Before installing a security checker for a code review, inspect the checker itself. A skill is a folder of instructions the model opens when it decides it needs them. We measured 15,178 security skills. That makes the checker part of the safety check.
What a security skill is, and how many there are
The context is everything the model can see while it answers you. A skill may start as a name and description. When chosen, its full body enters the context. Of 15,178 skills, 14,662 load something every session; 516 wait until needed.
The original is the first copy of a file we saw; everything matching it afterwards is a copy. The catalogue marks 14,099 as original, with no near-duplicates. That tells you where a file came from, not whether its instructions deserve trust.
What a security skill costs before it checks anything
The median preload costs 57 tokens every session. A token is the unit your AI plan bills by, about three quarters of a word. The top tenth starts at 141 tokens.
Assuming 20 sessions a day, the 57-token median totals 1,140 tokens across a day. An on-demand skill costs nothing until it loads. Its median full body is 1,048 tokens; across all full bodies, the median is 1,544 tokens.
The heaviest every-session entry is atproto-oauth, at 711 tokens. It may be useful, but its preload is part of every session before its OAuth instructions matter.
What the safety scan found in 15,178 skills
The scan placed 13,437 skills at grade A, 1,057 at B, 680 at C or D, and 4 at E or F. Network access was the most common finding, appearing in 2,287 skills. Another 613 ask for root. A further 464 run shell commands, and 328 contain recursive force deletion.
The range is visible in careful, which received grade C for recursive force deletion. aws-penetration-testing combines root access, cloud metadata access, and network calls. analyzing-docker-container-forensics received grade D for root access, credential files, and network calls.
Each finding gives you the file line that triggered it. Read that evidence and decide whether the access fits your task. The scan reports a signal, not the whole value or safety of the skill.
Security skills worth opening first
These choices fit code review, application security and release checking.
- cso: audits applications and delivery processes for secrets, unsafe dependencies, weak pipelines, AI risks, and web vulnerabilities. 12 tokens every session, 940 lines, grade A, original, 0 copies.
- django-security: reviews Django authentication, permissions, injection protection, cookies, HTTPS, and deployment settings. 30 tokens every session, 594 lines, grade A, original, 14 copies.
- chrome-release-verify: finds missing Chrome security fixes, validates patches, and prepares an Electron pull request. 121 tokens every session, 140 lines, grade A, original, 0 copies.
- critique: checks repository scripts and GitHub Actions for technical, timing, data, performance, and security problems. 23 tokens every session, 146 lines, grade A, original, 0 copies.
- Verification & Quality Assurance: checks correctness, security, code practices, and regressions through verification workflows. 36 tokens every session, 694 lines, grade A, original, 3 copies.
When a hook is the better safety net
A security skill gives the model instructions for inspecting code. It cannot fire on an event by itself. A hook is a shell command your agent runs for you when something happens.
Choose a hook when you need a check before a tool call, after a result, or at session end. The hook-development mod is better for building that event-driven behaviour. Choose a skill when the model needs judgement across code, dependencies, or release changes.
Questions people ask
Can an A grade settle the choice? No. A clean scan cannot tell you whether the skill suits your repository or whether its preload is worthwhile. The catalogue records 106 reviewed skills, including 1 marked high risk.
How much does an on-demand skill use? Its median full body is 1,048 tokens when loaded. The catalogue’s median CLAUDE.md file is 1,296 tokens, so occasional work may justify waiting for a match.
What should I do when the checker wants root access? Treat it as a stop-and-check condition. Ask why it needs that access, look for a narrower alternative, and install it only when the reason is clear.
Do it now
Run npx agentmods add <slug> to install a skill you have chosen, or browse the skills catalogue.