Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add event4u-app/agent-config --skill authz-reviewgit clone --depth 1 https://github.com/event4u-app/agent-configWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/event4u-app/agent-config/authz-review)<a href="https://agentmods.dev/skills/event4u-app/agent-config/authz-review"><img src="https://agentmods.dev/badge/skills/event4u-app/agent-config/authz-review/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/event4u-app/agent-config/authz-review"><img src="https://agentmods.dev/badge/skills/event4u-app/agent-config/authz-review.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00037 | $0.04614 |
| Opus 5.5 | $0.00015 | $0.01846 |
| Sonnet 5.5 | $0.00007 | $0.00923 |
| Haiku 4.5 | $0.00004 | $0.00461 |
Grade A, and why
authz-review scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
Object-ownership (above) is *horizontal* (may this principal touch this record). This is *vertical*: which **fields** and which **functions** a role may reach — the maintainer's case (driver ≠ price, office worker ≠ boss How it starts
The opening of the file, as written. The whole thing — 297 lines — stays where its author put it; the contents beside it link to each section on GitHub.
authz-review
Grounded corpus (Tier-1 consultation): the threat corpus's
authorization+tenancyrows (IDOR, mass-assignment escalation, unscoped queries, sealed job context — each with negative tests) come fromnode <skills-root>/corpus-grounding/scripts/ground.mjs ground --manifest <skills-root>/threat-modeling/data/manifest.json "<the check being reviewed>". Cite corpus rows in findings instead of restating from memory; surface the evidence gap when the corpus has no row.
You are a reviewer specialized in end-to-end authorization enforcement. Your only job is to walk a request path from entry to response and confirm the authorization layer (Laravel Policies/Gates · Symfony Voters · Express middleware · FastAPI
Depends· Spring@PreAuthorize· Rails Pundit/CanCan) actually gates every protected asset. You do not perform threat modelling, you do not review diffs holistically, you do not implement controls — sibling skills handle those.
When to use
- A change adds or modifies permission checks, roles, or ownership rules
- A change exposes a new route, action, or admin-only capability
- A change adds or modifies something an AI agent can do — an MCP tool, a function-calling tool, a bot action
- A query fetches tenant-scoped or user-scoped records and you must confirm scope
- A bug report mentions "user A saw user B's data" or "non-admin accessed admin page"
security-sensitive-stop-rulefires on an auth/tenant/ownership code path
Do NOT use when:
- The change has no trust boundary crossing — skip entirely
- You need a pre-implementation risk model — route to
threat-modeling - A full codebase authorization audit is requested — route to
security-audit - The concern is a diff ready for review — route to
judge-security-auditor - The concern is PII leakage into logs specifically — route to
data-flow-mapper. (Role-based field-level output filtering IS access gating — it stays in scope here; see § Broken-access-control depth below and thebroken-access-controlrule.) - The concern is implementing a control once identified — route to
security
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 6d ago Changed 6d38b506e4ec
- 14d ago Changed · +28 lines 55041d00a0d0
- 25d ago Changed e359a2a68980
- 26d ago Changed · +2 lines e953b27b80dc
- 2mo ago First seen · 267 lines · 37 tokens per session scan A de582ce75074
authz-review is a skill published in the GitHub repository event4u-app/agent-config (19 stars, last pushed today), licensed MIT. It adds 37 tokens to every session and 4,614 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
authz-review compared with skills from other repositories
| Mod | Type | Stars | Last push | Licence | Scan | Tokens | Works with |
|---|---|---|---|---|---|---|---|
| authz-reviewevent4u-app/agent-config | Skill | 19 | today | MIT | A | 37 | Claude Code, Codex |
| tech-lead/code-reviewechoVic/boss-skill | Skill | 546 | today | MIT | A | 52 | Claude Code |
| reviewadriannoes/awesome-agentic-ai | Skill | 96 | 6d ago | MIT | A | 44 | Claude Code |
| adrdrafthq/draft | Skill | 40 | 18d ago | MIT | A | 37 | Claude Code |
| statusdrafthq/draft | Skill | 40 | 18d ago | MIT | A | 22 | Claude Code |
| am-command-ponytail-auditsampleXbro/agentsmesh | Skill | 27 | 3d ago | MIT | A | 22 | Claude Code, Codex |
| metago-archmetago-ai/metagolifeform | Skill | 6 | yesterday | MIT | A | 110 | Claude Code, Codex |