Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add ApexIQ/skillsmith --skill security_auditgit clone --depth 1 https://github.com/ApexIQ/skillsmithWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/apexiq/skillsmith/security_audit)<a href="https://agentmods.dev/skills/apexiq/skillsmith/security_audit"><img src="https://agentmods.dev/badge/skills/apexiq/skillsmith/security_audit.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00027 | $0.00501 |
| Opus 5 | $0.00014 | $0.00251 |
| Sonnet 5 | $0.00005 | $0.00100 |
| Haiku 4.5 | $0.00003 | $0.00050 |
Grade A, and why
security-audit scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
🔒 Security Audit
Rule: Assume every input is malicious. Verify everything.
OWASP Top 10 Checklist
1. Injection (SQL, NoSQL, Command)
- Using parameterized queries? (SQLModel does this automatically)
- Never concatenating user input into queries?
2. Broken Authentication
- Passwords hashed with bcrypt/argon2?
- Session tokens are random and long (>128 bits)?
- Rate limiting on login endpoints?
3. Sensitive Data Exposure
- API keys/secrets in environment variables, NOT code?
- HTTPS enforced?
- Logging does NOT include passwords or tokens?
4. Broken Access Control (CRITICAL for this app)
- Ownership check on EVERY resource access?
if resource.user_id != current_user.id: raise HTTPException(404) # Return 404, not 403 - Admin endpoints require admin role?
5. Security Misconfiguration
- Debug mode OFF in production?
- Default credentials changed?
- CORS restricted to allowed origins?
6. XSS (Cross-Site Scripting)
- User-generated content sanitized before rendering? (React auto-escapes)
-
dangerouslySetInnerHTMLavoided or sanitized?
7. Insecure Deserialization
- Using Pydantic for all input validation?
- Not using
pickleon untrusted data?
Examples
- Vulnerable:
cursor.execute(f"SELECT * FROM users WHERE id = {user_input}") - Secure:
cursor.execute("SELECT * FROM users WHERE id = ?", (user_input,))
Guidelines
- Run
bandit(Python) andnpm audit(JS) in CI. - When in doubt, return 404 instead of 403 (don't leak existence).
- Log security-relevant events (login attempts, access denials).
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 7d ago First seen · 64 lines · 27 tokens per session scan A effcbdef0778
security-audit is a skill published in the GitHub repository ApexIQ/skillsmith (5 stars, last pushed 5mo ago), licensed MIT. It adds 27 tokens to every session and 501 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
security-audit
Audit code and infrastructure for security vulnerabilities. Use when performing security reviews, checking for OWASP Top 10 issues, auditing dependencies, or hardening applications.
Security Audit Code Reviewer
Expert security-focused code review that catches vulnerabilities OWASP Top 10 and beyond. Reviews any language, any framework, with remediation guidance.
ai-security-review
Use this skill to audit an AI system for security vulnerabilities including prompt injection, sensitive data exposure, excessive agent permissions, unsafe tool calls, and insecure output handling. Grounded in OWASP GenAI LLM Top 10 (2026). Activates before production deployment of any LLM-based application, agent, or…
007
Security audit, hardening, threat modeling (STRIDE/PASTA), Red/Blue Team, OWASP checks, code review, incident response, and infrastructure security for any project.
pptx
Extract text from Microsoft PowerPoint presentations.
xlsx
Extract data from Excel and CSV files.