caddy-security is a security application and set of plugins for Caddy v2, a web server, that handles user authentication and controls access to HTTP requests. It supports methods including local, LDAP, OpenID Connect, OAuth 2.0, SAML, JWT, and PASETO, and is used to protect web services behind Caddy.
Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add greenpau/caddy-security --skill testing-and-cigit clone --depth 1 https://github.com/greenpau/caddy-securityWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/greenpau/caddy-security/testing-and-ci)<a href="https://agentmods.dev/skills/greenpau/caddy-security/testing-and-ci"><img src="https://agentmods.dev/badge/skills/greenpau/caddy-security/testing-and-ci/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/greenpau/caddy-security/testing-and-ci"><img src="https://agentmods.dev/badge/skills/greenpau/caddy-security/testing-and-ci.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00050 | $0.04330 |
| Opus 5.5 | $0.00020 | $0.01732 |
| Sonnet 5.5 | $0.00010 | $0.00866 |
| Haiku 4.5 | $0.00005 | $0.00433 |
Grade A, and why
testing-and-ci scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 372 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Testing and CI
Browser choice
Use headless Chrome for browser E2E tests, screenshots, developer-tools
network traces, and conformance visual evidence. Avoid Firefox unless the user
explicitly requests it for a browser-specific investigation. Prefer a pinned
Chrome for Testing distribution for reproducible external workflows; keep its
binary, driver, profiles, caches and artifacts under this repository's tmp/.
Preserve real browser interaction and TLS validation. Do not set
acceptInsecureCerts, ignore-certificate flags, disable web security, rewrite
Origin headers, or fabricate successful callbacks to make a conformance run pass.
Overview
Use this skill for caddy-security test selection, fixture maintenance, and CI reproduction. Select tests from the changed behavior for both development and final validation. Do not run the full suite as a routine completion step. Use filtered Makefile targets when reports are needed; reserve full-suite commands for explicitly requested full-suite, CI-reproduction, or release workflows.
The Go module is rooted at the repository top level. Most tests live in the
root security package and cover Caddyfile parsing, Caddyfile adaptation, and
runtime authcrunch config resolution.
Follow the repository scope.
Create and run tests in this module only; never run sibling suites to validate
work here or fix a failing test by editing the sibling. TEST_DIR and
QUICK_TEST_DIR must select this module's packages, and COVERAGE_DIR must not
point into another checkout. Existing local replacements are dependency inputs
only. Keep compatibility fixtures and reports here and report required upstream
test or implementation changes as separate work.
Required Coverage for Code Changes
When writing or changing code, ensure both unit tests and E2E tests exist and exercise the changed behavior. Add or amend tests where coverage is missing; existing tests count when they demonstrably verify that behavior. Run the relevant unit and E2E tests before considering the code change complete.
What ships with it
4 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- today First seen · 372 lines · 50 tokens per session scan A bc0bd5e0bc66
testing-and-ci is a skill published in the GitHub repository greenpau/caddy-security (2,263 stars, last pushed today), licensed Apache-2.0. It adds 50 tokens to every session and 4,330 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-25.
Other skills, from other repositories
JWT Security Testing
Comprehensive JWT token security testing including signature verification, expiration checks, algorithm confusion attacks, and claim validation.
security-review
Security Code Review: Reviews code for security vulnerabilities including authentication (OAuth2, JWT), authorization (RBAC, roles), API security, data protection, payment security, and common attack vectors. Use whenever the user wants a security review, penetration test analysis, threat model, or mentions OAuth2…
e2e-testing
Use when reviewing CI coverage, automated checks, or test strategy related to Implement end-to-end testing. Focus on whether the rule is continuously verified, not just documented.
azure-microsoft-playwright-testing-ts
Run Playwright tests at scale using Azure Playwright Workspaces (formerly Microsoft Playwright Testing). Use when scaling browser tests across cloud-hosted browsers, integrating with CI/CD pipelines, or publishing test results to the Azure portal.
mirrord-chaos
Help users chaos test their app with mirrord: inject artificial latency or connection errors into a mirrord session's outgoing traffic via per-session chaos rules managed with the mirrord chaos CLI. Use when a user wants to add latency or delay to outgoing connections or a dependency (e.g. a slow database), simulate…
testing-api-authentication-weaknesses
Tests API authentication mechanisms for weaknesses including broken token validation, missing authentication on endpoints, weak password policies, credential stuffing susceptibility, token leakage in URLs or logs, and session management flaws. The tester evaluates JWT implementation, API key handling, OAuth flows, and…