Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add Cratis/AI --skill cratis-security-reviewgit clone --depth 1 https://github.com/Cratis/AIWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/cratis/ai/cratis-security-review)<a href="https://agentmods.dev/skills/cratis/ai/cratis-security-review"><img src="https://agentmods.dev/badge/skills/cratis/ai/cratis-security-review/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/cratis/ai/cratis-security-review"><img src="https://agentmods.dev/badge/skills/cratis/ai/cratis-security-review.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00074 | $0.01565 |
| Opus 5 | $0.00037 | $0.00783 |
| Sonnet 5 | $0.00015 | $0.00313 |
| Haiku 4.5 | $0.00007 | $0.00156 |
Grade A, and why
cratis-security-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 142 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Cratis security review
Event sourcing changes the shape of a security review. A mistake in an ordinary application is a bug you fix; a secret written into an append is a fact that lives in the log forever and cannot be edited out. The event-sourcing section below is the one that is specific to this stack, and it is the one worth reading first.
Verified product sources
| Package | Version | Purpose |
|---|---|---|
Cratis.Arc.Chronicle |
22.10.4 |
[NotAudited] in Cratis.Arc.Chronicle.Commands; the ARCCHR0009 analyzer |
Cratis.Chronicle |
16.45.2 |
[PII], [Subject], redaction, namespace isolation |
Cratis.Arc.Core |
22.10.4 |
Authorization filters, CommandResult.Unauthorized |
Reverify against the owning product repository before asserting a framework guarantee this file does not already state.
Route near misses
- General correctness and maintainability: use
cratis-code-review. - Scalability and resource use: use
cratis-performance-review. - Implementing authentication, authorization or identity: use
cratis-arc-authentication-authorization-and-identity. This skill reviews; it does not build. - Compliance mechanics —
[PII], subject resolution, erasure, redaction: usecratis-chronicle-compliance.
Step 1 — Event sourcing: the permanent-record checks
- Every
[Command]property holding a secret is marked[NotAudited]. A command's property values are written to the causation of every event it appends, and causation is as permanent as the events. Prefer the marking on the concept type so it travels everywhere the value appears.ARCCHR0009catches properties whose names read as secrets — so read the properties whose names do not say what they hold, because the analyzer cannot. - Personal data is
[PII], not[NotAudited]. They are different mechanisms with different consequences:[NotAudited]withholds a value from the causation chain;[PII]enrolls it in per-subject encryption and erasure. A password is[NotAudited]. An email address is[PII]. Neither substitutes for the other. - No secret, token, API key or password in an event property or a read model.
- Event-source ids are generated server-side, never accepted from an untrusted client where the id grants access to a stream.
- Upcasting and event-type migration logic cannot introduce a property the original contract did not carry.
- Uniqueness cannot be bypassed by concurrent writes — it is enforced by a Chronicle constraint, not by a read-model pre-check.
- Cross-tenant writes cannot bypass a constraint that is scoped per namespace.
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 142 lines · 74 tokens per session scan A ee7f526f3a8b
cratis-security-review is a skill published in the GitHub repository Cratis/AI (2 stars, last pushed yesterday), licensed MIT. It adds 74 tokens to every session and 1,565 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-08.
Other skills, from other repositories
code-analysis
Use the free built-in .NET SDK analyzers and analysis levels with gradual Roslyn warning promotion. USE FOR: the repo wants first-party .NET analyzers; CI should fail on analyzer warnings; the team needs AnalysisLevel or AnalysisMode guidance. DO NOT USE FOR: third-party analyzer selection by itself; formatting-only…
sonarjs
Use SonarJS-derived rules in .NET repositories that ship JavaScript or TypeScript frontends and need deeper bug-risk, code-smell, or cognitive-complexity checks than a minimal ESLint baseline. USE FOR: SonarQube, SonarCloud, or eslint-plugin-sonarjs setups; frontend code smells; cognitive complexity and deeper…
meziantou-analyzer
Use the open-source free Meziantou.Analyzer package for design, usage, security, performance, and style rules in .NET. Use when a repo wants broader analyzer coverage with a single NuGet package. USE FOR: the repo uses or wants Meziantou.Analyzer; the team wants one analyzer pack that covers design, usage, security…
review
Code review skill for PRs, branches, or uncommitted changes. Loads the appropriate subset of architecture/subsystem docs based on what changed, walks the changeguardrailsrules pre-PR checklist, and emits structured findings (blocking / advisory / nit) with a verdict.
dotnet-techne-csharp-type-design-performance
Use when designing types and collections for hot paths and low-allocation .NET code. Keywords: readonly struct, sealed class, ValueTask, Span, FrozenDictionary, FrozenSet, allocation optimisation.
dotnet-techne-csharp-api-design
Use when designing or changing public C#/.NET APIs with compatibility and versioning constraints. Keywords: breaking change, API design, backward compatibility, binary compatibility, deprecation strategy, versioning.