agentmods.dev

code-security

code-security is a skill for Claude Code, Codex from fmind/dot. It costs 19 tokens per session (261 once invoked), scanned A, original, MIT.

A code-security skill for reviewing repositories and scanning for exposed secrets and known vulnerabilities using Gitleaks and Trivy.

In plain words
What is it for?
It is for checking source code, dependencies, container images, configuration, licenses, and software inventories, then verifying findings and repairs.
Why use it?
It helps identify security defects, leaked credentials, vulnerable dependencies, unsafe configuration, and related risks that ordinary code review may miss.

Skill for Claude CodeCodex

Written for no agent in particular: nothing here depends on one. Also seen: mentions Claude Code.

not rated 11repo changed 9d ago A scan 19 tokens original MIT

Good fit It is for checking source code, dependencies, container images, configuration, licenses, and software inventories, then verifying findings and repairs.

Compare 6 skills from other repositories ↓
Install with agentmods
npx agentmods add skills/fmind/dot/code-security
View source ↗ fmind/dot fmind.dev
Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent
npx skills add fmind/dot --skill code-security
Clone the repo
git clone --depth 1 https://github.com/fmind/dot

Made for: Claude Code, Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for code-security

README.md
[![agentmods](https://agentmods.dev/badge/skills/fmind/dot/code-security/github.svg)](https://agentmods.dev/skills/fmind/dot/code-security)
Your own site
<a href="https://agentmods.dev/skills/fmind/dot/code-security"><img src="https://agentmods.dev/badge/skills/fmind/dot/code-security/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for code-security

Your own site · 80×15
<a href="https://agentmods.dev/skills/fmind/dot/code-security"><img src="https://agentmods.dev/badge/skills/fmind/dot/code-security.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 19 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 261 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00019 $0.00261
Opus 5.5 $0.00008 $0.00104
Sonnet 5.5 $0.00004 $0.00052
Haiku 4.5 $0.00002 $0.00026

Measured 9d ago against content hash bd454403b4f4, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

code-security scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

skills/code-security/SKILL.md · 30 lines

What it actually says

Code Security

Investigate and fix security defects with evidence. Choose code review, secret scanning, or vulnerability scanning from the task; findings need verification and scanners do not replace reasoning. The name deliberately avoids security-review, which Claude Code and Copilot CLI ship as a built-in command.

Workflow

Read only the matching guide and its required resources. Use a known guide directly when shared prerequisites are not needed.

Task guides

  • code-review: Assess code and repository security; verify findings and repairs.
  • gitleaks: Scan the working tree and history for secrets; handle confirmed exposure.
  • trivy: Scan dependencies, IaC, images, and licenses; generate SBOMs.
Files

What ships with it

9 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 9d ago Changed bd454403b4f4
  2. 11d ago Changed 447e6acb271a
  3. 12d ago First seen · 30 lines · 19 tokens per session scan A 4104906c5c5d

Subscribe to this mod's changes

code-security is a skill published in the GitHub repository fmind/dot (11 stars, last pushed yesterday), licensed MIT. It adds 19 tokens to every session and 261 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-05.

Claude CodeCode reviewSecurityai-agentschezmoidotfilesfish-shellmise
Related

Other skills, from other repositories

diff-review

Inspect changed code in an exact diff, patch, branch, PR, or candidate for correctness defects. Use for pre-merge or self-review, spec compliance, test gaps, and regression risk — not whole-repo audit, release go/no-go, or plan review.

fmind/dotfiles · 57 tokens

repository-review

Audit a whole repository across architecture, source, tests, tooling, security, CI/CD, docs, and releases. Use for cross-cutting audits, readiness, or technical-debt reviews with ranked findings — not one diff or release candidate.

fmind/dotfiles · 51 tokens

vibe

Delegate a coding task to a cheap AI model (Mistral Vibe by default, but any provider Vibe knows about — DeepSeek, Gemini Flash, etc.) and supervise the result via git diff. Claude orchestrates, the cheap model codes. Claude consumes 500-1500 tokens per delegation regardless of how many file reads the delegate does…

sebastienrousseau/dotfiles · 137 tokens

pr

Create a draft or ready pull request with gh for a jj revision — pushes the bookmark, reviews the full changeset, and drafts a title and body explaining why the change was made. Use when asked to open a PR.

martinemde/dotfiles · 47 tokens

assess-quality

Foundational quality framework: the five questions (readable, easy to start, expands without bloat, consistent, intentional) every other dev skill is judged against, plus the dual-audience and workshop principles. Use when onboarding to a project, defining a quality bar, setting an assessment checklist, or arbitrating…

urmzd/dotfiles · 120 tokens

sync-ecosystem

Audit one repository against ecosystem conventions (naming, capabilities, terminology, doc coverage, version discipline, canonical skill coverage) and emit a read-only drift report. Use when onboarding a repo, auditing convention drift, or checking ecosystem consistency after a refactor. This skill only reports; it…

urmzd/dotfiles · 101 tokens