Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add bhuvangupta/vapt-claude --skill vaptgit clone --depth 1 https://github.com/bhuvangupta/vapt-claudeWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/bhuvangupta/vapt-claude/vapt)<a href="https://agentmods.dev/skills/bhuvangupta/vapt-claude/vapt"><img src="https://agentmods.dev/badge/skills/bhuvangupta/vapt-claude/vapt/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/bhuvangupta/vapt-claude/vapt"><img src="https://agentmods.dev/badge/skills/bhuvangupta/vapt-claude/vapt.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00060 | $0.02482 |
| Opus 5 | $0.00030 | $0.01241 |
| Sonnet 5 | $0.00012 | $0.00496 |
| Haiku 4.5 | $0.00006 | $0.00248 |
Grade A, and why
vapt scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
2. Use fallback approach (curl, Python scripts, openssl) How it starts
The opening of the file, as written. The whole thing — 249 lines — stays where its author put it; the contents beside it link to each section on GitHub.
VAPT — Web Application Penetration Testing
Commands
| Command | Description | Output | Sub-Skill |
|---|---|---|---|
/vapt audit <url> |
Full VAPT audit (all waves) | VAPT-AUDIT.md |
Orchestrator (this file) |
/vapt recon <url> |
Recon & OSINT | VAPT-RECON.md |
vapt-recon |
/vapt network <url> |
Network & port scanning | VAPT-NETWORK.md |
vapt-network |
/vapt ssl <url> |
SSL/TLS & crypto analysis | VAPT-SSL.md |
vapt-ssl |
/vapt scan <url> |
Web app scanning | VAPT-SCAN.md |
vapt-scan |
/vapt inject <url> |
Injection testing | VAPT-INJECT.md |
vapt-inject |
/vapt auth <url> |
Authentication & session | VAPT-AUTH.md |
vapt-auth |
/vapt authz <url> |
Authorization & access control | VAPT-AUTHZ.md |
vapt-authz |
/vapt api <url> |
API security testing | VAPT-API.md |
vapt-api |
/vapt headers <url> |
Headers & infrastructure | VAPT-HEADERS.md |
vapt-headers |
/vapt logic <url> |
Business logic testing | VAPT-LOGIC.md |
vapt-logic |
/vapt graphql <url> |
Deep GraphQL security testing | VAPT-GRAPHQL.md |
vapt-graphql |
/vapt websocket <url> |
WebSocket security testing | VAPT-WEBSOCKET.md |
vapt-websocket |
/vapt cloud <url> |
Cloud misconfiguration testing | VAPT-CLOUD.md |
vapt-cloud |
/vapt report <url> |
Generate Markdown report | VAPT-REPORT.md |
vapt-report |
/vapt report-pdf <url> |
Generate PDF report | VAPT-REPORT.pdf |
vapt-report-pdf |
/vapt setup |
Check tool dependencies | Terminal | vapt-setup |
Flags
--mode pro— Terse output, advanced tool flags, assumes expertise--mode dev— Educational output, explains findings with remediation code snippets (DEFAULT)--scope <domains>— Limit testing to specific subdomains/paths--skip <category>— Skip categories during full audit (e.g.,--skip network,logic)--severity <min>— Only report findings at or above threshold (critical,high,medium,low)
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 249 lines · 60 tokens per session scan A 672b067c0115
vapt is a skill published in the GitHub repository bhuvangupta/vapt-claude (1 stars, last pushed 5mo ago), licensed MIT. It adds 60 tokens to every session and 2,482 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
webcrawler-deep-crawl
Deep-crawl any website from start URLs, return per-page LLM-ready text/markdown/HTML plus metadata (title, description, author, language, canonical URL, OG) and in-scope outbound links. Use when user mentions deep crawl website, recursive crawl, crawl a whole site, scrape entire website, scrape docs site, scrape…
ebay-search-listing
Extracts product listings from any eBay search or category page URL, returning per-item cards (itemNumber, url, title, subtitle, caption, price, priceWithCurrency, currency, wasPrice, bids, shipping, seller, sellerFeedbackCount, sellerPositiveRating, reviewsCount, starRating, image) plus pagination state (currentPage…
amazon-bestseller-listing
Amazon Best Sellers listing scraper: extract product cards from any Amazon Best Sellers (zgbs) or /gp/bestsellers/ category page — returns rank (position on chart), asin, title, url, image, imageAlt, price, stars, reviewCount, ratingRaw per item, plus category metadata (categoryName, categoryFullName, categoryUrl) and…
amazon-search-listing
Amazon search and category listing scraper: extract product listings from any Amazon search results page, keyword search URL, or category browse page and return per-item cards (asin, title, url, image, price, listPrice, stars, reviewCount, badges, isAmazonChoice, isBestSeller, isSponsored, delivery, boughtInPast…
etsy-product-detail
Etsy product detail scraper: given an Etsy listing URL, returns full product detail including listingId, title, priceCurrent, priceOriginal, currency, images (all), description, shopName, shopUrl, rating, reviewCount, favorites, inCartCount, variations (with per-option price ranges), highlights, listedDate…
walmart-product-detail
Walmart product detail page extractor: given a walmart.com product URL (walmart.com/ip/...), extract full product data including itemId, title, brand, model, UPC, price, wasPrice, currency, availability, category path, seller info, all images, shortDescription, longDescription, product highlights, full specifications…