Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/emre-guler/websec/llmnpx skills add emre-guler/websec --skill llmgit clone --depth 1 https://github.com/emre-guler/websecWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00085 | $0.05623 |
| Opus 5 | $0.00043 | $0.02812 |
| Sonnet 5 | $0.00017 | $0.01125 |
| Haiku 4.5 | $0.00009 | $0.00562 |
Grade A, and why
llm scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 168 lines — stays where its author put it; the contents beside it link to each section on GitHub.
LLM Integration Detection
Overview
An application that embeds a language model gives a server-side component authority that the caller does not have: the model reads a prompt, may invoke functions on the user's behalf, and returns text the application often renders or acts on. The flaw is not in the model — it is in the three code paths around it. Untrusted text is concatenated into the prompt with nothing separating instructions from data, so the model cannot tell developer intent from attacker text. Tools are registered with more authority than the caller, so persuading the model to call one crosses a boundary the caller could not cross directly. And model output is passed onward without encoding, so whatever the model emits executes wherever it lands. Structurally this mirrors request forgery: a privileged intermediary is coerced into acting against systems it can reach and the attacker cannot. The attacker is either a direct chat user or a third party who plants text in content the model later ingests — a review, a document, a profile field, a fetched page — which reaches other users' sessions. This skill finds these by locating every prompt assembly site, tool definition, and output consumer, checking each in parallel, and merging the results into <output_dir>/llm-results.md.
What it is NOT
- The classic class at the sink (
/websec:os-command-injection,/websec:sql-injection,/websec:path-traversal,/websec:ssrf,/websec:ssti): when a tool argument reaches a shell, a query, a file path, a template, or an outbound request unvalidated, the finding belongs to that skill; the model is the delivery channel. Judge here whether the tool should exist, what authority it holds, and whether the argument is treated as untrusted — then name the sibling class and the sink in the finding. - Cross-site scripting (
/websec:xss): model output written unescaped into a page is XSS reached through an unusual source. Judge the output path here — whether the application encodes for the destination context and whether an attacker can steer the output — and cross-reference/websec:xssfor the rendering fix. - Access control (
/websec:access-control): if a tool's backing API is missing authorization for direct callers too, that is an access-control gap. It is judged here when the API is reachable only through the model and relies on the prompt to gate who may use it. - Information disclosure (
/websec:information-disclosure): secrets in configuration or logs belong there. Secrets placed in a system prompt or retrieval context that any caller can elicit are judged here. - Training-data poisoning and extraction of memorised training data: real risks, but not decidable from application source. Note the data source and any unscrubbed corpus in one line under "Also observed" rather than classifying it.
- Not a finding: a model integration with no privileged tool, no sensitive context, and no dangerous output consumer — prompt injection with nothing to reach is not an impact; a refusal or guardrail observed in a system prompt, which is not a control; output whose only consumer is a text pane that already escapes it.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 168 lines · 85 tokens per session scan A f3797135d449
llm is a skill published in the GitHub repository emre-guler/websec (2 stars, last pushed 6d ago), licensed MIT. It adds 85 tokens to every session and 5,623 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
AI/ML Attack Surface
This skill should be used when the user asks about "AI security", "ML pipeline attacks", "prompt injection", "model deserialization", "unsafe model loading", "Jupyter injection", "LLM security", or needs to identify AI/ML-specific vulnerabilities in codebases that use machine learning frameworks.
coff0xc-ai-agent-rag
Use when / 当用户请求 Agent、RAG、LLM、Prompt、embedding、向量数据库、LangChain/AutoGen、tool calling、多模型编排、记忆/缓存、评测、观测、成本、失败恢复或可落地 AI 助手。交付架构、工具 schema、检索引用、eval 和降级。手动触发：使用 coff0xc-ai-agent-rag。.
arize-prompt-optimization
Optimizes, improves, and debugs LLM prompts using production trace data, evaluations, and annotations. Extracts prompts from spans, gathers performance signal, and runs a data-driven optimization loop using the ax CLI. Use when the user mentions optimize prompt, improve prompt, make AI respond better, improve output…
arize-prompts
INVOKE THIS SKILL for Arize Prompt Hub and ax prompts workflows: author or import templates and save (Workflows A–B), label/promote (C), or list/get/edit/delete/duplicate (D). Use when the user mentions ax prompts, Prompt Hub, creating/editing/saving a prompt, {variable} placeholders, or production/staging labels. For…
context-fundamentals
This skill should be used to explain or reason about the foundational concepts of context engineering: what context is, the anatomy of a context window, how attention mechanics work, the U-shaped attention curve, why context quality matters more than quantity, and the mental models needed to interpret every other…
enhance-prompt
Transforms vague UI ideas into polished, Stitch-optimized prompts. Enhances specificity, adds UI/UX keywords, injects design system context, and structures output for better generation results.