Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add cyj4578/chen-skillshub --skill web-sastgit clone --depth 1 https://github.com/cyj4578/chen-skillshubWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/cyj4578/chen-skillshub/web-sast)<a href="https://agentmods.dev/skills/cyj4578/chen-skillshub/web-sast"><img src="https://agentmods.dev/badge/skills/cyj4578/chen-skillshub/web-sast/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/cyj4578/chen-skillshub/web-sast"><img src="https://agentmods.dev/badge/skills/cyj4578/chen-skillshub/web-sast.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00075 | $0.05307 |
| Opus 5 | $0.00037 | $0.02653 |
| Sonnet 5 | $0.00015 | $0.01061 |
| Haiku 4.5 | $0.00007 | $0.00531 |
Grade A, and why
web-sast scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
curl -sI -L -A "Mozilla/5.0" "$URL" How it starts
The opening of the file, as written. The whole thing — 342 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Web SAST
Web 前端静态安全扫描。输入一个 URL，自动执行 4 阶段扫描（HTTP头/SSL → 源码提取 → 漏洞模式匹配 → 分级报告），输出含修复建议的结构化安全审计报告（HTML 格式，浏览器打印即可导出 PDF）。
核心能力
用户给 URL → 我来扫 → 出报告（Critical / High / Medium / Low）
能做什么：
- 扫描任何可通过 HTTP 访问的 Web 页面（H5、SPA、传统站点）
- 检测前端 JS 源码中的安全漏洞模式
- 分析 HTTP 安全响应头和 SSL/TLS 配置
- 识别硬编码密钥、客户端验证码生成、PII 泄露等常见问题
- 输出分级报告 + 每个漏洞的修复代码示例
不能做什么：
- ❌ 不做后端渗透测试（SQL注入需交互式探测，静态扫描无法完成）
- ❌ 不做 DDoS / 网络层测试
- ❌ 不扫描需要登录才能访问的页面（除非用户提供认证信息）
- ❌ 不替代 OWASP ZAP / Burp Suite 等专业安全工具
- ❌ 不对目标发起任何攻击性行为（只读分析，零副作用）
触发条件
以下任一场景触发本 Skill：
| 用户说的话 | 触发 |
|---|---|
| "这个页面安全吗" / "有漏洞吗" | ✅ |
| "帮我审计/扫描一下这个网站" | ✅ |
| "检查 XSS / CSRF / 安全头" | ✅ |
| "有没有后门 / 密钥泄露" | ✅ |
| "等保测评 / 安全合规检查" | ✅ |
| "帮我写一个安全检测报告" | ✅ |
| "这个 URL 能打开，看看代码" | ✅ |
不触发的场景：
- 用户只问概念性问题（"什么是XSS"）→ 用解释/教学方式回答即可，不需要加载本 Skill
- 用户要求修改/修复代码 → 本 Skill 只负责发现，修复用其他 Skill 或直接编码
- 用户提供的不是 URL（如本地文件路径）→ 需要调整策略
工作流程
Phase 1: 表面扫描（约 10 秒）
抓取 HTTP 响应头和 SSL 证书信息。
# 获取响应头
curl -sI -L -A "Mozilla/5.0" "$URL"
# 检查 SSL 证书
echo | openssl s_client -connect $DOMAIN:443 -servername $DOMAIN 2>/dev/null | openssl x509 -noout -dates -subject -issuer
检查项清单：
| 安全头 | 期望值 | 缺失时严重度 |
|---|---|---|
| Content-Security-Policy | 存在且非空 | Medium |
| Strict-Transport-Security | max-age ≥ 31536000 | Medium |
| X-Frame-Options | DENY / SAMEORIGIN | Low |
| X-Content-Type-Options | nosniff | Low |
| Referrer-Policy | 存在 | Low |
| Set-Cookie 的 HttpOnly/Secure/SameSite | 全部具备 | High |
SSL 证书检查：
- 是否过期？（当前日期 vs notAfter）
- 颁发机构是否为知名 CA？
- SAN 是否包含目标域名？
Phase 2: 源码提取（约 15 秒）
下载 HTML 页面并提取所有外部 JS/CSS 资源。
# 下载完整 HTML
curl -sL -A "Mozilla/5.0" "$URL" > page.html
# 提取所有 JS 引用
grep -oE 'src="([^"]+\.js[^"]*)"' page.html | sed 's/src="//;s/"$//' > js_urls.txt
# 提取所有 CSS 引用
grep -oE 'href="([^"]+\.css[^"]*)"' page.html | sed 's/href="//;s/"$//' > css_urls.txt
# 下载每个 JS 文件到 js/ 目录
while read js_path; do
# 处理相对路径/绝对路径/完整URL
curl -sL "$full_url" -o "js/$(basename $js_path)"
done < js_urls.txt
What ships with it
3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 10d ago First seen · 342 lines · 75 tokens per session scan A 1155d86fc8f8
web-sast is a skill published in the GitHub repository cyj4578/chen-skillshub (11 stars, last pushed 2mo ago), licensed MIT. It adds 75 tokens to every session and 5,307 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
opencli-sitemap-author
Use when creating or maintaining OpenCLI site sitemaps: agent-facing navigation, page-state, action, workflow, API-reference, pitfall, and fallback knowledge for a website. Use after browser exploration discovers durable site context, when a sitemap is stale, or when promoting local site knowledge into the repo.
debug-optimize-lcp
Guides debugging and optimizing Largest Contentful Paint (LCP) using Chrome DevTools MCP tools. Use this skill whenever the user asks about LCP performance, slow page loads, Core Web Vitals optimization, or wants to understand why their page's main content takes too long to appear. Also use when the user mentions…
interactive-login
How to complete browser/interactive logins (aws / gh / glab / gcloud). The platform backgrounds the login poller so it survives the human's browser round-trip — and when that does NOT work.
pinchtab-mcp
Use this skill when a task requires browser automation through PinchTab's MCP server connected to a remote browser instance. Covers navigation, element interaction, data extraction, form filling, multi-step flows, and session management via MCP tools.
azure-messaging-webpubsub-java
Build real-time web applications with Azure Web PubSub SDK for Java. Use when implementing WebSocket-based messaging, live updates, chat applications, or server-to-client push notifications.
google-safe-browsing
Prevent and fix Google Safe Browsing "Dangerous site" flags. Use when launching a public web app, buying/picking a domain, building a login or signup page, or when any site shows a red "Dangerous site" / "Deceptive site" warning in Chrome, Brave, Safari, Firefox, or Edge. Triggers on "dangerous site", "deceptive…