Borrowing it
Nothing to install: this file belongs to c9r-io/orchestrator. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/c9r-io/orchestrator/main/.claude/skills/security-test-doc-gen/SKILL.mdgit clone --depth 1 https://github.com/c9r-io/orchestratorWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/c9r-io/orchestrator/security-test-doc-gen)<a href="https://agentmods.dev/skills/c9r-io/orchestrator/security-test-doc-gen"><img src="https://agentmods.dev/badge/skills/c9r-io/orchestrator/security-test-doc-gen/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/c9r-io/orchestrator/security-test-doc-gen"><img src="https://agentmods.dev/badge/skills/c9r-io/orchestrator/security-test-doc-gen.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00054 | $0.01416 |
| Opus 5.5 | $0.00022 | $0.00566 |
| Sonnet 5.5 | $0.00011 | $0.00283 |
| Haiku 4.5 | $0.00005 | $0.00142 |
Grade A, and why
security-test-doc-gen scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
- Add a runnable verification method per scenario (curl/grpcurl/SQL/log grep) How it starts
The opening of the file, as written. The whole thing — 107 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Security Test Doc Gen
Generate/complete docs/security/** so it evolves from a generic template into a set of project-aligned, reproducible, executable security test scenarios.
ASVS 5.0 High Bar (Required)
- Baseline: Use OWASP ASVS 5.0 as the control source. Default target is L2 unless the project explicitly targets L1, or a high-value system requires L3.
- No "fake compliance": Docs may claim "covered chapters/requirements + evidence", but must not claim "ASVS certified/passed".
- Traceability: Each doc header must list applicable
OWASP ASVS 5.0chapters (and requirement ids if needed). Record selection rationale and evidence sources indocs/security/_surface/asvs_profile.md. - Do not invent requirement ids: If you reference a specific requirement id, it must match ASVS 5.0 text.
- Recommended format:
v5.0.0-<chapter>.<section>.<requirement>
- Recommended format:
Inputs
- Current repo code and configuration (
core/,crates/,gui/,.github/, and any deployment assets that actually exist) - If available: a confirmed plan mode output (to cover new security scenarios introduced by new features)
Outputs
- Update/add
docs/security/**(only the portions that apply to the current project) - Update
docs/security/README.mdindex (keep it lightweight; do not hardcode totals)
Workflow
-
Define scope
feature-only: only cover security scenarios relevant to the current feature (recommended default)system-baseline: establish/refresh a baseline across the whole project (pre-release/security regression)- Decide the ASVS target level (default L2) and record it in
docs/security/_surface/asvs_profile.md
-
Discover the security surface (from code/config)
- Prefer running the extraction script to produce a "security surface inventory" (endpoints/routes/services):
.claude/skills/security-test-doc-gen/scripts/extract_surface.sh- Output defaults to
docs/security/_surface/ - Optional overrides:
CORE_DIRS=core,auth9-core(backend candidates, comma-separated)PORTAL_DIRS=portal,auth9-portal(frontend candidates, comma-separated)
- If output is empty: routes may be generated or live outside the extractor's defaults; fall back to manual searches across
core/,crates/, andgui/.
- HTTP API:
- Search for router definitions (framework-specific) and
/api/paths - If OpenAPI/Swagger exists, use it as the endpoint inventory source
- Search for router definitions (framework-specific) and
- gRPC:
- Search for
.protofiles and service definitions
- Search for
- Authentication:
- Search for
Authorization,Bearer,jwt,oidc,session,cookie
- Search for
- Authorization model:
- Search for
rbac,permission,role,tenant,org, and Workspace authorization concepts.
- Search for
- Outbound calls:
- Search for HTTP client usage and URL fields (SSRF scenarios)
- File handling:
- Search for upload/download endpoints, multipart handling, object storage
- Data stores and secrets:
- Search for
sqlx/redis/DATABASE_URL/REDIS_URL/SECRET, etc.
- Search for
- Prefer running the extraction script to produce a "security surface inventory" (endpoints/routes/services):
What ships with it
6 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2mo ago First seen · 107 lines · 54 tokens per session scan A a19581fa664e
security-test-doc-gen is a skill published in the GitHub repository c9r-io/orchestrator (21 stars, last pushed 1mo ago), licensed MIT. It adds 54 tokens to every session and 1,416 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
codew-release-qa-sweep
Use before claiming Codewhale release work is done: run the full gate sweep and list the manual QA targets.
cw-dogfood
Use when a Codewhale change needs proving in the real product, or when asked to build/install/dogfood the local binaries: stamped release build, atomic install, fresh-shell verification, and the manual QA that gates cannot cover.
cw-gates
Use before claiming any Codewhale change is done, green, or ready to land: the focused-to-broad verification ladder, the budget checks CI enforces, and the rules for what counts as a passing test.
test-driven-development
Use when implementing any feature or bugfix, before writing implementation code.
verification-before-completion
Use when about to claim work is complete, fixed, or passing, or before committing or creating PRs.
verify
Exercise the real app/API/CLI and collect observable evidence; tests alone do not count as end-to-end verification.