Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add aspectrr/deer --skill elasticsearch-authngit clone --depth 1 https://github.com/aspectrr/deerWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/aspectrr/deer/elasticsearch-authn)<a href="https://agentmods.dev/skills/aspectrr/deer/elasticsearch-authn"><img src="https://agentmods.dev/badge/skills/aspectrr/deer/elasticsearch-authn/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/aspectrr/deer/elasticsearch-authn"><img src="https://agentmods.dev/badge/skills/aspectrr/deer/elasticsearch-authn.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00048 | $0.01119 |
| Opus 5.5 | $0.00019 | $0.00448 |
| Sonnet 5.5 | $0.00010 | $0.00224 |
| Haiku 4.5 | $0.00005 | $0.00112 |
Grade A, and why
elasticsearch-authn scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
curl -u "${ELASTICSEARCH_USERNAME}:${ELASTICSEARCH_PASSWORD}" "${ELASTICSEARCH_URL}/_security/_authenticate" How it starts
The opening of the file, as written. The whole thing — 155 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Elasticsearch Authentication
Authenticate to an Elasticsearch cluster using any supported authentication realm that is already configured. Covers all built-in realms, credential verification, and the full API key lifecycle.
For roles, users, role assignment, and role mappings, see the elasticsearch-authz skill.
Critical principles
- Never ask for credentials in chat. Secrets must not appear in conversation history.
- Always use environment variables. Instruct the user to set them in a
.envfile in the project root.
Authentication Realms
Elasticsearch evaluates realms in a configured order (the realm chain). The first realm that can authenticate the request wins.
Internal realms
Native (username and password)
curl -u "${ELASTICSEARCH_USERNAME}:${ELASTICSEARCH_PASSWORD}" "${ELASTICSEARCH_URL}/_security/_authenticate"
File
Users defined in flat files on each cluster node. Always active regardless of license state. Self-managed only.
curl -u "${FILE_USER}:${FILE_PASSWORD}" "${ELASTICSEARCH_URL}/_security/_authenticate"
External realms
LDAP / Active Directory
Self-managed only. Combined with role mappings to translate LDAP/AD groups to Elasticsearch roles.
curl -u "${LDAP_USER}:${LDAP_PASSWORD}" "${ELASTICSEARCH_URL}/_security/_authenticate"
PKI (TLS client certificates)
Requires PKI realm and TLS on HTTP layer.
curl --cert "${CLIENT_CERT}" --key "${CLIENT_KEY}" --cacert "${CA_CERT}" \
"${ELASTICSEARCH_URL}/_security/_authenticate"
SAML / OIDC
Primarily for Kibana SSO. Browser-based redirect flow, not for REST clients. Configure another realm alongside for programmatic API access.
JWT
Accepts JWTs as bearer tokens.
curl -H "Authorization: Bearer ${JWT_TOKEN}" "${ELASTICSEARCH_URL}/_security/_authenticate"
Kerberos
Self-managed only. Requires KDC infrastructure, DNS, and time synchronization.
kinit "${KERBEROS_PRINCIPAL}"
curl --negotiate -u : "${ELASTICSEARCH_URL}/_security/_authenticate"
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 155 lines · 48 tokens per session scan A 05ca400765a3
elasticsearch-authn is a skill published in the GitHub repository aspectrr/deer (405 stars, last pushed 6mo ago), licensed MIT. It adds 48 tokens to every session and 1,119 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
build-with-opengeni
Add Opengeni agents to the user's own product, backend, website, or app with @opengeni/sdk and @opengeni/react: the packaged chat UI behind one server route, per-tenant workspaces, and the product's own tools. Also builds a small local demo web app with an Opengeni chat. Use when the user wants AI agents or an…
cache-design
Design a caching strategy for an application — pattern selection, key design, TTL, and eviction policy. Use when asked to "add caching to this", "design a cache strategy", or "what should we cache".
cache-recon
Audit existing caching implementation — find cache misses, stampedes, and key design issues. Use when asked to "audit our caching", "why is our hit rate low", or "find cache stampedes".
agentmail-v2
AgentMail — Email for AI Agents workflow skill. Use this skill when the user needs Email infrastructure for AI agents. Create accounts, send/receive emails, manage webhooks, and check karma balance via the AgentMail API and the operator should preserve the upstream workflow, copied support files, and provenance before…
service-explorer
Discover and interact with ANY service running on the system. Not pre-programmed per-service. Discovers dynamically. Read configs, hit APIs, parse logs. Figure it out.
gitlab_api
A skill for using the GitLab REST API, the web service interface for reading and changing GitLab projects. It covers projects, merge requests, issues, pipelines, and repository files.