Borrowing it
Nothing to install: this file belongs to AsiaOstrich/EngramGraph. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/AsiaOstrich/EngramGraph/main/.agents/skills/security-scan-assistant/SKILL.mdgit clone --depth 1 https://github.com/AsiaOstrich/EngramGraphWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/asiaostrich/engramgraph/security-scan-assistant)<a href="https://agentmods.dev/skills/asiaostrich/engramgraph/security-scan-assistant"><img src="https://agentmods.dev/badge/skills/asiaostrich/engramgraph/security-scan-assistant/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/asiaostrich/engramgraph/security-scan-assistant"><img src="https://agentmods.dev/badge/skills/asiaostrich/engramgraph/security-scan-assistant.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00072 | $0.01153 |
| Opus 5.5 | $0.00029 | $0.00461 |
| Sonnet 5.5 | $0.00014 | $0.00231 |
| Haiku 4.5 | $0.00007 | $0.00115 |
Grade A, and why
scan scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 14d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 98 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Security Scan Assistant | 安全掃描助手
Automate security scanning for dependencies, secrets, and license compliance.
自動化相依套件、機密資訊和授權合規的安全掃描。
Scan Types | 掃描類型
| Type | Tool Examples | Purpose | 用途 |
|---|---|---|---|
| Dependency audit | npm audit, pip-audit, Snyk | Find known CVEs in dependencies | 檢測相依套件已知 CVE |
| Secret detection | gitleaks, trufflehog | Find leaked credentials in code | 偵測程式碼中洩漏的憑證 |
| License compliance | license-checker, SPDX | Verify OSS license compatibility | 驗證開源授權相容性 |
| SAST | Semgrep, CodeQL | Static analysis for code patterns | 靜態分析程式碼模式 |
Tool Integration | 工具整合
| Tool | Command | Scope | 範圍 |
|---|---|---|---|
| npm audit | npm audit --json |
Node.js dependencies | Node.js 相依套件 |
| Snyk | npx snyk test |
Multi-language deps | 多語言相依套件 |
| Trivy | trivy fs . |
Filesystem & containers | 檔案系統與容器 |
| gitleaks | gitleaks detect |
Git history secrets | Git 歷史機密 |
| SPDX | npx spdx-tool |
License SBOM generation | 授權 SBOM 產出 |
Severity Classification & SLA | 嚴重程度分類與 SLA
| Severity | SLA | Criteria | 標準 |
|---|---|---|---|
| Critical | 24 hours | RCE, auth bypass, data exfil | 遠端執行、認證繞過、資料外洩 |
| High | 72 hours | Privilege escalation, SQLi | 權限提升、SQL 注入 |
| Medium | 2 weeks | XSS, CSRF, info disclosure | XSS、CSRF、資訊洩漏 |
| Low | Next sprint | Missing headers, verbose errors | 缺少 Header、冗長錯誤訊息 |
Workflow | 工作流程
SCAN ──► TRIAGE ──► PRIORITIZE ──► FIX ──► VERIFY
- Scan — Run automated scanners on codebase and dependencies
- Triage — Filter false positives, confirm real vulnerabilities
- Prioritize — Rank by severity and exploitability
- Fix — Apply patches, update dependencies, rotate secrets
- Verify — Re-scan to confirm remediation
Usage | 使用方式
/scan - Full scan (deps + secrets + license) | 完整掃描
/scan --deps - Dependency audit only | 僅相依套件審計
/scan --secrets - Secret detection only | 僅機密偵測
/scan --license - License compliance check | 授權合規檢查
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 14d ago First seen · 98 lines · 72 tokens per session scan A 0ca9acb72f1f
scan is a skill published in the GitHub repository AsiaOstrich/EngramGraph (3 stars, last pushed today), licensed MIT. It adds 72 tokens to every session and 1,153 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-16.
Other skills, from other repositories
kivgraph
Use Kivgraph's local MCP server to search symbols, read their source, and follow references, dependencies, cross-repository consumers and graph status in the indexed code graph.
mushroom
Live graph memory for agents — query and create entities, derive relationships by rule, explain why two things are associated, read the graph at a past commit, ask what a change would do, and answer as one role. Trigger on: memory, remember, recall, relationship, entity, association, why are X and Y related, as of…
omnigraph
Operate OmniGraph graphs and deployments. Use for .pg schemas, .gq queries, OmniGraph CLI commands, file:///s3:///az:// graph URIs, cluster.yaml, operator config, bearer-authenticated servers, graph-backed knowledge or memory, Blob values, embeddings, branches, commits, and change feeds. Apply especially before schema…
code-graph
This skill should be used when understanding code structure, finding dependencies between functions/classes, tracing call graphs, or exploring code relationships. Trigger phrases include 'code graph', 'call graph', 'who calls', 'what calls', 'find dependencies', 'code structure', 'inheritance', 'find paths'.
usage
Query LeanKG knowledge graph for code understanding. Use when exploring a codebase, finding functions, tracing dependencies, or calculating impact radius.
codestory-grounding
Use when discovering repository structure, tracing relationships, analyzing change impact, or validating CodeStory retrieval or an installed plugin through the CodeStory plugin MCP. Skip only for bounded inspection or editing of named files that does not require those operations.