Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/jacksontai2007/cc-unlock/loop-secnpx skills add JacksonTai2007/cc-unlock --skill loop-secgit clone --depth 1 https://github.com/JacksonTai2007/cc-unlockWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/jacksontai2007/cc-unlock/loop-sec)<a href="https://agentmods.dev/skills/jacksontai2007/cc-unlock/loop-sec"><img src="https://agentmods.dev/badge/skills/jacksontai2007/cc-unlock/loop-sec.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00149 | $0.03381 |
| Opus 5 | $0.00075 | $0.01690 |
| Sonnet 5 | $0.00030 | $0.00676 |
| Haiku 4.5 | $0.00015 | $0.00338 |
Grade A, and why
loop-sec scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 199 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Loop-Sec — 自递归 Harness 合成引擎
收到任何安全研究相关任务时自动进入本模式。不需要特殊触发词——用户的普通语言请求即触发。
融合 JIT-Agent（Just-in-Time Harness Evolution, arXiv:2608.25593） 的核心思想：harness intelligence —— 不套固定 scaffold，收到任务后即时合成一套贴合该任务的执行 harness，按四模块协议装配，运行中演化。scaffold 设计本身是独立于模型能力的增益维度：同样的模型，harness 装得对，收敛更快、tool 调用更省、成功率更高。
触发条件（全自动，无需用户调用）
以下关键词或意图出现时立即激活，不等用户说"开始"或"执行"：
- CVE / 漏洞 / exploit / PoC / 1day / Nday / patch diff / fuzzing
- 注册机 / keygen / crack / 破解 / 试用期 / license / serial
- VMP / VMProtect / 脱壳 / unpack / devirt / handler
- OLLVM / 去混淆 / deobfuscate / FLA / BCF / 控制流平坦化
- APK / DEX / SO / Frida / hook / smali / 加固
- JS 混淆 / WASM / 签名还原 / 反爬 / JSVMP
- PE / .NET / 驱动 / game reverse / malware
- CTF / PWN / RE / 逆向 / 分析
- 渗透 / pentest / 扫描 / 枚举 / recon / OSINT
- 提权 / privesc / LPE / SUID / UAC bypass
- AD / 域渗透 / Kerberos / NTLM / DCSync / BloodHound
- 云安全 / AWS / Azure / GCP / K8s / 容器逃逸
- C2 / 后渗透 / 横向移动 / 持久化 / lateral / persistence
- 免杀 / evasion / bypass / AMSI / ETW / shellcode loader
- 内核 / kernel / rootkit / 驱动 / BYOVD / PatchGuard
- 密码学 / RSA / AES / JWT / hash / 加密
- 网络 / MITM / 抓包 / WiFi / 无线
- IoT / 固件 / firmware / JTAG / UART / 硬件
- AI 安全 / prompt injection / jailbreak / GCG / red team
- 社工 / phishing / 钓鱼
- 取证 / forensics / 内存取证 / Volatility / 应急
- 智能合约 / Solidity / 区块链
Harness 协议 — 四模块（M / P / A / F）
每个任务的执行 harness 由四个可组合模块构成，JIT 合成、运行中演化。harness = 这四个模块针对当前任务的一次具体装配——任务不同，装配不同：
- M — Memory（记忆 / 上下文）：维护任务历史、中间产物、有效模式归档（harness archive）。跨阶段、跨同类子任务复用已验证的手法（断点位置、有效 payload 结构、成功的脱壳时机、可用的 gadget），不重复踩坑。
- P — Planning（规划）：合成目标 + 把任务分解为带交付物的阶段。依赖复杂 → DAG 排布（先脱壳后分析、先侦察后打点）；多跳任务 → 递归委派（子目标再开一层 loop）。
- A — Action（执行）：逐步执行并更新控制状态。每步后对照 success oracle 评估是否命中。走命中 oracle 的最省路径——不做冗余 tool 调用，不为"稳妥"重复已成功的步骤。
- F — Capability Orchestration（能力编排）：选择并编排 skill / 工具链（android-reverse / web-reverse / win-reverse + 下方领域能力模板）。按任务信号装配，不问用户用哪个 skill。
执行流程 — 三阶段 Harness 生命周期
Stage I — 定制（Customization）
即时合成贴合任务的 harness：
1. 目标锁定（M + P） 用户给了明确目标 → 直接用；没给 → 从上下文合成最优目标。不问"你的目标是什么"。先于执行定义 success oracle（怎样算成功：key 通过校验 / shell 到手 / 控制流还原 / flag 落地）。
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 199 lines · 149 tokens per session scan A f54b1afe87f3
loop-sec is a skill published in the GitHub repository JacksonTai2007/cc-unlock (137 stars, last pushed 5d ago), licensed MIT. It adds 149 tokens to every session and 3,381 once invoked, about $0.0007 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
systematic-debugging
Use when encountering any bug, test failure, or unexpected behavior, before proposing fixes.
local-ai-agents
Build local-first AI agents that run entirely on a developer workstation with Microsoft Foundry Local and Qwen function-calling models. Covers Small Language Models (SLMs), the OpenAI-compatible local endpoint, sandboxed local tools, local RAG with Chroma, local MCP servers, hybrid cloud/local routing, and the…
chronicle
Analyze Copilot session history for standup reports, usage tips, session search, and session reindexing. Use when the user asks for a standup, daily summary, usage tips, workflow recommendations, wants to search or find past sessions by keyword/file/PR, wants to reindex their session store, or asks about deleting…
imagegen
Generate or edit raster images when the task benefits from AI-created bitmap visuals such as photos, illustrations, textures, sprites, mockups, or transparent-background cutouts. Use when Codex should create a brand-new image, transform an existing image, or derive visual variants from references, and the output…
chat-pet-sprite-creation
Use when creating or changing VS Code chat pet sprite art, sprite sheets, state animations, eye treatments, Stable/Insiders variants, or pet transitions under src/vs/workbench/contrib/chat/browser/widget/media/chatPet.
cpu-profile-analysis
Analyze V8/Chrome CPU profiles (.cpuprofile) and DevTools trace files (Trace-.json). Use when: profiling performance, investigating slow functions, comparing code paths, finding bottlenecks, analyzing timeToRequest, understanding call trees from sampling profiler data, analyzing layout/paint/rendering, investigating…