Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add astroicers/security-weekly-mcp --skill skillgit clone --depth 1 https://github.com/astroicers/security-weekly-mcpWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/astroicers/security-weekly-mcp/skill)<a href="https://agentmods.dev/skills/astroicers/security-weekly-mcp/skill"><img src="https://agentmods.dev/badge/skills/astroicers/security-weekly-mcp/skill/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/astroicers/security-weekly-mcp/skill"><img src="https://agentmods.dev/badge/skills/astroicers/security-weekly-mcp/skill.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00124 | $0.07349 |
| Opus 5.5 | $0.00050 | $0.02940 |
| Sonnet 5.5 | $0.00025 | $0.01470 |
| Haiku 4.5 | $0.00012 | $0.00735 |
Grade A, and why
security-weekly-tw scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 787 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Security Weekly TW - 資安週報與術語庫管理
專案路徑
| 專案 | 路徑 |
|---|---|
| Monorepo | ~/projects/security-weekly-mcp/ |
| 術語庫 | ~/projects/security-weekly-mcp/packages/glossary/ |
| MCP Server | ~/projects/security-weekly-mcp/packages/mcp-server/ |
| 週報輸出 | ~/projects/security-weekly-mcp/output/reports/ |
| 舊專案（已封存） | ~/projects/security-glossary-tw/, ~/projects/security-weekly-report/ |
功能概覽
| 功能 | 觸發詞 | 說明 |
|---|---|---|
| 審核待審術語 | 「審核術語」「review terms」 | 檢視 pending/ 中的新術語 |
| 新增術語 | 「新增術語」「add term」 | 手動新增術語到術語庫 |
| 更新術語庫 | 「更新術語」「修改定義」 | 修改現有術語定義 |
| 產生週報 | 「產生週報」「寫週報」 | 根據來源產生專業週報 |
| 術語比對 | 「檢查用詞」「加術語連結」 | 驗證用詞並加上連結 |
| 收集術語 | 「收集術語」「discover terms」 | 從網路搜尋新興資安術語 |
MCP 工具清單
MCP Server security-weekly-tw 提供以下工具：
術語庫工具
| 工具 | 說明 |
|---|---|
search_term |
模糊搜尋術語庫 |
get_term_definition |
取得完整術語定義 |
validate_terminology |
驗證用詞規範 |
add_term_links |
為文本加術語連結 |
list_pending_terms |
列出待審術語 |
extract_terms |
從文本自動提取術語 |
approve_pending_term |
批准待審術語 |
reject_pending_term |
拒絕待審術語 |
新聞收集工具
| 工具 | 說明 |
|---|---|
fetch_security_news |
從 RSS 來源收集資安新聞 |
fetch_vulnerabilities |
收集 NVD + CISA KEV 漏洞 |
list_news_sources |
列出新聞來源 |
suggest_searches |
產生 WebSearch/WebFetch 搜尋建議 |
list_weekly_data |
列出已保存的週報原始資料 |
load_weekly_data |
載入指定週數的原始資料 |
週報工具
| 工具 | 說明 |
|---|---|
generate_report_draft |
產生週報結構化資料 |
compile_report_pdf |
使用 Typst 編譯 PDF |
list_reports |
列出已產生的週報 |
兩階段週報架構
GitHub Actions (每週一自動) 你 + Claude (隨時)
════════════════════════ ═══════════════════
collect_weekly_data.py 「產生週報」
↓ ↓
抓 RSS + API load_weekly_data
↓ ↓
output/raw/YYYY-WNN.json 讀取已保存資料
↓ + WebSearch 補充
永久保存到 repo + AI 分析撰寫
↓
高品質 PDF 報告
What ships with it
5 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 787 lines · 124 tokens per session scan A d284451bba40
security-weekly-tw is a skill published in the GitHub repository astroicers/security-weekly-mcp (0 stars, last pushed 3d ago), licensed MIT. It adds 124 tokens to every session and 7,349 once invoked, about $0.0005 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
burpsuite
Operate an already configured burp-mcp server for authorized web application security testing, penetration testing, vulnerability assessment, and Burp Suite automation: inspect Proxy HTTP/WebSocket history, scope, and site map; craft and replay requests in Repeater; run bounded parallel fuzzing, race condition jobs…
release-and-publish
Ship a release end-to-end across every registry the project targets (npm, MCP Registry, GitHub Releases for .mcpb bundles, GHCR). Runs the final verification gate, fast-forwards main when the release rode a release PR, creates the annotated tag on the commit main now points at, pushes commits and tags, then publishes…
add-tool
Scaffold a new MCP tool definition. Use when the user asks to add a tool, create a new tool, or implement a new capability for the server.
api-linter
MCP definition linter rules reference. Use when bun run lint:mcp or bun run devcheck reports a lint error or warning (format-parity, schema-is-object, name-format, server-json-, etc.) and you need to understand the rule, its severity, and how to fix it. Every rule ID the linter emits has an entry in this doc.
design-mcp-server
Design the tool surface, resources, and service layer for a new MCP server. Use when starting a new server, planning a major feature expansion, or when the user describes a domain/API they want to expose via MCP. Produces a design doc at docs/design.md that drives implementation.
api-context
Canonical reference for the unified Context object passed to every tool and resource handler in @cyanheads/mcp-ts-core. Covers the full interface, its RequestContext base, all sub-APIs (ctx.log, ctx.state, ctx.requestInput, ctx.inputs, ctx.clientCapabilities, ctx.enrich, ctx.content), and when to use each.