Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/danielmiessler/lifeos/securitymarketdatanpx skills add danielmiessler/LifeOS --skill securitymarketdatagit clone --depth 1 https://github.com/danielmiessler/LifeOSWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00057 | $0.00744 |
| Opus 5 | $0.00028 | $0.00372 |
| Sonnet 5 | $0.00011 | $0.00149 |
| Haiku 4.5 | $0.00006 | $0.00074 |
Grade A, and why
SecurityMarketData scanned grade A with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Sends data to an external URLlowData exfiltration
A POST to an outside endpoint may be telemetry or may be exfiltration; either way the mod talks to somewhere, and you should know where.
curl -s -X POST http://localhost:31337/notify -H 'Content-Type: application/json' -d '{"message":"Running the QueryMarket workflow in the SecurityMarketData skill to query cybersecurity market data"}' > /dev/null 2>&1 & Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
curl -s -X POST http://localhost:31337/notify -H 'Content-Type: application/json' -d '{"message":"Running the QueryMarket workflow in the SecurityMarketData skill to query cybersecurity market data"}' > /dev/null 2>&1 & How it starts
The opening of the file, as written. The whole thing — 76 lines — stays where its author put it; the contents beside it link to each section on GitHub.
SecurityMarketData
Query Return on Security's Signal data through its live MCP interface, with evidence, freshness, and analytical boundaries intact.
Customization
Before executing, check ~/.claude/LIFEOS/USER/CUSTOMIZATIONS/SKILLS/SecurityMarketData/. If present, load enabled preferences and configuration; otherwise use these defaults.
Voice Notification
When executing QueryMarket, run:
curl -s -X POST http://localhost:31337/notify -H 'Content-Type: application/json' -d '{"message":"Running the QueryMarket workflow in the SecurityMarketData skill to query cybersecurity market data"}' > /dev/null 2>&1 &
Output: Running the QueryMarket workflow in the SecurityMarketData skill to query cybersecurity market data...
Workflow Routing
| Workflow | Trigger | File |
|---|---|---|
| QueryMarket | Any supported market, company, investor, funding, M&A, or lifecycle query | Workflows/QueryMarket.md |
Load References/ToolCatalog.md only when selecting tools, confirming tiers, or using the REST fallback. Do not preload it for routing.
Setup and Diagnostics
Prefer Streamable HTTP MCP. For Hermes:
hermes mcp add signal-mcp --url https://mcp.returnonsecurity.com/mcp
hermes mcp list
OAuth 2.1 authorization is interactive. It cannot be bypassed, automated away, or claimed complete before the user finishes it.
Optional vendor examples:
claude mcp add signal-mcp https://mcp.returnonsecurity.com/mcp
claude mcp list
codex mcp add signal-mcp https://mcp.returnonsecurity.com/mcp
codex mcp login signal-mcp
Examples
-
Funding trend: “Show quarterly funding trends for cloud security and distinguish observed rounds from forecasts.”
-
Company enrichment: “Enrich this security company and report its category, funding, investors, lifecycle, and data freshness.”
-
Category M&A: “Map identity-security M&A activity, acquirers, and observed consolidation signals for the last three years.”
Gotchas
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 76 lines · 57 tokens per session scan A 76397f2050af
SecurityMarketData is a skill published in the GitHub repository danielmiessler/LifeOS (18,798 stars, last pushed 19d ago), licensed MIT. It adds 57 tokens to every session and 744 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 2 findings (sends data to an external url, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
mobile-harness
Portable Android and iOS device-control harness for agents. Use when an agent needs to control or automate Android/iOS devices — tap, swipe, screenshot, app control — locally (ADB/Portal/Simulator) or on Mobilerun cloud devices.
macos-harness
Control a whole Mac from one persistent Python session with screenshots, PID-targeted input, an animated virtual pointer, targeted Apple Accessibility, Apple Events, Browser Harness CDP, and filesystem access. Use for native, Electron, browser, dialog, file, or cross-app tasks without moving the physical cursor or…
aster-config
Reference for aster.yaml, covering review models, analyzers, focus areas, include/exclude globs, minconfidence, and the permissions block that gates edits. Use when creating or editing aster.yaml, choosing hypothesis/verify models, enabling semgrep or ast-grep, or configuring edit permissions.
aster-chat-sessions
Drive aster chat programmatically and manage sessions and memory: one-shot --print/--json answers, --messages-json for caller-owned history, --continue and --session persistence, --allow-edits gating, and the sessions/memory commands. Use when scripting aster chat, integrating it into an editor or agent, or inspecting…
aster-review-ci
Run aster code reviews non-interactively in CI, GitHub Actions, or from another agent. Covers aster review --pr, --json, --stream, --comment, diff-from-stdin, token handling, and filtering findings. Use when wiring aster into a pipeline, posting PR comments, or parsing review output programmatically.
echo-plugins
Build, validate, package, and stage optional Echo plugins using the Echo Plugin API v1 security and lifecycle contracts.