Borrowing it
Nothing to install: this file belongs to ebibibi/ebi-agent-chat-relay. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/ebibibi/ebi-agent-chat-relay/main/.claude/skills/security-audit/SKILL.mdgit clone --depth 1 https://github.com/ebibibi/ebi-agent-chat-relayWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/ebibibi/ebi-agent-chat-relay/security-audit)<a href="https://agentmods.dev/skills/ebibibi/ebi-agent-chat-relay/security-audit"><img src="https://agentmods.dev/badge/skills/ebibibi/ebi-agent-chat-relay/security-audit.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00024 | $0.00791 |
| Opus 5 | $0.00012 | $0.00396 |
| Sonnet 5 | $0.00005 | $0.00158 |
| Haiku 4.5 | $0.00002 | $0.00079 |
Grade A, and why
security-audit scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 88 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Security Audit — claude-code-discord-bridge Specific
This project runs arbitrary Claude Code sessions triggered by Discord messages. Security is the #1 priority.
When to Activate
- Before any commit that changes
runner.py,_run_helper.py, or any Cog - When adding new user-facing commands
- When modifying subprocess execution or argument passing
- When adding new environment variables or configuration
- Periodically as a full audit
Threat Model
| Threat | Vector | Mitigation |
|---|---|---|
| Command injection | User message passed to CLI args | create_subprocess_exec (no shell), -- separator |
| Flag injection | Prompt starting with - |
-- separator before prompt |
| Session hijack | Fake session ID | Strict regex validation ^[a-f0-9\-]+$ |
| Skill injection | Malicious skill name | Strict regex validation ^[\w-]+$ |
| Secret exfiltration | Claude Bash tool reads env | Strip secrets from subprocess env |
| Nesting attack | Claude spawns another claude-code-discord-bridge | Strip CLAUDECODE from env |
| Token theft | Bot token in logs/errors | Never log tokens, strip from env |
Checklist
Subprocess Safety
- All subprocess calls use
asyncio.create_subprocess_exec(NEVERshell=True) -
--separator is always placed before user-provided prompt text - No string formatting/interpolation of user input into command strings
- Session IDs validated with
re.match(r"^[a-f0-9\-]+$", session_id) - Skill names validated with
re.match(r"^[\w-]+$", name)
Environment Security
-
_STRIPPED_ENV_KEYSincludes all secret environment variables -
DISCORD_BOT_TOKENis stripped from subprocess env -
CLAUDECODEis stripped (prevents nesting detection bypass) - No secrets in log output (check
logger.info/debug/warning/errorcalls) -
.envfile is in.gitignore
Input Validation
- All user-provided strings are validated before use
- Discord message content is never directly interpolated into commands
- Thread IDs and channel IDs are validated as integers
- No user input reaches dangerous evaluation functions
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 7d ago First seen · 88 lines · 24 tokens per session scan A 6f6c9775a15a
security-audit is a skill published in the GitHub repository ebibibi/ebi-agent-chat-relay (56 stars, last pushed today), licensed MIT. It adds 24 tokens to every session and 791 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
switch
How to take part in a Switch room. Load this skill before your first Switch action and whenever Switch comes up — the user mentions Switch, a Switch room or another Switch agent; you are asked to list, join, read or post in a room, create a room or room group, work with references, links or roles, or inspect an agent…
configure
Set up the Switch connector for Claude Code — register this Claude Code instance as a Switch agent and write the credentials the bundled MCP server and hooks read. Use when the user asks to configure Switch, set up the plugin, register with a Switch server, or when the Switch tools report no identity.
codex-delegate
Delegate a coding task to the OpenAI Codex CLI as a background implementer, then review its diff and land it yourself. Use this whenever the user wants to hand implementation work to Codex — phrasings like "have Codex do X", "delegate this to Codex", "run it through Codex", or "use Codex to implement/fix/refactor" …
warp-delegate
Delegate a coding task to the Warp Agent CLI (oz) as a background implementer, then review its diff and land it yourself. Use this whenever the user wants to hand implementation work to Warp - phrasings like "have Warp implement X", "delegate this to the Warp CLI", "run it through Warp", "use oz to…
cursor-delegate
Delegate a coding task to the Cursor Agent CLI (cursor-agent) as a background implementer, then review its diff and land it yourself. Use this whenever the user wants to hand implementation work to Cursor — phrasings like "have Cursor implement X", "delegate this to Cursor", "run it through Cursor Agent", or "use…
cline-delegate
Delegate a coding task to the Cline coding agent CLI (cline) as a background implementer, then review its diff and land it yourself. Use this whenever the user wants to delegate implementation work to Cline - phrasings like "have Cline implement X", "delegate this to cline", "run it through Cline", or "use cline to…