Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add gabrieldabbah/genesis --skill security-auditgit clone --depth 1 https://github.com/gabrieldabbah/genesisWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/gabrieldabbah/genesis/security-audit)<a href="https://agentmods.dev/skills/gabrieldabbah/genesis/security-audit"><img src="https://agentmods.dev/badge/skills/gabrieldabbah/genesis/security-audit.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00111 | $0.01840 |
| Opus 5 | $0.00056 | $0.00920 |
| Sonnet 5 | $0.00022 | $0.00368 |
| Haiku 4.5 | $0.00011 | $0.00184 |
Grade A, and why
security-audit scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Runs shell commandslowCapability
Expected in a hook, worth knowing in a rule or an instructions file.
grep -rnE "innerHTML|dangerouslySetInnerHTML|eval\(|new Function|execSync|os\.system|pickle\.loads|yaml\.load\(" . How it starts
The opening of the file, as written. The whole thing — 124 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Security audit — score it, fix what is safe to fix, gate the rest
A finding without a location, a reason and a fix is not a finding. An audit that reports "nothing obvious" is not an audit — it is the absence of one.
1. Build the checklist
Start from the domains in §5. Add the per-integration items from each enabled service's registry entry
(security: field). Tailor depth to what the thing is: deeper threat modelling for anything network-facing,
data integrity for pipelines, the PCI surface for payments.
1a. Where a stronger scanner is installed, it does the hunting
Finding vulnerabilities and deciding what to do about them are different jobs, and this skill is better at the second than the first. A single read of a surface has no adversarial verification and no coverage accounting, so where a dedicated scanner is available, hand it the hunt and fold its output in here:
- Anthropic's
claude-securityplugin, if installed./claude-securityopens its menu; scan a diff for a surface just built, or the whole codebase before a handoff. It partitions the tree, threat-models each component, and puts every candidate through a three-lens panel that defaults to false-positive — which is the part a single pass cannot reproduce. ItsCLAUDE-SECURITY-RESULTS.jsonlis the evidence to fold in. /security-review, if available.
Three reasons this stays a preference rather than a step: the plugin may not be installed on the machine running genesis, it cannot be invoked as a skill (only as its own command or agent), and it asks the operator to accept its cost before starting — which an unattended build cannot answer on their behalf. When none is available, or the run is unattended, do §2 onward directly and say in the report which path was taken.
What stays here either way, because no general scanner covers it: the per-integration checklist from the
registry, dependency advisories, the domain ledger in §5, the fix-versus-gate line in §4, and turning findings
into docs/TODO.md items that gate the build.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 7d ago First seen · 124 lines · 111 tokens per session scan A 8ea3e15fbfc2
security-audit is a skill published in the GitHub repository gabrieldabbah/genesis (4 stars, last pushed 1mo ago), licensed MIT. It adds 111 tokens to every session and 1,840 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it A with 1 finding (runs shell commands). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
fleet
Parallel campaign orchestrator. Runs multiple campaigns in coordinated waves within a single session. Spawns 2-3 agents per wave in isolated worktrees, collects discoveries, shares context between waves. Use when work decomposes into 3+ independent streams that can run simultaneously.
daemon
Continuous autonomous operation mode. Keeps campaigns running 24/7 by chaining Claude Code sessions via RemoteTrigger. Each session picks up from the campaign's continuation state, works until context runs low or the phase completes, then schedules the next session. Auto-stops on campaign completion or budget…
evolve
Research-driven multi-cycle improvement director. Forms causal hypotheses about why scores are low, validates them with scout agents before attacking, dispatches axis-parallel fleet attacks, extracts transferable patterns, and runs indefinitely within a budget envelope. Accumulates a persistent belief model and…
improve
Autonomous quality improvement loop. Scores a target against a rubric, selects the highest-leverage axis, attacks it, verifies, documents, and loops. No pre-planning between iterations — each loop re-scores from scratch.
setup
First-run experience for the harness. Three modes: Recommended (guided, 3 min), Full Tour (guided + skill walkthrough, 8 min), and Express (zero questions, 30 sec). Installs hooks first, detects stack, configures harness.json, runs a live demo on real code, and prints a reference card.
ascii-diagram
Generate perfectly aligned ASCII diagrams — architecture, flow, sequence, box-and-arrow. Uses a programmatic character-grid approach so alignment is guaranteed by math, not token prediction. Includes post-render verification.