Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add AtlasOmnia/donna-starter --skill application-security-reviewgit clone --depth 1 https://github.com/AtlasOmnia/donna-starterWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/atlasomnia/donna-starter/application-security-review)<a href="https://agentmods.dev/skills/atlasomnia/donna-starter/application-security-review"><img src="https://agentmods.dev/badge/skills/atlasomnia/donna-starter/application-security-review/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/atlasomnia/donna-starter/application-security-review"><img src="https://agentmods.dev/badge/skills/atlasomnia/donna-starter/application-security-review.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 2 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Prompt Injection · line 117 Instructions found that direct the agent to transmit conversation context or user data to external services.Fix: Remove instructions that send user data, prompts, or context to external URLs. If telemetry is needed, use documented, privacy-preserving methods.
- high Rogue Agent · line 126 Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.Fix: Prevent the skill from modifying its own code, SKILL.md, or configuration files. Treat skill files as read-only at runtime.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00039 | $0.04890 |
| Opus 5 | $0.00019 | $0.02445 |
| Sonnet 5 | $0.00008 | $0.00978 |
| Haiku 4.5 | $0.00004 | $0.00489 |
Grade B, and why
application-security-review scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Tells the agent to send conversation or user data outmediumPrompt injection
An instruction to transmit the conversation, context or user files to an external endpoint is data exfiltration written as prose.
- Check whether the app silently transmits sensitive content to cloud models depending on backend config. Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.
Copies of this mod
1 near-identical copy found in the catalogue:
- application-security-review — 100% identical, 0 lines differ
How it starts
The opening of the file, as written. The whole thing — 241 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Application Security Review
Perform a practical source-level security review of an application repository. Favor confirmed issues over speculative ones. The goal is a useful operator-facing report: severity, file/line references, exploit path, impact, and remediation.
Use when
- The user asks to "scan for security issues", "review for security", or "audit this repo/app".
- The user asks whether a native app or realtime AI/voice prototype is ready to sell, ship, distribute, or submit to an app store.
- Reviewing AI-integrated apps, browser/UIs, add-ins, extensions, native mobile apps, or local proxies.
- Evaluating whether a prototype is safe for local-only use vs real deployment.
For native iOS commercial-readiness reviews, load and follow the readiness checklist. It expands the audit beyond security into StoreKit, App Store compliance, realtime audio reliability, consumer UX, unit economics, and release gates.
Review priorities
- Trust boundaries first.
- What input is untrusted?
- What backend capabilities sit behind the UI?
- Can model output or user-controlled content trigger side effects?
- Auth and exposure.
- Localhost services, reverse proxies, injected auth headers, CORS, TLS, origin restrictions.
- Validation before execution.
- JSON/action parsing, schema checks, range/size limits, before/after verification, allowlists.
- Data handling.
- What leaves the machine, what is logged, whether sensitive user data is silently sent to cloud backends.
- For public-release reviews, scan both tracked source and git metadata for PII: local hostnames, personal emails, profile names, private org/business names, absolute user paths, and secret/token patterns.
- Dependencies.
- Separate runtime risk from dev-toolchain risk.
Workflow
- Read top-level README and manifests/config first to understand architecture.
- Locate network entry points and auth flow.
- Trace untrusted input to powerful sinks:
- LLM prompts
- filesystem/terminal/network tools
- code execution
- document/workbook mutations
- Search for:
- fetch/XHR/API calls
- proxies and bearer-token injection
- JSON.parse on model output
- eval/Function/innerHTML/dangerous DOM sinks
- wildcard CORS or broad allowlists
- dependency versions with known advisories
- For public-release/privacy scans, include repository metadata and the actual remote publication surface as well as source:
- Before first push, inspect staged/tracked files, local author metadata, and reachable history to catch accidental local-hostname identities and workstation paths.
- Scan tracked/source files for emails, hostnames,
<user-home>/...,C:\\Users\\<name>, private profile names, internal org names, token prefixes, and generated run artifacts. - After push or history rewrite, make the publication verdict from a fresh remote clone/mirror, every public branch/tag and PR ref, PR text, commit metadata, and all reachable blobs. Do not count ignored files, virtual environments, local reflogs, or stale remote-tracking refs as currently published content.
- Use an independent-model review when practical, then verify findings yourself; classifiers often mislabel loopback, placeholder paths, or code symbols as PII.
- Confirm the update reaches the intended default/publication branch rather than remaining only on a feature branch.
- Distinguish generic loopback (
127.0.0.1), contextual test IPs, GitHub noreply identities, placeholder fixtures, and code symbols ending in.localfrom real PII or private-machine identifiers.
What ships with it
3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 241 lines · 39 tokens per session scan B 0548b9f69136
application-security-review is a skill published in the GitHub repository AtlasOmnia/donna-starter (107 stars, last pushed 9d ago), licensed MIT. It adds 39 tokens to every session and 4,890 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it B with 1 finding (tells the agent to send conversation or user data out). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
npm-downloads-to-leads
Takes a list of npm package names (yours or competitors'), fetches 12 weeks of daily download data from the npm API, computes a breakout velocity score per package to identify hockey-stick growth, fetches maintainer profiles from the npm registry and GitHub API, and outputs a ranked lead brief for each breakout…
gh-issue-to-demand-signal
Takes a competitor's public GitHub repo URL, fetches their open issues via the GitHub REST API, filters noise locally, clusters issues into 6 demand categories, computes a demand score per issue and per cluster, and outputs a ranked demand gap report with a GTM messaging brief. Use when asked to scan a competitor's…
domain-expired-opportunity-finder
Evaluates expired domain candidates against a target niche, scores them by topical relevance, historical activity level, and history cleanliness, then outputs a ranked shortlist with explainable reasoning and risk flags.
company-radar
Competitive intelligence orchestrator tracking companies across 8+ platforms (GitHub, Twitter, Reddit, HN, PH, YC Jobs) with heat scores and AI briefings.
dependency-update-bot
Scans your project for outdated npm, pip, Cargo, Go, or Ruby packages. Runs a CVE security audit. Fetches changelogs, summarizes breaking changes with Gemini, and opens one PR per risk group (patch, minor, major). Includes Diagnosis Mode for install conflicts. Use when asked to update dependencies, check for outdated…
linkedin-job-post-to-buyer-pain-map
Takes pasted LinkedIn job posts or hiring descriptions and converts them into a structured buyer pain map with inferred pains, capability gaps, buy-vs-build signal, account priority scores, and suggested outreach angles. Use when asked to analyze hiring posts, decode job descriptions for buyer intent, build a pain map…