Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add ch015/code-pentester --skill feedbackgit clone --depth 1 https://github.com/ch015/code-pentesterWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/ch015/code-pentester/feedback)<a href="https://agentmods.dev/skills/ch015/code-pentester/feedback"><img src="https://agentmods.dev/badge/skills/ch015/code-pentester/feedback/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/ch015/code-pentester/feedback"><img src="https://agentmods.dev/badge/skills/ch015/code-pentester/feedback.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00030 | $0.02918 |
| Opus 5.5 | $0.00012 | $0.01167 |
| Sonnet 5.5 | $0.00006 | $0.00584 |
| Haiku 4.5 | $0.00003 | $0.00292 |
Grade A, and why
ch015-feedback scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 215 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Security Design Review — 보안 설계 리뷰 스킬
PRD/기획서를 분석하여 글로벌 보안 표준·규제에 근거한 보안 의견서 또는 보안 검토 의견서를 생성한다.
서비스 개요
| 항목 | 내용 |
|---|---|
| 서비스명 | Security Design Review |
| 방법론 | 문서 정찰 → 위협 표면 매핑 → 표준 바인딩 → 의견/검토 생성 |
| 출력물 | Opinion: 섹션별 MUST/SHOULD 의견 + 코드 예시 (OP-{NNN}) |
| Review: CRITICAL~LOW 검토 Finding + 설계 가이드 (C/H/M/L-{NN}) | |
| 코드 수정 | 없음 (명세·의견 생성 전용) |
| 코드 분석 | 없음 (PRD/기획서 텍스트 분석) |
| 토큰 예산 | ~22-35K (Phase별 계층 로딩) |
출력 모드
Mode_Selection:
opinion:
trigger: "--mode opinion (기본값)"
대상: "개발자, AI 코딩 도구"
관점: "구현 가이드 — '이렇게 만들어라'"
ID: "OP-{NNN} (001부터 순차)"
구조: "문서 섹션별 MUST / MUST NOT / SHOULD 의견 + 코드 예시"
용도: "Cursor, Claude Code 등에 컨텍스트로 주입하여 보안 요건 반영 코딩"
review:
trigger: "--mode review"
대상: "QSA, CISO, 경영진, 개발팀"
관점: "감사 리포트 — '이 설계의 위험은 이것이다'"
ID: "C-{NN} / H-{NN} / M-{NN} / L-{NN}"
구조: "Severity별 Finding + 표준 Gap 분석 + Risk Acceptance Matrix"
용도: "Go/No-Go 의사결정, 감사 대응, 규제 보고"
설계 원칙
No_Pattern_Lists:
- "CWE/OWASP 카탈로그를 기계적으로 나열하지 않는다"
- "PRD 컨텍스트에서 실제 관련된 표준만 바인딩"
- "도메인·관할에 따라 적용 표준이 달라짐을 인지"
Standards_Authority:
- "권고하는 모든 알고리즘·파라미터에 근거 표준 인용 필수"
- "표준이 명확하면 그대로 인용 (e.g., NIST SP 800-63B §5.1.1.2)"
- "표준 간 충돌 시 가장 엄격한 기준 채택"
- "표준이 업데이트된 경우 최신 버전 적용 (e.g., PCI DSS 4.0.1 future-dated 2025-03-31)"
Implementation_Specificity:
핵심: "구현자가 바로 코딩할 수 있는 수준"
bad_examples:
- "암호화 적용"
- "강력한 비밀번호 정책"
- "적절한 접근 제어"
good_examples:
- "AES-256-GCM envelope encryption, DEK 로테이션 365일, CMK→DEK 2-tier"
- "bcrypt cost 12, 최소 12자, zxcvbn score ≥ 3, breached-password 사전 차단"
- "리소스별 ABAC, policy: {action, resource, condition}, 서버사이드 enforcement"
Conservative_Judgment:
- "규제 적용 범위 불확실 시 '적용 가능성 있음'으로 포함"
- "'이 정도면 안전하다'는 표현 금지"
- "법률 자문이 아닌 기술 보안 관점의 참고 정보"
Phase 구조 (Overview)
Phase 0: Input Normalization → 입력 유형 판별 (문서/질문/구현의도) + 도메인·관할·차원 감지
Phase 1: Threat Surface Map → 문서 섹션별 위협 표면 매핑 (8차원 활용)
Phase 2: Standard Binding → 위협별 글로벌 표준/규제 바인딩
Phase 3: Opinion/Review/Consultation Gen → 모드별 출력 생성
Phase 4: Code Exemplification → 수정 코드 예시 생성 (의견 모드) 또는 설계 가이드 (검토 모드)
Phase 5: Checklist Assembly → Phase별 체크리스트 + Risk Acceptance
Phase 6: Output Formatting → 템플릿 기반 최종 출력
What ships with it
11 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- references/checklist.md 2.4 KB
- references/code-exemplification.md 2.7 KB
- references/consultation.md 4.6 KB
- references/context-loading.md 2.1 KB
- references/input-normalization.md 7.1 KB
- references/opinion.md 2.0 KB
- references/output-formatting.md 1.8 KB
- references/regulatory-currentness.md 1.6 KB
- references/review.md 2.2 KB
- references/standard-binding.md 2.0 KB
- references/threat-surface.md 2.2 KB
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago Changed · -654 lines ae1f431bc077
- 1mo ago First seen · 869 lines · 30 tokens per session scan A e58d53ab489e
ch015-feedback is a skill published in the GitHub repository ch015/code-pentester (4 stars, last pushed 2d ago), licensed MIT. It adds 30 tokens to every session and 2,918 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
dotnet-analyzer-security-deps
Scan .NET projects for security vulnerabilities (OWASP Top 10), NuGet dependency health, CVE exploits, license compliance, and version conflicts using Roslyn and NuGet.org API. Use when the user asks to scan for security vulnerabilities, check for CVE, analyze dependency health, check license compliance, scan NuGet…
plagiarism-checker
Scans lyrics for phrases that may match existing songs using web search and LLM knowledge. Use before release to check for unintentional borrowing.
revenue-recognition
Determines when and how revenue is recognized — performance obligations, contract terms that change the answer, and the deal structures that create accounting problems. Use this to work out how a contract should be recognized, review a non-standard deal before it is signed, understand deferred revenue, or spot terms…
compensation-and-leveling
Builds and maintains the leveling framework and pay structure — level definitions, salary bands, benchmarking, pay equity, and how raises and promotions are decided. Use this to design or revise leveling, set or adjust salary bands, benchmark against market, handle a compensation request or counteroffer, run a review…
employment-compliance
Covers the employment rules that carry real penalties — exempt and non-exempt classification, overtime and hours, employee versus contractor status, work authorization and recordkeeping, accommodation requests, and the notices and retention obligations that go with them. Use this to classify a role, review a…
privacy-and-data-protection
Assesses and improves how personal data is collected, used, shared, and retained — data mapping, lawful basis, consent, processor agreements, subject rights, and breach obligations. Use this before launching anything that handles personal data, when adding a vendor that will process it, when a data subject request…