Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/briiirussell/cybersecurity-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/rules/briiirussell/cybersecurity-skills/scanner-pipeline)<a href="https://agentmods.dev/rules/briiirussell/cybersecurity-skills/scanner-pipeline"><img src="https://agentmods.dev/badge/rules/briiirussell/cybersecurity-skills/scanner-pipeline/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/rules/briiirussell/cybersecurity-skills/scanner-pipeline"><img src="https://agentmods.dev/badge/rules/briiirussell/cybersecurity-skills/scanner-pipeline.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00192 | $0.05061 |
| Opus 5.5 | $0.00077 | $0.02024 |
| Sonnet 5.5 | $0.00038 | $0.01012 |
| Haiku 4.5 | $0.00019 | $0.00506 |
Grade A, and why
scanner-pipeline scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
curl -s -H "Authorization: Bearer $SUPABASE_ACCESS_TOKEN" \ How it starts
The opening of the file, as written. The whole thing — 234 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Scanner Pipeline — Run the Real Tools, Normalize, Hand Off
Stop asking the agent to hack your app. Have it pick the right deterministic scanner for each layer, run it non-interactively, merge the output into one format, and route each finding to a fix agent. Scanners find the same thing every time; an agent review finds it when it happens to look.
Field evidence from a 45-app sweep in October 2026 (patch-sweep). An agent-led review eventually found all of these; a scanner would have flagged each one on the first run:
- 10 Supabase tables with RLS disabled, readable and writable with the public anon key — including 472k inbound email bodies. Supabase's own security advisor reports this as
rls_disabled_in_public. - An always-true RLS policy:
csr.collection_id = csr.collection_id. A custom semgrep rule over migrations catches it (below). - Separate
npm audit,pnpm audit, andbundle-auditruns per repo, where oneosv-scannerpass covers every lockfile.
This skill orchestrates. Interpreting a tool's findings in depth stays with the layer skill: secrets-audit, dependency-audit, container-audit, cloud-audit, owasp-audit. Active exploitation is web-pentest / red-team-engagement.
Why Write is pre-approved: this skill's main output is files — the scanner-pipeline.md plan, a .github/workflows/security-scan.yml, and scanner configs. It writes only those, and only inside the target repo. Live-app scanners (nuclei, zap) are deliberately not pre-approved; they always prompt.
Cross-references: finding-triage (ranking and disposition), secrets-audit, dependency-audit, container-audit, cloud-audit (Supabase advisors, PaaS), web-pentest (authorization for live scans), agent-supply-chain-audit (SHA-pinned Actions), patch-sweep (fleet CVE response), log-watch.
Authorization
Before running anything, confirm:
- Repos: the user owns or is authorized to scan each one. For fleet mode, the owners/orgs to enumerate.
- Live targets: only domains the user owns and names explicitly in this conversation. Not "whatever the repo deploys to" — the user says the hostnames.
- Where results go: local files only, GitHub code scanning, or issues. Secret findings never go into a public issue.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- today First seen · 234 lines · 192 tokens per session scan A f24435d3a573
scanner-pipeline is a cursor rule published in the GitHub repository briiirussell/cybersecurity-skills (435 stars, last pushed today), licensed MIT. It adds 192 tokens to every session and 5,061 once invoked, about $0.0008 per session on Opus 5.5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-27.
Other cursor rules, from other repositories
beanstalk-deploy
Robust deployment patterns for Elastic Beanstalk with GitHub Actions, Pulumi, and edge case handling.
vibes-plug-devops
Vibes-Plug Cloud & DevOps Platform Engineering — Docker BuildKit, distroless runtimes, Kubernetes GitOps, and GitHub Actions OIDC.
agents-shipgate
Run Agents Shipgate as the deterministic merge gate for AI-generated agent capability changes.
cursor-asdd
ASDD contribution rules for this repository.
agents
Agent engineering standards — Agents (TR-SEC-003).
infra-devops
Infrastructure, Cloud, Terraform, Docker & CI/CD Agent.