Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add carsteneu/yesmem --skill security-reviewgit clone --depth 1 https://github.com/carsteneu/yesmemWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/carsteneu/yesmem/security-review)<a href="https://agentmods.dev/skills/carsteneu/yesmem/security-review"><img src="https://agentmods.dev/badge/skills/carsteneu/yesmem/security-review/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/carsteneu/yesmem/security-review"><img src="https://agentmods.dev/badge/skills/carsteneu/yesmem/security-review.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 3 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Prompt Injection · line 10 Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.Fix: Audit all comments and invisible characters. Remove any instructions that direct the agent to perform unauthorized actions. Use plain, reviewable content.
- high Output Handling · line 120 Model output is used without validation or sanitization. Unvalidated output injected into downstream contexts (SQL, shell, HTML) enables injection attacks and arbitrary code execution.Fix: Validate and sanitize all model output before using it in downstream contexts. Use parameterized queries for SQL, shell quoting for commands, and HTML encoding for web output.
- high Output Handling · line 219 Model output is used without validation or sanitization. Unvalidated output injected into downstream contexts (SQL, shell, HTML) enables injection attacks and arbitrary code execution.Fix: Validate and sanitize all model output before using it in downstream contexts. Use parameterized queries for SQL, shell quoting for commands, and HTML encoding for web output.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00050 | $0.03348 |
| Opus 5 | $0.00025 | $0.01674 |
| Sonnet 5 | $0.00010 | $0.00670 |
| Haiku 4.5 | $0.00005 | $0.00335 |
Grade A, and why
security-review scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Runs shell commandslowCapability
Expected in a hook, worth knowing in a rule or an instructions file.
| `.js`, `.ts`, `express`, `react`, `vue`, `next` | JavaScript: `child_process`, `eval`, `innerHTML`, `dangerouslySetInnerHTML` | How it starts
The opening of the file, as written. The whole thing — 311 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Security Review Skill
Identify exploitable security vulnerabilities in code. Investigate before flagging. Report findings with confidence levels and severity.
Skip condition: If the diff contains no executable code (docs-only, JSON-only config, comments-only), skip the review and record skipped — diff is docs-only (or similar) in the **Security:** field. If the diff touches any .go/.py/.js/.ts/.tsx/.jsx/.java/.rs/.php/.rb file, this skill MUST be invoked — no skip.
Scope: Research vs. Reporting
CRITICAL DISTINCTION:
- Report on: Only the specific file, diff, or code provided
- Research: The ENTIRE codebase to build confidence before reporting
Before flagging any issue, research the codebase to understand:
- Where does this input actually come from? (Trace data flow)
- Is there validation/sanitization elsewhere?
- How is this configured? (Check settings, config files, middleware)
- What framework protections exist?
Do NOT report issues based solely on pattern matching. Investigate first, then report.
Confidence Levels + NEW/MODIFIED Doctrine (adapted for yesloop)
The Sentry original says "Do not report LOW". That is rejected here. We also reject the "fix if <2 min" time-estimate rule from earlier Phase 5 doctrine. Instead we use a bright-line NEW vs MODIFIED distinction — a fact about the diff, not an estimate.
Why NEW vs MODIFIED instead of time estimates
- Time estimates are unreliable for agents and humans. "NEW vs MODIFIED" is a fact determined from
git diff. - Greenfield has zero compat constraints — no API contract, no migration, no downstream callers that can break.
- Training signal — shipping LOW findings trains future agents that LOW is acceptable. yesloop builds production code.
- Compounding debt — 50 LOW findings = 4+ hours of tech-debt cleanup later plus re-orientation per finding.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 311 lines · 50 tokens per session scan A b48f52ff5d85
security-review is a skill published in the GitHub repository carsteneu/yesmem (41 stars, last pushed 6d ago), licensed Apache-2.0. It adds 50 tokens to every session and 3,348 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 1 finding (runs shell commands). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
pre-pr
Prepare a Honcho change for a pull request to plastic-labs/honcho. Invoke before opening a PR, when drafting a PR body, when asked if a branch is PR-ready, or when filling the pull request template. Checks the linked issue, required tests and docs, then writes Description / Proofs / Fixes.
lithium-kb
Generates, maintains, and visualizes a structured Markdown knowledge base (.lithium-kb/{architecture,debug,tasks,features}) with an interactive Neural Network graph, auto-watch mode, custom agent directives (.agentrules), and MCP server integration for Pi, Claude, Codex, Cursor, and other coding agents. Triggers…
graphifychat
Turn any conversation into a queryable knowledge graph. Three-layer portable memory file: TRON (structured input+output capture with emotion, psychology, intent — every turn), Sparse6 (layered relational graph with community detection, hyperedges, confidence scores — every turn), GRAPHREPORT (god nodes + surprising…
memoryai
Universal autonomous long-term memory for AI agents. Remember everything, send only what matters.
memoryai-capture
Automatically extracts durable knowledge (decisions, preferences, facts, milestones), executes Memory Brain decisions, and handles temporal conflict invalidation.
memoryai-core
Primary master orchestrator for MemoryAI autonomous memory. Automatically detects task context, coordinates specialized sub-skills, enforces token budgets, and manages lifecycle.