Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/agent-hellboy/mcp-runtime/security-audit-platformnpx skills add Agent-Hellboy/mcp-runtime --skill security-audit-platformgit clone --depth 1 https://github.com/Agent-Hellboy/mcp-runtimeWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00123 | $0.03289 |
| Opus 5 | $0.00062 | $0.01644 |
| Sonnet 5 | $0.00025 | $0.00658 |
| Haiku 4.5 | $0.00012 | $0.00329 |
Grade B, and why
security-audit-platform scanned grade B with 3 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Sends data to an external URLlowData exfiltration
A POST to an outside endpoint may be telemetry or may be exfiltration; either way the mod talks to somewhere, and you should know where.
- **Large body**: `dd if=/dev/urandom bs=1M count=200 | curl -X POST --data-binary @- ...`; Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.
Cloud metadata endpointmediumServer-side request forgery
One request to 169.254.169.254 can return temporary IAM credentials.
`127.0.0.1`, `169.254.169.254`, `[::1]`, IPv6 zone IDs, schemes other than Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
got="$(curl -sS -o /dev/null -w "%{http_code}\n" -X "$method" "${headers[@]}" "$BASE$path")" How it starts
The opening of the file, as written. The whole thing — 268 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Security Audit — Platform-wide
Overview
Use this skill when the goal is a deep, repository-wide security assessment of
MCP Runtime, not a PR review. The output is a structured report with a threat
model, a per-endpoint authn/authz matrix, tenant-isolation probes, protocol
fuzz results, audit-log integrity tests, TLS hygiene, and DAST against a live
cluster. Findings use the shared template at
../_shared/FINDINGS-TEMPLATE.md.
This skill is intentionally heavy. Expect hours, not minutes. Skip nothing silently — every check that did not run becomes a recorded gap.
Step 1 — Build the threat model before running tools
Produce a STRIDE table per component. Components to cover:
- operator (
cmd/operator/,internal/operator/): reconcilesMCPServer,MCPAccessGrant,MCPAgentSession; injects gateway sidecar. - mcp-gateway (
services/mcp-gateway/): in-pod sidecar enforcing rendered policy, emitting audit events. - platform-api (
services/platform-api/): identity, admin, registry forward-auth. - runtime-api (
services/runtime-api/): runtime governance, deployments, registry push. - analytics-api (
services/analytics-api/): ClickHouse events and usage analytics. - sentinel-ui (
services/ui/): browser UI, login, dashboards. - sentinel-ingest (
services/ingest/): high-volume event intake. - sentinel-processor (
services/processor/): event processing, ClickHouse writes. - registry (
k8s/,config/): Distribution v2 registry (HTTP dev or HTTPS prod). - traefik plugins (
traefik-plugins/): PII redactor, dev-only middleware. - CRD types (
api/v1alpha1/): trust source for resource shapes. - CI (
.github/workflows/): build, sign, test, release pathways.
For each component fill: Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege. State preconditions, attacker, and impact.
Attacker profiles to enumerate:
- anon-public: someone reaching
platform.<domain>from the internet. - anon-cluster: a pod inside the cluster with no creds.
- authenticated-user: holds
UI_API_KEYor a logged-in session. - admin-user: holds an
ADMIN_API_KEYSvalue. - ingest-only: holds an
INGEST_API_KEYSvalue. - rogue-mcp-image: a malicious image pulled from the registry.
- rogue-tenant-agent: a session for tenant A trying to reach tenant B.
- mitm-ingress / mitm-registry: someone between client and ingress.
- compromised-CI-token: a leaked GH Actions secret.
What ships with it
3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 268 lines · 123 tokens per session scan B 22d9746d1e54
security-audit-platform is a skill published in the GitHub repository Agent-Hellboy/mcp-runtime (5 stars, last pushed 8d ago), licensed Apache-2.0. It adds 123 tokens to every session and 3,289 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it B with 3 findings (sends data to an external url, cloud metadata endpoint, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
local-frontend-check
Smoke-test or verify UI behaviour on the local Jarvis Registry frontend running at http://localhost/gateway. Use for manual regression checks, bug-fix verification, and end-to-end confirmation of specific flows without running the automated test suite.
release-notes
Create release notes for a new version tag. Gathers all commits, PRs, issues fixed, and breaking changes since a previous release. Creates the release notes markdown file, tags the repo, and pushes. Asks the user to confirm the base version to diff against.
agentcore-register
Given an MCP server URL, probe the server via curl to discover its metadata and tools, then generate a markdown file with copy-pasteable content for each field in the Amazon Bedrock AgentCore "Create record" form.
debug
Debug issues in the MCP Gateway Registry using first-principles thinking. Invoke when something is broken, timing out, returning errors, or behaving unexpectedly. Forces structured root-cause analysis before any code change is proposed.
search-benchmark
Generate a search quality benchmark for the AI Registry. Generates ground truth from the registry's assets, runs 100+ queries against the semantic search API, evaluates results using NDCG@10/MRR/Recall, and produces a markdown report. Use when you want to measure search quality after changes to the scoring algorithm…
benchmark-report
Generate a benchmark report from stress test results (registration, API performance, search concurrency). Reads JSON result files and produces a markdown report suitable for docs/benchmarks/.