Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add bugrabilge/bilge-development-kit --skill vulnerability-scannergit clone --depth 1 https://github.com/bugrabilge/bilge-development-kitWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/bugrabilge/bilge-development-kit/vulnerability-scanner)<a href="https://agentmods.dev/skills/bugrabilge/bilge-development-kit/vulnerability-scanner"><img src="https://agentmods.dev/badge/skills/bugrabilge/bilge-development-kit/vulnerability-scanner/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/bugrabilge/bilge-development-kit/vulnerability-scanner"><img src="https://agentmods.dev/badge/skills/bugrabilge/bilge-development-kit/vulnerability-scanner.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00027 | $0.01851 |
| Opus 5 | $0.00014 | $0.00925 |
| Sonnet 5 | $0.00005 | $0.00370 |
| Haiku 4.5 | $0.00003 | $0.00185 |
Grade A, and why
vulnerability-scanner scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 209 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Vulnerability Scanner
"Security is not a product, but a process." -- Bruce Schneier
When to Use
- Scanning code for security vulnerabilities (SAST)
- Running dynamic application security testing (DAST)
- Auditing dependencies for known vulnerabilities (SCA)
- Tracking and prioritizing CVEs affecting your software
- Implementing automated security checks in CI/CD pipelines
- Developing remediation plans for discovered vulnerabilities
- Performing compliance checks (SOC 2, PCI DSS, HIPAA)
Vulnerability Scanning Categories
SAST (Static Application Security Testing)
Analyzes source code without executing it. Catches vulnerabilities early in development.
Tools:
- Semgrep: Rule-based, fast, supports 30+ languages, community rules
- SonarQube/SonarCloud: Comprehensive code quality and security analysis
- CodeQL (GitHub): Deep semantic code analysis, built into GitHub Advanced Security
- Bandit: Python-specific security linter
- Brakeman: Ruby on Rails security scanner
- ESLint security plugins:
eslint-plugin-security,eslint-plugin-no-unsanitized
What SAST catches:
- SQL injection patterns
- Cross-site scripting (XSS) sinks
- Hardcoded secrets and credentials
- Insecure cryptographic usage
- Path traversal vulnerabilities
- Command injection
- Deserialization flaws
DAST (Dynamic Application Security Testing)
Tests a running application by sending crafted requests. Finds runtime vulnerabilities.
Tools:
- OWASP ZAP: Open-source, full-featured web app scanner
- Burp Suite: Professional-grade web security testing
- Nuclei: Template-based vulnerability scanner, fast and extensible
- Nikto: Web server scanner for misconfigurations
- DAST in CI: Use ZAP baseline scan or Nuclei in pipelines
What DAST catches:
- Authentication and session management flaws
- Server misconfigurations
- Missing security headers
- CORS misconfigurations
- Exposed sensitive endpoints
- Runtime injection vulnerabilities
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 209 lines · 27 tokens per session scan A 15d6ed912c18
vulnerability-scanner is a skill published in the GitHub repository bugrabilge/bilge-development-kit (10 stars, last pushed 4mo ago), licensed MIT. It adds 27 tokens to every session and 1,851 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
atmos-hooks
Atmos hooks: lifecycle events, hook kinds, command/store/git/security hooks, step/steps hooks, when: conditions, scoping and overrides, toolchain integration, --skip-hooks, and Atmos Pro/local output.
atmos-modernization
Atmos Modernization: migrate deprecated or legacy Atmos patterns to current names, Native CI, Atmos Pro drift detection, dependencies.components, nametemplate, and declared secrets.
atmos-pro
Atmos Pro setup and workflows: settings.pro, GitHub OIDC, affected and inventory uploads, stack locks, pro commit, workflow dispatch, merge queues, and drift detection.
atmos-sbom
Atmos SBOM provenance: CycloneDX and SPDX generation from vendor and Terraform evidence, coverage diagnostics, NTIA validation, and native CI workflow-artifact publication.
atmos-version
Atmos Version Tracker: version tracks, lock files, managed external dependency versions, atmos version track commands, !version, file managers, update policy, pinning, and CI verification.
atmos-cache
Atmos caching: CI cache configuration and commands, GitHub Actions cache integration, Terraform registry cache mirror/list/prune/stats/trust, and cache modernization guidance.