Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/evilfreelancer/secs/orchestrating-vulnerability-researchnpx skills add EvilFreelancer/secs --skill orchestrating-vulnerability-researchgit clone --depth 1 https://github.com/EvilFreelancer/secsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/evilfreelancer/secs/orchestrating-vulnerability-research)<a href="https://agentmods.dev/skills/evilfreelancer/secs/orchestrating-vulnerability-research"><img src="https://agentmods.dev/badge/skills/evilfreelancer/secs/orchestrating-vulnerability-research.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00176 | $0.03182 |
| Opus 5 | $0.00088 | $0.01591 |
| Sonnet 5 | $0.00035 | $0.00636 |
| Haiku 4.5 | $0.00018 | $0.00318 |
Grade A, and why
orchestrating-vulnerability-research scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
This is a copy
100% identical to orchestrating-vulnerability-research — 0 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.
How it starts
The opening of the file, as written. The whole thing — 250 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Orchestrating Vulnerability Research
One agent hunting one target rationalizes. It finds a "probably exploitable" path, writes a confident paragraph, and grades its own paragraph as a finding. The paragraph is not the bug. This skill is the harness that stops that: give the hunt a bar it cannot talk its way around, split the target so pieces are worked in parallel, and never let the agent that built a candidate be the one that decides it is real.
It is a loop, not a pass. You run it until findings are proven or the target is genuinely exhausted — not until the first plausible writeup appears.
When to Use
- Told to find previously-unknown vulnerabilities in a whole codebase, a binary, or a named live target, with room to run many agents
- Running a bug-bounty or research campaign where depth and novelty matter more than a one-pass coverage report
- A single audit or test pass has stalled or produced only unproven "maybe" findings, and you want independent critics to break or confirm them
- You have the budget to fan out and iterate, and want the builder/critic separation and a demonstrated-trigger bar enforced across the whole effort
When NOT to Use
- One focused review of a source tree for coverage (client audit, one pass,
a deliverable coverage table) — use
auditing-code-for-vulnerabilitiesdirectly; this skill dispatches it, it does not replace it - Reversing or triaging a single binary — use
analyzing-binaries - Black-box testing one web app or API methodically — use
testing-web-applicationsortesting-apis - Writing up the confirmed findings — use
reporting-security-findings - Tracking the campaign's evidence, provenance, and dead ends — use
maintaining-engagement-state; this skill produces that record, it does not define its format - Hunting a webshell or backdoor someone already planted (not a latent
vulnerability) — use
hunting-web-backdoors - A stateless spot check — "is this one function injectable?" is one builder call, not a campaign. The harness overhead only pays off at scale.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 250 lines · 176 tokens per session scan A 7cca26284cfe
orchestrating-vulnerability-research is a skill published in the GitHub repository EvilFreelancer/secs (10 stars, last pushed 27d ago), licensed Apache-2.0. It adds 176 tokens to every session and 3,182 once invoked, about $0.0009 per session on Opus 5. A static security scan graded it A with 0 findings. It is 100% identical to orchestrating-vulnerability-research, differing in 0 lines, and is treated as a copy.
Other skills, from other repositories
Blue Team Defense & Hardening
System hardening, detection engineering, security baseline monitoring, patch management, defense-in-depth architecture, and security posture improvement.
wave-issue-coverage
For each DRAFT requirement in a given Ground Control wave (or all waves), ensure a GitHub issue covers it and is bidirectionally linked. Use when the user asks to "cover wave N requirements with issues", "back-fill issues for draft requirements", or similar. Requires the Ground Control MCP and gh CLI.
ship
Ship current branch — CI, SonarCloud, code review, security review, fix all issues, merge. Assumes code is already committed and pushed.
create-huntable-agent
Add a new extraction sub-agent to Huntable CTI Studio as a first-class peer of CmdlineExtract, ProcTreeExtract, HuntQueriesExtract, RegistryExtract, ServicesExtract, and ScheduledTasksExtract. Use this skill whenever the user asks to "add a new agent", "create a sub-agent", "wire up a new extractor", "add a new…
codebase-test-trueup
Audit test coverage gaps and generate unit tests to close them. Use when the user says "test trueup", "coverage gaps", "test coverage audit", "fill coverage", "write missing tests", "backfill tests", "scope tests", "test what I changed", or any request to identify and fill test gaps. Three modes: audit (report only)…
cut-release
Interactive walkthrough for cutting a new release of Huntable CTI Studio. Use this skill whenever the user says "cut a release", "ship a release", "tag a version", "bump the version", "new release", "do the release", "release vX.Y.Z", "ship v5.4.0", "time to release", or otherwise signals they want to move code from…