Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/ArieGoldkin/ai-agent-hubnpx agentmods add skills/ariegoldkin/ai-agent-hub/security-checklistWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/ariegoldkin/ai-agent-hub/security-checklist)<a href="https://agentmods.dev/skills/ariegoldkin/ai-agent-hub/security-checklist"><img src="https://agentmods.dev/badge/skills/ariegoldkin/ai-agent-hub/security-checklist/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/ariegoldkin/ai-agent-hub/security-checklist"><img src="https://agentmods.dev/badge/skills/ariegoldkin/ai-agent-hub/security-checklist.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00045 | $0.06167 |
| Opus 5 | $0.00023 | $0.03083 |
| Sonnet 5 | $0.00009 | $0.01233 |
| Haiku 4.5 | $0.00005 | $0.00617 |
Grade A, and why
security-checklist scanned grade A with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
response = requests.get(url) # Can access internal services! Runs shell commandslowCapability
Expected in a hook, worth knowing in a rule or an instructions file.
subprocess.run(f"cat {filename}", shell=True) How it starts
The opening of the file, as written. The whole thing — 963 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Security Checklist
Overview
This skill provides comprehensive security guidance for building secure applications. Whether performing a security audit, implementing new features, or hardening existing systems, this framework helps identify and mitigate common vulnerabilities.
When to use this skill:
- Conducting security audits or reviews
- Implementing authentication and authorization
- Validating and sanitizing user input
- Handling sensitive data (PII, credentials, payment info)
- Ensuring compliance (GDPR, HIPAA, SOC2)
- Preparing for security assessments or penetration tests
- Reviewing third-party dependencies for vulnerabilities
Required Tools
This skill requires the following tools to be installed on your system:
For JavaScript/TypeScript Projects
- Node.js 18+ with npm
- Command:
npm audit - Install: Node.js comes with npm pre-installed
For Python Projects
- Python 3.8+ with pip
- pip-audit: Security scanner for Python dependencies
- Install:
pip install pip-audit - Command:
pip-audit
- Install:
Optional (Advanced Security Scanning)
-
Semgrep: Static analysis tool
- Install (macOS):
brew install semgrep - Install (pip):
pip install semgrep - Command:
semgrep --config=auto .
- Install (macOS):
-
Bandit: Python security linter
- Install:
pip install bandit - Command:
bandit -r .
- Install:
-
TruffleHog: Secrets detection
- Install (macOS):
brew install trufflesecurity/trufflehog/trufflehog - Install (Go):
go install github.com/trufflesecurity/trufflehog/v3@latest - Command:
trufflehog filesystem .
- Install (macOS):
Installation Verification
# Verify Node.js & npm
node --version
npm --version
# Verify Python & pip
python --version
pip --version
# Verify pip-audit
pip-audit --version
# Verify optional tools
semgrep --version
bandit --version
trufflehog --version
Note: The skill will automatically detect which tools are available and use appropriate commands for your project type.
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 10d ago First seen · 963 lines · 45 tokens per session scan A f5767e7b1494
security-checklist is a skill published in the GitHub repository ArieGoldkin/ai-agent-hub (11 stars, last pushed 9mo ago), licensed MIT. It adds 45 tokens to every session and 6,167 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 2 findings (makes network calls, runs shell commands). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
security-audit
Audit code and infrastructure for security vulnerabilities. Use when performing security reviews, checking for OWASP Top 10 issues, auditing dependencies, or hardening applications.
testing-api-authentication-weaknesses
Tests API authentication mechanisms for weaknesses including broken token validation, missing authentication on endpoints, weak password policies, credential stuffing susceptibility, token leakage in URLs or logs, and session management flaws. The tester evaluates JWT implementation, API key handling, OAuth flows, and…
API Security Testing
Comprehensive API security testing based on OWASP API Security Top 10 including broken authentication, injection attacks, rate limiting, BOLA/BFLA vulnerabilities, and automated security scanning with ZAP and custom scripts.
Web Application Security Testing
OWASP Top 10 testing, injection vulnerability detection, API security assessment, authentication testing, and web vulnerability reporting for authorized assessments.
security-patterns
Security patterns for authentication, defense-in-depth, input validation, OWASP Top 10, LLM safety, and PII masking. Use when implementing auth flows, security layers, input sanitization, vulnerability prevention, prompt injection defense, or data redaction.
security-expert
Expert-level application security, OWASP Top 10, penetration testing, and security best practices. Use when the user mentions OWASP, pentesting, appsec, vulnerability, encryption, or authentication, or when the task involves Security Principles, OWASP Top 10, Security Domains, or Broken Access Control.