Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add bxmaximum/bitrix-framework-skills --skill bitrix-securitygit clone --depth 1 https://github.com/bxmaximum/bitrix-framework-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/bxmaximum/bitrix-framework-skills/bitrix-security)<a href="https://agentmods.dev/skills/bxmaximum/bitrix-framework-skills/bitrix-security"><img src="https://agentmods.dev/badge/skills/bxmaximum/bitrix-framework-skills/bitrix-security/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/bxmaximum/bitrix-framework-skills/bitrix-security"><img src="https://agentmods.dev/badge/skills/bxmaximum/bitrix-framework-skills/bitrix-security.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00056 | $0.00359 |
| Opus 5.5 | $0.00022 | $0.00144 |
| Sonnet 5.5 | $0.00011 | $0.00072 |
| Haiku 4.5 | $0.00006 | $0.00036 |
Grade A, and why
bitrix-security scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 16d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
Security
Baseline: main 23.0+ · Verified: main 26.800.0
General defaults (no superglobals, keep default prefilters, escape output) live in bitrix-framework.
| Task | Read |
|---|---|
| CSRF, escaping, HTML sanitizing, link and redirect targets, raw-HTML sinks | rules/csrf-xss.md |
SQL injection (raw, ORM, ExpressionField), SSRF, local files, uploads, stored settings |
rules/sql-ssrf.md |
Rights checks, #[ActionAccess], REST scopes, JWT/JWK, encryption, 2FA |
rules/jwt-crypto-access.md |
Invariants
- Untrusted: request data, and also DB-stored settings, imports, REST payloads. The type and owner of an entity come from its DB record, never from the request.
- Whitelist whatever becomes SQL structure (field names, operators, functions,
orderkeys), whatever its source. - Escape for the output context: HTML
htmlspecialcharsbx(), JSJson::encode(), URLs through a scheme allow-list. - User input never goes unchecked into
CFile::MakeFileArray(),file_get_contents(),unserialize(), redirect targets. Authentication/Csrffilters don't authorize: check rights on the object in every action.
What ships with it
3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 16d ago Changed · -27 lines · +23 tokens per session e3b92cdb4976
- 1mo ago First seen · 52 lines · 33 tokens per session scan A a2f0923ab6c0
bitrix-security is a skill published in the GitHub repository bxmaximum/bitrix-framework-skills (45 stars, last pushed 5d ago), licensed MIT. It adds 56 tokens to every session and 359 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
roblox-lighting
Use when setting up or changing Roblox lighting, atmosphere, day/night cycles, or post-processing effects.
cdd-design
Independent brainstorm orchestrator -- Node-anchored flow with digraph as single control-flow source of truth. Consumes the /superpowers:brainstorming（pi：/skill:brainstorming） flow inline as this session's baseline (one import per session), gates on mode and phase registration, runs grilling, and dispatches the…
cdd-report
Analyzes the current CDD session for bugs and enhancement opportunities and files a single aggregate GitHub issue against Oscaner/skills via gh CLI. Open dedup matches become links in the issue body (never comments); closed matches are flagged as regression follow-ups, never reopened. Findings never auto-include…
roblox-growth-design
Use for Roblox growth: diagnosing stats, discovery, retention, onboarding, experiments, LiveOps, thumbnails, and packaging.
roblox-data
Use when writing, changing, debugging, or auditing Roblox player saves: DataStore, ProfileStore, session locks, schemas, migrations.
roblox-input
Use when handling Roblox touch, gamepad, keyboard, mouse or motion input, on-screen action buttons, or cross-platform action binding.