Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add anyshift-io/sre-skills --skill sg-deceptive-reachability-auditorgit clone --depth 1 https://github.com/anyshift-io/sre-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/anyshift-io/sre-skills/sg-deceptive-reachability-auditor)<a href="https://agentmods.dev/skills/anyshift-io/sre-skills/sg-deceptive-reachability-auditor"><img src="https://agentmods.dev/badge/skills/anyshift-io/sre-skills/sg-deceptive-reachability-auditor/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/anyshift-io/sre-skills/sg-deceptive-reachability-auditor"><img src="https://agentmods.dev/badge/skills/anyshift-io/sre-skills/sg-deceptive-reachability-auditor.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00253 | $0.03675 |
| Opus 5 | $0.00127 | $0.01837 |
| Sonnet 5 | $0.00051 | $0.00735 |
| Haiku 4.5 | $0.00025 | $0.00367 |
Grade A, and why
sg-deceptive-reachability-auditor scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 248 lines — stays where its author put it; the contents beside it link to each section on GitHub.
sg-deceptive-reachability-auditor
Reachability-audit skill for a fleet of AWS security groups. Takes the
describe-security-groups output for the fleet (plus describe-instances for the
instance-to-SG membership), composes the SG-to-SG references into a directed graph,
and answers one question a per-rule read cannot: from a named entry point, what can
actually be reached, and does any path reach the crown-jewel tier. It returns the
shortest path, the blast radius, and any pivot hub, ranked by severity, then names
exactly where the SG graph stops being able to answer the question.
The job is a graph problem, and the whole point of the skill is the composition the
graph makes visible. A per-rule read sees "app accepts from web" and "db accepts from
app" as two individually fine rules and never assembles that internet -> web -> app -> db is one reachable path. In a fleet of 10-13 security groups, that chain is buried
among scoped tiers (bastion, monitoring, ci, ssm) and app-fed leaves (cache, queue,
logs), and the loud 0.0.0.0/0 rule on the front door draws the eye away from it. This
skill composes the edges instead of clearing each rule in isolation.
When to invoke
- An agent is asked to review a security-group fleet for lateral movement, blast radius, or "can the internet reach the database."
- A fleet is being shipped or changed and the question is whether a low-trust tier can reach a sensitive one transitively, not just directly.
- An incident assumes a host is compromised and the question is what that foothold can pivot to.
- A fleet looks segmented and the claim "the database is isolated" needs to be confirmed against the actual edges rather than taken on trust.
What this skill reads, and what it does not
It reads the static configuration of a fleet of security groups plus the
instance-to-SG membership. Both are EC2 control-plane reads
(describe-security-groups, describe-instances). That is the entire input. The audit
is correct and complete for what the SG graph can tell you, and it is explicit about
the rest. Reachability-on-paper is not exploitability, and every audit ends by naming
the joins it cannot make:
What ships with it
39 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- FAILURE_MODES.md 3.4 KB
- fixtures/01-orphaned-front-internal-cidr/instances.json 1.2 KB
- fixtures/01-orphaned-front-internal-cidr/meta.json 378 B
- fixtures/01-orphaned-front-internal-cidr/security-groups.json 6.8 KB
- fixtures/02-public-alb-no-sg-ref/instances.json 1.2 KB
- fixtures/02-public-alb-no-sg-ref/meta.json 477 B
- fixtures/02-public-alb-no-sg-ref/security-groups.json 7.1 KB
- fixtures/03-disjoint-public-vpn-islands/instances.json 1.4 KB
- fixtures/03-disjoint-public-vpn-islands/meta.json 569 B
- fixtures/03-disjoint-public-vpn-islands/security-groups.json 6.8 KB
- fixtures/04-broken-segment-midchain/instances.json 1.2 KB
- fixtures/04-broken-segment-midchain/meta.json 541 B
- fixtures/04-broken-segment-midchain/security-groups.json 6.3 KB
- fixtures/05-six-hop-cdn-waf-gw-app-svc-db/instances.json 1.4 KB
- fixtures/05-six-hop-cdn-waf-gw-app-svc-db/meta.json 394 B
- fixtures/05-six-hop-cdn-waf-gw-app-svc-db/security-groups.json 8.0 KB
- fixtures/06-compromised-ci-runner-deep/instances.json 1.6 KB
- fixtures/06-compromised-ci-runner-deep/meta.json 466 B
- fixtures/06-compromised-ci-runner-deep/security-groups.json 7.5 KB
- fixtures/07-five-hop-ingress-mesh-broker-db/instances.json 1.2 KB
- fixtures/07-five-hop-ingress-mesh-broker-db/meta.json 394 B
- fixtures/07-five-hop-ingress-mesh-broker-db/security-groups.json 7.4 KB
- tests/_deep.py 3.0 KB runs code
- tests/_reach_engine.py 21 KB runs code
- tests/_replay.py 881 B runs code
- tests/eval/eval_results.json 562 KB
- tests/eval/judge_prompt.md 3.2 KB
- tests/eval/README.md 4.3 KB
- tests/eval/rubric.md 4.7 KB
- tests/eval/run_eval.py 20 KB runs code
- tests/eval/scenarios.py 13 KB runs code
- tests/README.md 3.1 KB
- tests/replay_01_orphaned_front_internal_cidr.py 1.9 KB runs code
- tests/replay_02_public_alb_no_sg_ref.py 1.9 KB runs code
- tests/replay_03_disjoint_public_vpn_islands.py 2.0 KB runs code
- tests/replay_04_broken_segment_midchain.py 2.0 KB runs code
- tests/replay_05_six_hop_cdn_waf_gw_app_svc_db.py 1.8 KB runs code
- tests/replay_06_compromised_ci_runner_deep.py 2.0 KB runs code
- tests/replay_07_five_hop_ingress_mesh_broker_db.py 1.8 KB runs code
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago First seen · 248 lines · 0 tokens per session scan A 9ec4d3495670
sg-deceptive-reachability-auditor is a skill published in the GitHub repository anyshift-io/sre-skills (17 stars, last pushed 15d ago), licensed Apache-2.0. It adds 253 tokens to every session and 3,675 once invoked, about $0.0013 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
legal-issue-research
A systematic research assistant for Chinese law. It searches laws, regulations, judicial interpretations, guiding cases, and typical cases, then organizes the legal sources and how they relate.
multi-jurisdictional-research-zacharie-laik
Conducts multi-jurisdictional legal research and risk assessment across 50+ countries using the Legal Data Hunter MCP, producing cited comparative analyses of case law, legislation, and doctrine.
recht-erbe-verfahren
Austrian probate and inheritance procedure — Verlassenschaftsverfahren (AußStrG §§143ff), Erbantrittserklärung, Erbrechtsklage, Pflichtteilsklage, Testamentsanfechtung, EU-ErbVO cross-border estates, Erbschaftsmediation, and procedural templates for inheritance disputes.
yuandian-law-search
A search tool for Chinese legal provisions and court cases using the Yuandian open platform. It archives search results locally for later review.
paper-to-cn-patent
Convert finished research papers, figures, and author notes into Chinese invention patent application drafts. Use when Codex needs to rewrite a paper as a China invention patent, draft claims, abstract, specification sections, and figure descriptions, assess whether the source materials are sufficient for patent…
software-copyright
A guided workflow for preparing Chinese software copyright registration materials from a real software project. It produces drafts such as application details, source-code documents, and a user manual.