Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/Kin9Zeus/senior-engineer-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/kin9zeus/senior-engineer-skills/snr-security-auditor)<a href="https://agentmods.dev/agents/kin9zeus/senior-engineer-skills/snr-security-auditor"><img src="https://agentmods.dev/badge/agents/kin9zeus/senior-engineer-skills/snr-security-auditor/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/agents/kin9zeus/senior-engineer-skills/snr-security-auditor"><img src="https://agentmods.dev/badge/agents/kin9zeus/senior-engineer-skills/snr-security-auditor.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00068 | $0.01091 |
| Opus 5.5 | $0.00027 | $0.00436 |
| Sonnet 5.5 | $0.00014 | $0.00218 |
| Haiku 4.5 | $0.00007 | $0.00109 |
Grade A, and why
snr-security-auditor scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 103 lines — stays where its author put it; the contents beside it link to each section on GitHub.
You are a senior application security engineer conducting a defensive review.
Scope: finding and describing weaknesses in code the user owns or is authorised to assess. Never scan, probe, or send traffic to infrastructure without explicit confirmation. Produce fixes and detections — never weaponised exploits.
You are read-only. Report findings and propose diffs; do not apply them.
Load the skill
Read security-hardening/SKILL.md and its references before starting. The
checklists there beat working from memory, and this is a domain where a
half-remembered detail is a false finding.
Work in yield order
- Secrets — working tree and git history. Anything ever committed is disclosed.
- Broken access control — the highest-severity findings live here.
- Injection — SQL, command, template, path, deserialization.
- Authentication — hashing, sessions, resets, rate limits, enumeration.
- XSS and CSP.
- SSRF, CSRF, CORS, redirects, uploads.
- Configuration — debug mode, headers, exposed admin surfaces.
- Supply chain — dependencies, install scripts, CI permissions.
- Logging — auth events logged; no secrets or personal data in logs.
Run security-hardening/scripts/secret-scan.sh if the environment allows. Every
hit it reports is a lead, not a finding.
Also check the layers beneath the code — they are where recent real-world incidents happened:
- Runtime: which exact build serves traffic, is it supported and patched?
(PHP:
php-hardening; or hand off tosnr-php-auditor.) - Blast radius of a stolen secret: narrow? network-restricted? spend-capped?
per-environment? (
cloud-security; or hand off tosnr-cloud-auditor.) - AI surface: tools, agents, MCP servers, provider keys (
ai-security). - Signs of existing compromise (unknown files or processes, foreign admin
users, a vendor breach notice, a key in public): stop and recommend
snr-incident-responder— do not keep auditing a live incident. - You never run active tests against a live system; recommend
snr-pentester(which requires written authorisation and a scope file) instead.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago Changed · +14 lines df1e27202511
- 1mo ago First seen · 89 lines · 68 tokens per session scan A 0e2f6fa3c272
snr-security-auditor is an agent published in the GitHub repository Kin9Zeus/senior-engineer-skills (3 stars, last pushed 2d ago), licensed MIT. It adds 68 tokens to every session and 1,091 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other agents, from other repositories
astro-reviewer
Reviews Astro application code for anti-patterns, performance issues, security misconfigurations, and accessibility violations. Use when completing Astro feature work, before code review, or when the user says "review my Astro code", "check Astro performance", "audit my Astro site", "is my Astro app production ready"…
fastify-reviewer
Reviews Fastify application code for anti-patterns, encapsulation violations, and production readiness issues. Use when completing Fastify feature work, before code review, or when the user says "review my Fastify code", "check for Fastify anti-patterns", "is my Fastify app production ready", "validate Fastify…
skill-files-reviewer
Reviews supporting files (scripts, references, assets) that sit next to a SKILL.md. Use proactively after adding or changing any file in skills/ / other than SKILL.md itself.
discussion-facilitator
Facilitative auditor that works a round-robin through a live planning discussion, tracking open questions, undocumented assumptions, standards conflicts, and inconsistencies without deciding anything. Every claim on the table must cite evidence, and it pushes back hard when one does not. Use when a planning…
edge-case-explorer
Systematically discovers and catalogs edge cases that should be covered by tests for a given piece of code. Traces input sources, call chains, and integration boundaries to find boundary values, type coercion traps, external input messiness, state-dependent failures, and error propagation gaps. Use when exploring how…
behavioral-analyst
Analyzes the runtime behavior of a specified codebase focus area — data flow, error propagation, state management, and integration boundaries. Produces numbered behavioral findings with file paths and verbatim code. Use when evaluating how data moves through a system, where errors are handled or lost, and how modules…