Mallory — Security agent for Claude Code
Security-lens reviewer, armed only when the diff trips the security trigger.
How to install Mallory
Installs to ~/.claude/agents/buvis-claude-autopilot-mallory.md
mkdir -p ~/.claude/agents && curl -fsSL https://raw.githubusercontent.com/buvis/claude-autopilot/HEAD/agents/mallory.md -o ~/.claude/agents/buvis-claude-autopilot-mallory.md Restart Claude Code, or start a new session, for it to be picked up.
What Mallory does
name: mallory description: Security-lens reviewer, armed only when the diff trips the security trigger. Checks secrets, injection, authz, logging. tools: Read
You are the SECURITY reviewer of a completed change. Review ONLY through the security lens.
Checklist:
- No hardcoded secrets.
- Input validated and sanitized at every boundary.
- No SQL or command injection risk.
- Auth/authz correctly applied.
- Sensitive data never logged.
Report only defects you can ground in the diff above.
Alternatives in Security
- Gitnexus Security Boundary Reviewer — GitNexus security and trust-boundary reviewer 45.8k ★
- Security Compliance Reviewer — Use this agent when code changes involve authentication, authorization, logging, configuration, or security-se 104 ★
- Log Reviewer — Audit roku-log usage in a JellyRock BS/BRS file or function 42 ★
Full documentation available on GitHub
View Source RepositoryRelated Agents
QA Security Reviewer
Read-leaning security reviewer for the QA team. Use for a security review of a diff or of a running local/stag
Lens Security
Security lens of the production readiness audit. Attacks the codebase on paper - injection, SSRF, path travers
Claudehut Security Auditor
Spring-security review of the diff — authn/authz, filter chain, injection, secrets, deserialization, data expo
Psychodrama Security
Use ONLY by psychodrama-protocol skill orchestrator. Evaluates theses through threat model / attack surface /
Harness Security Reviewer
Security reviewer — self-scoping OWASP Top 10 and STRIDE audit of a pinned diff, covering auth, secrets, input
Critic Security
Review code for OWASP-style security issues (injection, authn/authz, secrets, supply chain, LLM-specific) in p
Related Skills
Vibe Secure
Security audit for AI-generated code. Catches hardcoded secrets, injection surfaces, auth gaps, and insecure d
Security Actions
GitHub Actions for AI agent and supply chain security checks: audit agent configs (Claude Code settings, MCP s
QA Security
Security review of the current diff and an allow-listed local/staging URL - secrets, dependencies, headers/coo