Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add akashsebastian333/peephole --skill sec-reviewgit clone --depth 1 https://github.com/akashsebastian333/peepholeWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/akashsebastian333/peephole/sec-review)<a href="https://agentmods.dev/skills/akashsebastian333/peephole/sec-review"><img src="https://agentmods.dev/badge/skills/akashsebastian333/peephole/sec-review/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/akashsebastian333/peephole/sec-review"><img src="https://agentmods.dev/badge/skills/akashsebastian333/peephole/sec-review.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00052 | $0.00620 |
| Opus 5 | $0.00026 | $0.00310 |
| Sonnet 5 | $0.00010 | $0.00124 |
| Haiku 4.5 | $0.00005 | $0.00062 |
Grade A, and why
sec-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 48 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Peephole security review
Peephole's write-time gate catches present insecure patterns. This review adds the part a regex cannot prove: missing guards. Review the current diff against this checklist and report concrete findings with file:line.
Present (Peephole enforces these at write time — verify none slipped through in audit mode):
- CWE-89 SQL injection — string-built queries instead of parameters
- CWE-94 code injection — eval/exec/new Function on dynamic input
- CWE-502 unsafe deserialization — pickle/yaml.load/node-serialize on untrusted data
- CWE-79 XSS — unescaped output, dangerouslySetInnerHTML,
| safe - CWE-78 command injection — shell=True / exec with interpolation
- CWE-22 path traversal — join(base, user_input) without containment check
- CWE-798 hardcoded secrets
- CWE-327 weak crypto — fast/unsalted password hashes, ECB, non-CSPRNG for secrets
- CWE-1188 disabled controls — verify=False, DEBUG=True, csrf_exempt, wildcard CORS+credentials
Absence — cannot be regex-proven; check by reading (this is where real bugs hide):
- CWE-862/863 missing/incorrect authorization on state-changing or cross-user routes
- CWE-639 IDOR — object lookups keyed on a client-supplied id without ownership scoping
- CWE-352 CSRF on state-changing endpoints
- CWE-306 missing authentication on a sensitive endpoint
- CWE-770 missing rate limiting on expensive or auth endpoints
For each finding: state the CWE, the file:line, the exploit in one sentence, and the fix.
Challenge every finding before reporting it (3 lenses)
A finding survives only if you fail to disprove it. Before reporting each one, try to refute it from all three angles — report only the ones that survive:
- REACHABILITY — can an attacker actually reach the sink? Is the source genuinely attacker-controlled? Is the path reachable in a default deployment, or is there a guard on every route (not just the one you first looked at)?
- IMPACT — if they reach it, does it matter? Is the claimed consequence the real one? Is the data actually sensitive, the write actually dangerous?
- DEFENSES — is something already stopping it — a framework default, middleware, a type, an escape, a prepared statement, a check one frame up?
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago First seen · 48 lines · 52 tokens per session scan A f049e636641a
sec-review is a skill published in the GitHub repository akashsebastian333/peephole (5 stars, last pushed 13d ago), licensed MIT. It adds 52 tokens to every session and 620 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
assessing-vector-and-embedding-weaknesses
Test vector stores for embedding inversion, cross-tenant leakage, and poisoning.
detecting-data-and-model-poisoning
Identify poisoned training data and backdoored models across the ML pipeline.
detecting-model-extraction-attacks
Detect model stealing, model inversion, and membership inference performed through inference-API abuse by monitoring query patterns, applying output perturbation, and red-teaming your own model's extractability.
orchestrating-llm-attacks-with-pyrit
Build multi-turn, Crescendo, and Tree-of-Attacks-with-Pruning (TAP) automated attack chains against conversational LLM agents using Microsoft PyRIT, with adversarial chat and scorer feedback loops.
securing-agentic-ai-tool-invocation
Apply least-privilege tool allowlisting, identity binding, and human-in-the-loop controls for agent tool calls.
continuous-llm-red-teaming-with-promptfoo
Wire Promptfoo and DeepTeam into CI/CD for automated regression red-teaming of LLM apps against OWASP LLM Top 10 and OWASP Agentic presets, failing the build when jailbreak or injection vulnerabilities regress.