Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add EresusSecurity/appsec-skills --skill eresus-codeql-heuristicsgit clone --depth 1 https://github.com/EresusSecurity/appsec-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/eresussecurity/appsec-skills/eresus-codeql-heuristics)<a href="https://agentmods.dev/skills/eresussecurity/appsec-skills/eresus-codeql-heuristics"><img src="https://agentmods.dev/badge/skills/eresussecurity/appsec-skills/eresus-codeql-heuristics.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00070 | $0.02259 |
| Opus 5 | $0.00035 | $0.01130 |
| Sonnet 5 | $0.00014 | $0.00452 |
| Haiku 4.5 | $0.00007 | $0.00226 |
Grade B, and why
eresus-codeql-heuristics scanned grade B with 3 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Encoded or obfuscated payloadmediumSupply chain
base64 or hex that is decoded and executed hides what actually runs from anyone reading the file.
- `marshal.loads(userInput)` Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
- `requests.get(userInput)` Runs shell commandslowCapability
Expected in a hook, worth knowing in a rule or an instructions file.
- `os.system(userInput)` How it starts
The opening of the file, as written. The whole thing — 309 lines — stays where its author put it; the contents beside it link to each section on GitHub.
CodeQL-Informed Audit Heuristics
Purpose
Provide a language-specific reference of dangerous sinks, sources, and patterns that security auditors should prioritize during manual code review. These heuristics are derived from the CodeQL Community Packs — the same query suites used by GitHub Advanced Security to find real vulnerabilities at scale.
Use this skill as a checklist companion during manual audit. It tells you what to look for
in each language. The actual manual reasoning is done by eresus-manual-security-audit.
Java / Kotlin
Command Injection
Runtime.exec(),ProcessBuilder.command()Runtime.getRuntime().exec(userInput)
JNDI Injection
InitialContext.lookup(userInput)Context.lookup()with attacker-controlled LDAP/RMI URLs
Expression Language Injection
SpELExpressionParser.parseExpression(userInput)OGNL.getValue(userInput)MVEL.eval(userInput)
SQL Injection
Statement.execute(query)with string concatenationStatement.executeQuery("SELECT ... " + userInput)- JPA
createNativeQuery()with interpolated strings - MyBatis
${}(raw) vs#{}(parameterized)
Deserialization
ObjectInputStream.readObject()XStream.fromXML()Kryo.readObject()- Jackson
@JsonTypeInfowithMINIMAL_CLASS/CLASS
XXE
DocumentBuilderFactorywithoutsetFeature(XMLConstants.FEATURE_SECURE_PROCESSING)SAXParserFactorywithout disabling external entitiesXMLInputFactorywithout disabling DTDs
Unsafe Reflection
Class.forName(userInput).newInstance()Method.invoke()with user-controlled method names
Path Traversal
new File(basePath + userInput)without canonicalizationPaths.get(userInput)without restricting to base directory
Python
Command Injection
os.system(userInput)subprocess.Popen(userInput, shell=True)subprocess.call(userInput, shell=True)os.popen(userInput)
Code Injection
eval(userInput)exec(userInput)compile(userInput, ...)
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 7d ago First seen · 309 lines · 70 tokens per session scan B e11d069833ae
eresus-codeql-heuristics is a skill published in the GitHub repository EresusSecurity/appsec-skills (7 stars, last pushed 5mo ago), licensed Apache-2.0. It adds 70 tokens to every session and 2,259 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it B with 3 findings (encoded or obfuscated payload, makes network calls, runs shell commands). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
ai-skill-auditor
A universal, dependency-free Node.js tool to statically audit AI Skills and local agents for malicious patterns.
smart-contract-audit
Comprehensive smart contract security audit framework with multi-expert analysis. Use for full audits of Ethereum / EVM Solidity and Vyper, Solana / SVM Anchor Rust, TON / FunC / Tact, or Sui / Move projects.
jwt-attacks
Forge and re-sign captured JWTs to test signature validation - algorithm confusion (alg:none, RS256 to HS256), key injection, and secret cracking. Use when testing JWT or bearer-token auth.
infrastructure-audit
Comprehensive infrastructure security audit framework for IaC, Docker, Kubernetes, and cloud configurations. Use for full infrastructure audits.
external-enumeration
Passively map a company's domains, subdomains, DNS ownership, tech stack, and CDNs. Use to recon an external attack surface or enumerate subdomains.
broken-access-control
Replay captured requests with swapped identities and bumped object IDs to surface broken access control. Use when testing for IDOR or authz flaws.