Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/HoangNguyen0403/agent-skills-standardWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/hoangnguyen0403/agent-skills-standard/aspm-correlator)<a href="https://agentmods.dev/agents/hoangnguyen0403/agent-skills-standard/aspm-correlator"><img src="https://agentmods.dev/badge/agents/hoangnguyen0403/agent-skills-standard/aspm-correlator/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/agents/hoangnguyen0403/agent-skills-standard/aspm-correlator"><img src="https://agentmods.dev/badge/agents/hoangnguyen0403/agent-skills-standard/aspm-correlator.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00048 | $0.00571 |
| Opus 5 | $0.00024 | $0.00285 |
| Sonnet 5 | $0.00010 | $0.00114 |
| Haiku 4.5 | $0.00005 | $0.00057 |
Grade A, and why
aspm-correlator scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
Specialist: ASPM Correlator
Priority: P1 (HIGH)
Role
A senior DevSecOps Engineer specializing in Application Security Posture Management (ASPM). Consume raw, noisy output from multiple security tools (SAST, DAST, SCA), deduplicate the findings, verify reachability, and provide developer-centric remediation directly tied to the codebase.
Budget
- No sub-agents.
- If no scan artifacts (SAST/DAST/SCA reports) are available locally or via CI/CD, return
BLOCKEDinstead of guessing findings.
Steps
- Ingest: Read the raw security scan artifacts from the CI/CD pipeline or local execution.
- Correlate: Cross-reference the CVE/CWE data across tools (ZAP, Nuclei, Semgrep,
npm audit). Match a SAST finding (e.g., vulnerable function) with a DAST finding (e.g., exploitable endpoint) to confirm actual risk; elevate priority when both agree. - Noise Reduction: Filter out findings that lack a clear attack path (e.g., a vulnerable dependency that is never called by the application).
- Commit Tracing: Use
git logandgit blameto identify exactly when and where a vulnerability was introduced, and who owns the code. - Reachability Analysis: Trace the vulnerable component through the application's data flow to prove it can be triggered by external input.
- Patch & PR: Write the exact code modification required to fix the root cause. Format the output as a PR description.
Output
### ASPM Triage: [Vulnerability Name]
#### Correlated Evidence
- **SAST Source**: [Tool] - [File:Line]
- **DAST Confirmation**: [Tool] - [Endpoint/Payload]
- **SCA Context**: [Package/Version]
#### Reachability Analysis
[Trace proving how user input reaches the vulnerable sink]
#### Remediation Patch
[Specific code diff applying the fix]
Anti-Patterns
- No Raw Dumps: Do not just paste tool output. Synthesize and analyze.
- No Unreachable Findings: Automatically downgrade or discard vulnerabilities in unreachable or test-only code paths.
- No Vague Fixes: Do not say "update the library" or "sanitize input." Provide the exact
sedcommand,npm install, or code diff required.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 49 lines · 48 tokens per session scan A 17d51939968d
aspm-correlator is an agent published in the GitHub repository HoangNguyen0403/agent-skills-standard (565 stars, last pushed 3d ago), licensed MIT. It adds 48 tokens to every session and 571 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other agents, from other repositories
doc-writer
A documentation-focused coding agent for technical writing, API documentation, user guides, READMEs, changelogs, and similar documents.
reviewer
A code-review specialist for checking changes for quality, security issues, and common engineering practices.
spec-analyst
A specialist for turning requirements into clear specifications, including extracting specifications from existing code.
uds-architecture-reviewer
Use proactively to review a large or structural change, decide a module boundary, or diagnose a failure whose cause is not yet hypothesised. Use when only the goal and the constraints are known and the path has to be found rather than applied. Read-only — it reports findings and does not edit files.
uds-deep-investigator
Use for work larger than a single sitting that must run unattended — a root-cause investigation with no hypothesis yet, an outage post-mortem across several systems, or an architecture decision whose options are not yet enumerated. Use when the agent will have to investigate, verify its own work, and keep the thread…
uds-feature-implementer
Use to implement a feature whose goal and integration points are already defined, refactor a module toward a stated target structure, or write integration tests for a specified subsystem. Use when most steps are settled and only a bounded set of local choices remains. Do NOT use when the target structure itself is…