Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/imgompanda/fireauto/fireauto-secure-guidenpx skills add imgompanda/fireauto --skill fireauto-secure-guidegit clone --depth 1 https://github.com/imgompanda/fireautoWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00073 | $0.00679 |
| Opus 5 | $0.00036 | $0.00340 |
| Sonnet 5 | $0.00015 | $0.00136 |
| Haiku 4.5 | $0.00007 | $0.00068 |
Grade A, and why
fireauto-secure-guide scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
보안 감사 방법론
실제 SaaS 프로젝트에서 총 18개 취약점을 발견한 패턴을 기반으로 한 보안 감사 방법론.
감사 8개 카테고리
- 환경변수/시크릿 노출 — .env 파일, 하드코딩된 키, NEXT_PUBLIC_ 오용
- 인증/인가 — 미인증 API, admin 클라이언트 남용, RLS 우회
- Rate Limiting — AI/비용 발생 엔드포인트 보호
- 파일 업로드 — MIME 검증, 크기 제한, 위험 파일 차단
- 스토리지 보안 — 퍼블릭 버킷, URL 추측
- Prompt Injection — 사용자 입력 직접 삽입
- 정보 노출 — 에러 상세, CSP 헤더
- 의존성 취약점 — npm audit, CVE
심각도 분류
| 심각도 | 기준 |
|---|---|
| CRITICAL | 즉시 조치. 데이터 유출, 인증 우회, 시크릿 노출 |
| HIGH | 빠른 조치. 서비스 장애, 비용 발생 가능 |
| MEDIUM | 계획적 조치. 특정 조건에서 악용 가능 |
| LOW | 개선 권장. 보안 강화 목적 |
핵심 검색 패턴
시크릿 노출
"sk-", "sk_live", "sk_test" → API 키
"password.*=", "secret.*=", "token.*=" → 하드코딩
"NEXT_PUBLIC_.*SERVICE" → 서비스 키 클라이언트 노출
인증 누락
API 라우트에서 아래 패턴이 없으면 인증 미적용:
"getSession", "getUser", "auth()", "cookies()"
Rate Limit 누락
AI 호출: "openai", "anthropic", "claude", "gpt"
같은 파일에 "ratelimit"이 없으면 취약
Prompt Injection
content: `...${userInput}...`
→ 시스템 프롬프트와 사용자 메시지가 분리되어야 함
우선순위 산정
우선순위 = 심각도 점수 × 구현 용이성
- 심각도: CRITICAL(4), HIGH(3), MEDIUM(2), LOW(1)
- 구현 용이성: 쉬움(3), 보통(2), 어려움(1)
커맨드
/fireauto-secure 실행으로 전체 보안 감사를 시작한다.
추가 리소스
상세 검색 패턴과 수정 가이드: references/patterns.md
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 73 lines · 73 tokens per session scan A 578ce02886a9
fireauto-secure-guide is a skill published in the GitHub repository imgompanda/fireauto (140 stars, last pushed 4mo ago), licensed MIT. It adds 73 tokens to every session and 679 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
taiyi-ui-design
TaiyiForge 第 4 阶段 — UI/UX 契约，产出 UI-DESIGN.md。四端通用。.
taiyi-diagram-arch
TaiyiForge 辅助 — 系统/产品架构图（Mermaid · SVG 海报 · 嵌入 DESIGN.md）。OpenCode / Claude / Codex / Cursor 通用。.
taiyi-evolve
TaiyiForge 辅助 — 实现后架构与文档同步（architecture-sync）。OpenCode / Claude / Codex / Cursor 通用。.
clarify
This skill should be used when user appears confused, frustrated, or shows misalignment between expectations and reality. Triggers on phrases like "I don't understand", "this doesn't make sense", "confused", "wait, shouldn't it...", "why is this happening", "I thought X did Y", contradictory statements, or frustration…
md-copy
Format final answer as markdown and copy to clipboard. Use when user says "copy as markdown", "md copy", "copy formatted", "clipboard", or wants the session's final answer formatted and copied.
txt-copy
Copy generated text content to clipboard. Use when user asks to "copy this", "copy to clipboard", "save to clipboard", or after creating emails, messages, letters, or other text content that needs to be shared.