Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add jellydn/my-ai-tools --skill security-auditgit clone --depth 1 https://github.com/jellydn/my-ai-toolsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/jellydn/my-ai-tools/security-audit)<a href="https://agentmods.dev/skills/jellydn/my-ai-tools/security-audit"><img src="https://agentmods.dev/badge/skills/jellydn/my-ai-tools/security-audit/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/jellydn/my-ai-tools/security-audit"><img src="https://agentmods.dev/badge/skills/jellydn/my-ai-tools/security-audit.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00029 | $0.02811 |
| Opus 5 | $0.00015 | $0.01406 |
| Sonnet 5 | $0.00006 | $0.00562 |
| Haiku 4.5 | $0.00003 | $0.00281 |
Grade A, and why
security-audit scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 206 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Security Audit
Perform a structured security audit of code, configuration, and architecture. Identify vulnerabilities, rank them by severity, and recommend concrete fixes grounded in OWASP standards, framework-specific best practices, and DevSecOps controls.
This is a read-only analysis. Do not modify code — audit, then report.
Usage
/security-audit [scope]
- With no argument, audit the current branch's diff against the default branch.
- With a path or module name, audit that scope.
- Use
fullto audit the whole repository for systemic issues.
Knowledge Base
The audit draws on five reference areas. Load the relevant reference file when a finding needs grounding or when you need detailed requirements for a topic:
| Area | Reference | When to load |
|---|---|---|
| OWASP Top 10 | reference/owasp-top-10.md |
Classifying a finding against the major vulnerability categories (2021 + 2025) |
| OWASP ASVS | reference/owasp-asvs.md |
Deriving concrete security requirements or building a verification checklist |
| OWASP Cheat Sheet Series | reference/owasp-cheat-sheets.md |
Needing practical implementation guidance (auth, JWT, file upload, CSRF, password storage) |
| Node.js Security | reference/nodejs-security.md |
Auditing Express, NestJS, Fastify, or Node.js dependency/supply-chain issues |
| DevSecOps | reference/devsecops.md |
Reviewing CI/CD pipeline security, dependency/container/secret/SAST/DAST scanning |
Use progressive disclosure: keep the reference files unloaded until a finding maps to them. Load only the file the current finding needs.
Audit Process
1. Scope and gather context
# Detect the default branch
BASE_BRANCH=$(git remote show origin 2>/dev/null | grep 'HEAD branch' | awk '{print $NF}' || echo main)
# Diff under audit
git diff "$BASE_BRANCH"...HEAD --stat
git diff "$BASE_BRANCH"...HEAD
# Dependency surface
cat package.json 2>/dev/null | jq '.dependencies, .devDependencies'
npm audit --json 2>/dev/null | jq '.metadata.vulnerabilities' 2>/dev/null
# Configuration surface
find . -maxdepth 2 \( -name '*.yml' -o -name '*.yaml' -o -name 'Dockerfile*' -o -name '.env*' \) -not -path './node_modules/*'
What ships with it
5 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 10d ago First seen · 206 lines · 29 tokens per session scan A a5965534f4c1
security-audit is a skill published in the GitHub repository jellydn/my-ai-tools (120 stars, last pushed today), licensed MIT. It adds 29 tokens to every session and 2,811 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
geo-explorer
A Chinese-language skill that explores countries, regions, and international topics through geography, history, resources, and relationships between places.
ask-first
Use only when explicitly invoked to clarify ambiguous, analogy-driven, meta-level, weakly delegated, or under-specified requests before execution.
insight-miner
Only invoke when explicitly requested via "洞见"、"@insight-miner" or "insight". Do NOT auto-trigger.
strategic-product-advisor
A Chinese-language product-strategy guide for evaluating what a product is for, whom it serves, and how it could grow.
book-recommender
A Chinese-language book recommendation and analysis skill that evaluates what books are about, whether they are worth reading, and how to read them.
history-autopsy
A structured overview of a major historical event or long-term historical process, covering its causes, development, results, and effects. It also connects the past to current events and adds memorable points for conversation.