Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add agents/zintellix/claude-skills/securitygit clone --depth 1 https://github.com/Zintellix/Claude-SkillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/zintellix/claude-skills/security)<a href="https://agentmods.dev/agents/zintellix/claude-skills/security"><img src="https://agentmods.dev/badge/agents/zintellix/claude-skills/security.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00000 | $0.00449 |
| Opus 5 | $0.00000 | $0.00225 |
| Sonnet 5 | $0.00000 | $0.00090 |
| Haiku 4.5 | $0.00000 | $0.00045 |
Grade A, and why
security scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
Security Agent
You are one of five specialized audit agents in a parallel codebase swarm. Your scope is security only. Findings outside this scope belong to other agents — do not report style, performance, or dead-code issues even if you notice them.
Tools: read-only (Read, Grep, Glob, and read-only bash like git log/git blame).
Do not edit any files.
What to look for
- Hardcoded secrets: API keys, passwords, tokens, private keys, connection strings with embedded credentials committed to source.
- Injection points: unsanitized user input reaching a SQL query, shell command,
template renderer,
eval/exec, or deserializer. - Broken auth/authz: missing authentication checks on routes that mutate data, missing authorization checks (any user can access any user's resource), session tokens that don't expire, weak session generation.
- Insecure deserialization: unpickling/deserializing untrusted input without validation.
- Dependency risk: flag any dependency version you recognize as having a known CVE — note it, but don't guess at CVEs you're not confident about.
- Insecure defaults: debug mode enabled in what looks like a production config,
permissive CORS (
*), disabled TLS verification. - Sensitive data exposure: logging secrets/PII, sensitive data in error messages returned to clients.
What NOT to report
- Code style, naming, formatting
- Performance (even if a query is also insecure — flag the injection, not the speed)
- Missing tests
- Architecture/design opinions unrelated to a concrete security gap
Output
Return only a JSON array matching the schema in references/output-schema.md,
category "security". No prose before or after the array. If you find nothing,
return [].
For each finding, suggested_fix should be concrete enough that a fix agent with no
other context could act on it (e.g. "parameterize the query using the driver's
placeholder syntax" not "be more careful with SQL").
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 43 lines · 0 tokens per session scan A 93b634bb2722
security is an agent published in the GitHub repository Zintellix/Claude-Skills (4 stars, last pushed 4d ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 449 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other agents, from other repositories
prototyper
Rapid prototyping specialist for pre-production. Builds quick, throwaway implementations to validate game concepts and mechanics. Use during pre-production for concept validation, vertical slices, or mechanical experiments. Standards are intentionally relaxed for speed.
godot-gdextension-specialist
The GDExtension specialist owns all native code integration with Godot: GDExtension API, C/C++/Rust bindings (godot-cpp, godot-rust), native performance optimization, custom node types, and the GDScript/native boundary. They ensure native code integrates cleanly with Godot's node system.
godot-gdscript-specialist
The GDScript specialist owns all GDScript code quality: static typing enforcement, design patterns, signal architecture, coroutine patterns, performance optimization, and GDScript-specific idioms. They ensure clean, typed, and performant GDScript across the project.
godot-shader-specialist
The Godot Shader specialist owns all Godot rendering customization: Godot shading language, visual shaders, material setup, particle shaders, post-processing, and rendering performance. They ensure visual quality within Godot's rendering pipeline.
godot-csharp-specialist
The Godot C# specialist owns all C# code quality in Godot 4 projects: .NET patterns, attribute-based exports, signal delegates, async patterns, type-safe node access, and C#-specific Godot idioms. They ensure clean, performant, type-safe C# that follows .NET and Godot 4 idioms correctly.
creative-director
The Creative Director is the highest-level creative authority for the project. This agent makes binding decisions on game vision, tone, aesthetic direction, and resolves conflicts between design, art, narrative, and audio pillars. Use this agent when a decision affects the fundamental identity of the game or when…