Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/azzygoatcoder/agent-useful-skills/code-security-auditnpx skills add Azzygoatcoder/agent-useful-skills --skill code-security-auditgit clone --depth 1 https://github.com/Azzygoatcoder/agent-useful-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/azzygoatcoder/agent-useful-skills/code-security-audit)<a href="https://agentmods.dev/skills/azzygoatcoder/agent-useful-skills/code-security-audit"><img src="https://agentmods.dev/badge/skills/azzygoatcoder/agent-useful-skills/code-security-audit.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00095 | $0.02001 |
| Opus 5 | $0.00048 | $0.01001 |
| Sonnet 5 | $0.00019 | $0.00400 |
| Haiku 4.5 | $0.00010 | $0.00200 |
Grade A, and why
code-security-audit scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 113 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Code Security Audit
Overview
Systematic security audit of any codebase using parallel domain exploration. Launch independent review agents across three security domains simultaneously, then synthesize findings into a structured audit report with severity ratings and concrete remediation steps.
Core principle: Coverage through parallelization. Three focused agents catch more than one broad agent — each domain has different grep patterns, different mental models, and different blind spots.
场景判定（先定深度，再走流程）
| 场景 | 触发 | 深度 | 产出 | 流程 |
|---|---|---|---|---|
| 快速风险扫描 | "/audit quick" / "快扫一眼" | L1 | 一页风险概览（不看全文） | Phase 1 单 agent + 摘要，跳过 Self-Check |
| 全面审计（默认） | "audit this repo" / "安全审计" / "/audit" | L2-L3 | 完整 SECURITY_AUDIT.md | Phase 1-3 全流程 |
| 增量重审 | "/reaudit" / "检查修复" | 变更文件 | 重审段 + 状态更新 | Phase 4 |
| 单 PR / 单文件 | "review this PR" / "看下这个改动" | — | 代码评审 | 委托 code-review，不进安全审计 |
| 快速修复 | "/security-fix" / "修漏洞" | — | 按 P1-P4 批量修复 | security-fix-skill |
默认是全面审计。用户要求"快扫/quick"才降级 L1；"修漏洞/再审计"分别走 security-fix / reaudit。场景不清时按全面审计走，深度宁高勿低。
Slash Commands
| Command | Action |
|---|---|
/audit |
Full security audit — explore → verify → report (Phase 1–3) |
/reaudit |
Verify previous audit fixes were applied (Phase 4) |
/reaudit mark-fixed <ID> |
Lightweight: mark a finding as fixed (update status annotation only, no file read) |
/reaudit mark-deferred <ID> |
Mark a finding as structurally deferred |
/reaudit status |
Show current fix progress (count by status from annotations) |
/code-security-audit |
Same as /audit (canonical name) |
When to Use
Trigger when the user asks to:
- Audit a repository or codebase for security issues
- Perform a security review or vulnerability assessment
- Check if security fixes were properly applied (re-audit)
- Find vulnerabilities before a release or deployment
Do NOT use for:
- Reviewing a single PR diff (use
/security-reviewor manual review) - Checking one specific function for bugs (use systematic-debugging)
- General code review for style/architecture (use
/code-review)
What ships with it
3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 113 lines · 95 tokens per session scan A cb99459a3b63
code-security-audit is a skill published in the GitHub repository Azzygoatcoder/agent-useful-skills (4 stars, last pushed 6d ago), licensed MIT. It adds 95 tokens to every session and 2,001 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
dsh-plugin-dev
开发 DeepSeek Harness (DSH) 插件的标准与权威参考：编写/修改/审查/调试 DSH/Cordis 插件、服务、事件、插件配置、模型工具、LLM 适配器、三种角色拆分、打包安装、workspace 包、cordis.yml 组合时使用；提到 DSH 插件、Cordis、plugin、服务、事件、工具、适配器即触发。 The authoritative standard for developing DeepSeek Harness (DSH) plugins — create, modify, review or debug DSH/Cordis plugins, services, events…
dsh-plugin-client
开发 DSH 插件的 client 半端（浏览器 UI）时使用：按已验证的 slot 与标准-kit 契约注册界面、双目标构建并包装客户端 bundle。.
dsh-plugin-dev
开发或调试 DeepSeek Harness 插件时使用：按已验证的结构编写 bundle、本地调试、发布与收录。.
dsh-plugin-i18n
给 DSH 插件的客户端 UI 做中英文国际化时使用：locale 命名空间、slot 声明、t() 取词与切语言即时生效。.
dsh-git-commit
提交代码时使用：按约定式提交写 commit message，并在提交前做最小自检。.
dsh-dependency-audit
升级或审查项目依赖时使用：审计安全告警、控制安装脚本风险、制定升级回滚预案。.