Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/ch015/code-pentester/feedbacknpx skills add ch015/code-pentester --skill feedbackgit clone --depth 1 https://github.com/ch015/code-pentesterWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00030 | $0.10715 |
| Opus 5 | $0.00015 | $0.05358 |
| Sonnet 5 | $0.00006 | $0.02143 |
| Haiku 4.5 | $0.00003 | $0.01072 |
Grade A, and why
ch015-feedback scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 869 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Security Design Review — 보안 설계 리뷰 스킬
PRD/기획서를 분석하여 글로벌 보안 표준·규제에 근거한 보안 의견서 또는 보안 검토 의견서를 생성한다.
서비스 개요
| 항목 | 내용 |
|---|---|
| 서비스명 | Security Design Review |
| 방법론 | 문서 정찰 → 위협 표면 매핑 → 표준 바인딩 → 의견/검토 생성 |
| 출력물 | Opinion: 섹션별 MUST/SHOULD 의견 + 코드 예시 (OP-{NNN}) |
| Review: CRITICAL~LOW 검토 Finding + 설계 가이드 (C/H/M/L-{NN}) | |
| 코드 수정 | 없음 (명세·의견 생성 전용) |
| 코드 분석 | 없음 (PRD/기획서 텍스트 분석) |
| 토큰 예산 | ~22-35K (Phase별 계층 로딩) |
출력 모드
Mode_Selection:
opinion:
trigger: "--mode opinion (기본값)"
대상: "개발자, AI 코딩 도구"
관점: "구현 가이드 — '이렇게 만들어라'"
ID: "OP-{NNN} (001부터 순차)"
구조: "문서 섹션별 MUST / MUST NOT / SHOULD 의견 + 코드 예시"
용도: "Cursor, Claude Code 등에 컨텍스트로 주입하여 보안 요건 반영 코딩"
review:
trigger: "--mode review"
대상: "QSA, CISO, 경영진, 개발팀"
관점: "감사 리포트 — '이 설계의 위험은 이것이다'"
ID: "C-{NN} / H-{NN} / M-{NN} / L-{NN}"
구조: "Severity별 Finding + 표준 Gap 분석 + Risk Acceptance Matrix"
용도: "Go/No-Go 의사결정, 감사 대응, 규제 보고"
설계 원칙
No_Pattern_Lists:
- "CWE/OWASP 카탈로그를 기계적으로 나열하지 않는다"
- "PRD 컨텍스트에서 실제 관련된 표준만 바인딩"
- "도메인·관할에 따라 적용 표준이 달라짐을 인지"
Standards_Authority:
- "권고하는 모든 알고리즘·파라미터에 근거 표준 인용 필수"
- "표준이 명확하면 그대로 인용 (e.g., NIST SP 800-63B §5.1.1.2)"
- "표준 간 충돌 시 가장 엄격한 기준 채택"
- "표준이 업데이트된 경우 최신 버전 적용 (e.g., PCI DSS 4.0.1 future-dated 2025-03-31)"
Implementation_Specificity:
핵심: "구현자가 바로 코딩할 수 있는 수준"
bad_examples:
- "암호화 적용"
- "강력한 비밀번호 정책"
- "적절한 접근 제어"
good_examples:
- "AES-256-GCM envelope encryption, DEK 로테이션 365일, CMK→DEK 2-tier"
- "bcrypt cost 12, 최소 12자, zxcvbn score ≥ 3, breached-password 사전 차단"
- "리소스별 ABAC, policy: {action, resource, condition}, 서버사이드 enforcement"
Conservative_Judgment:
- "규제 적용 범위 불확실 시 '적용 가능성 있음'으로 포함"
- "'이 정도면 안전하다'는 표현 금지"
- "법률 자문이 아닌 기술 보안 관점의 참고 정보"
Phase 구조 (Overview)
Phase 0: Input Normalization → 입력 유형 판별 (문서/질문/구현의도) + 도메인·관할·차원 감지
Phase 1: Threat Surface Map → 문서 섹션별 위협 표면 매핑 (8차원 활용)
Phase 2: Standard Binding → 위협별 글로벌 표준/규제 바인딩
Phase 3: Opinion/Review/Consultation Gen → 모드별 출력 생성
Phase 4: Code Exemplification → 수정 코드 예시 생성 (의견 모드) 또는 설계 가이드 (검토 모드)
Phase 5: Checklist Assembly → Phase별 체크리스트 + Risk Acceptance
Phase 6: Output Formatting → 템플릿 기반 최종 출력
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 869 lines · 30 tokens per session scan A e58d53ab489e
ch015-feedback is a skill published in the GitHub repository ch015/code-pentester (4 stars, last pushed 13d ago), licensed MIT. It adds 30 tokens to every session and 10,715 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
codebeacon
Scan a codebase → AST extraction → knowledge graph → wiki + CLAUDE.md context map. Supports 27 frameworks (Spring Boot, NestJS, Django, FastAPI, Flask, Rails, Express, Fastify, Koa, React, Next.js, Vue, Nuxt, Angular, SvelteKit, Gin, Echo, Fiber, Laravel, Actix-Web, Axum, Tauri, Rocket, Warp, ASP.NET Core, Vapor…
test-harness
Test codeweave-mcp tools against any project using TestHarness. Use this whenever verifying tool behavior, testing a code change, or running custom assertions — e.g. "test the harness", "run tests against X project", "does semanticsearch work correctly".
nexus-mapper
Generate a persistent .nexus-map/ knowledge base that lets any AI session instantly understand a codebase's architecture, systems, dependencies, and change hotspots. Use when starting work on an unfamiliar repository, onboarding with AI-assisted context, preparing for a major refactoring initiative, or enabling…
nexus-query
Precise, instant code structure queries for active development — answer 'who depends on this interface before I refactor it', 'how many modules break if I change this', 'what is the real impact radius of this feature change', 'which module is the true high-coupling hotspot in this legacy codebase'. Essential before…
repomix
Pack and analyze codebases into AI-friendly single files using Repomix. Use when the user wants to explore repositories, analyze code structure, find patterns, check token counts, or prepare codebase context for AI analysis. Supports both local directories and remote GitHub repositories.
knowledge-base
Create and maintain a Markdown knowledge base that any AI agent can read, search, and update. Use when the user wants to start a knowledge base, add or update notes, organize docs/notes for an agent or LLM to consume, build an index of notes, or run a cleanup/maintenance pass on an existing MD knowledge base. Triggers…