Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/garagon/nanostack/securitynpx skills add garagon/nanostack --skill securitygit clone --depth 1 https://github.com/garagon/nanostackWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00061 | $0.03738 |
| Opus 5 | $0.00030 | $0.01869 |
| Sonnet 5 | $0.00012 | $0.00748 |
| Haiku 4.5 | $0.00006 | $0.00374 |
Grade B, and why
security scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Cloud metadata endpointmediumServer-side request forgery
One request to 169.254.169.254 can return temporary IAM credentials.
**False negatives (don't miss):** Auth on route but not on query (IDOR), secrets in git history, rate limiting on login but not password reset, SSRF via URL params to `169.254.169.254`, `dangerouslySetInnerHTML` without Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.
How it starts
The opening of the file, as written. The whole thing — 327 lines — stays where its author put it; the contents beside it link to each section on GitHub.
/security — Security Audit
You think like an attacker but report like a defender. The real attack surface is rarely the code you wrote. It is the secrets in git history, the dependency you forgot to update, the CI pipeline that leaks tokens, and the AI endpoint without rate limiting. Start there, not at the application logic.
Telemetry preamble
Defensive telemetry init. No-op if telemetry is disabled via NANOSTACK_NO_TELEMETRY=1, ~/.nanostack/.telemetry-disabled, or if the helpers are removed.
_P="$HOME/.claude/skills/nanostack/bin/lib/skill-preamble.sh"
[ -f "$_P" ] && . "$_P" security
unset _P
Intensity Mode
| Mode | Flag | Scope | Confidence gate |
|---|---|---|---|
| Quick | --quick |
OWASP A01-A03 (top 3) + secrets scan + dependency check | 9/10 — only verified findings |
| Standard | (default) | Full OWASP A01-A10 + STRIDE per component + dependencies | 7/10 — report anything with evidence |
| Thorough | --thorough |
Full OWASP + STRIDE + variant analysis + conflict detection + LLM security check | 3/10 — flag tentative findings marked as TENTATIVE |
Auto-suggest:
- Pre-commit on small changes → suggest
--quick - Pre-ship standard feature →
--standard(default) - Pre-ship auth/payment/infra, or first audit of a codebase → suggest
--thorough
Thorough-only features:
- Variant analysis: When a finding is VERIFIED, search the entire codebase for the same pattern. One confirmed SQL injection means there may be more.
- Conflict detection: Cross-reference with
/reviewartifacts in.nanostack/review/for contradictions. - TENTATIVE findings: Below confidence gate but worth noting. Mark as
TENTATIVE: <description>.
Setup (first run per project)
Resolve context — load plan, review artifacts, matched solutions, and config:
~/.claude/skills/nanostack/bin/resolve.sh security --diff
The output is JSON with upstream_artifacts (plan and review paths), solutions (matched by file overlap and security tags), conflict_precedents (path to precedents doc), diarizations (module briefs), and config (intensity, detected stack, conflict precedence).
What ships with it
3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 327 lines · 61 tokens per session scan B 8455726c9206
security is a skill published in the GitHub repository garagon/nanostack (204 stars, last pushed 2mo ago), licensed Apache-2.0. It adds 61 tokens to every session and 3,738 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it B with 1 finding (cloud metadata endpoint). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
rulesync
Generates and syncs AI rule configuration files (.cursorrules, CLAUDE.md, copilot-instructions.md) across 20+ coding tools from a single source. Use when syncing AI rules, running rulesync commands, importing or generating rule files, or managing shared AI coding configurations.
agent-workspace-linux
Use when a task needs an isolated hidden Linux desktop or workspace-owned browser: GUI app QA, web/browser/shopping automation, sandboxed app observation, or stale workspace cleanup. Routes agent-workspace-linux MCP tools on demand. Does NOT apply to host desktop/Chrome control, generic MCP setup, or pure code/file…
ss-component
Generate a new UI component following the StyleSeed design conventions.
loongsuite-pilot-insight
基于 LoongSuite Pilot / AI Coding Agent 日志生成事件洞察、组织洞察、数据质量、研发效能和 AI Native 使用类 SLS 报表时使用；包含 AI Coding 事件表语义，以及团队报表可选的部门维表、deptuser 组织关系、指标口径和公共 CTE，通常与 sls-dashboard-builder 一起使用。.
map-review
Interactive 4-section code review using monitor, predictor, and evaluator agents plus the user and maintainer role reviewers on current changes. Use when reviewing a diff, PR, or staged work before merge. Do NOT use to plan or implement; use map-plan or map-efficient.
runjam-defaults
Default constraints for every RunJam session. Defines output path conventions, dependency checking rules, fallback strategies, and file management discipline. This skill is auto-injected into every session — do not remove. Current session working directory: /Users/guizhan/work/code/runjam.