Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add JesusConwellpy/secagent-skills --skill secagent-methodologygit clone --depth 1 https://github.com/JesusConwellpy/secagent-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/jesusconwellpy/secagent-skills/secagent-methodology)<a href="https://agentmods.dev/skills/jesusconwellpy/secagent-skills/secagent-methodology"><img src="https://agentmods.dev/badge/skills/jesusconwellpy/secagent-skills/secagent-methodology/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/jesusconwellpy/secagent-skills/secagent-methodology"><img src="https://agentmods.dev/badge/skills/jesusconwellpy/secagent-skills/secagent-methodology.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00039 | $0.01193 |
| Opus 5 | $0.00019 | $0.00596 |
| Sonnet 5 | $0.00008 | $0.00239 |
| Haiku 4.5 | $0.00004 | $0.00119 |
Grade A, and why
secagent-methodology scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
- Web: curl -s <url> | head -100; curl -s -I <url> How it starts
The opening of the file, as written. The whole thing — 148 lines — stays where its author put it; the contents beside it link to each section on GitHub.
SecAgent Methodology
Loading this SKILL gives you a universal security workflow. It adapts to any task type.
Task Classification (First step)
Classify before acting:
1. CTF challenge?
→ Solo execution. Analyze challenge directly. No agent spawn.
→ Key: read source → identify all checkpoints → bypass each one
2. Pentest (multi-target/multi-service)?
→ Use agents. Spawn in parallel. Full Phase 1-4.
3. Code audit?
→ Solo. Read file by file → trace data flow → mark vulnerability points.
4. Binary analysis?
→ Solo. checksec → disassemble → find vuln → write exploit.
5. CVE research?
→ Solo. Search → match → verify.
Phase 1: RECON — Know your target
1. Gather basic info:
- Web: curl -s <url> | head -100; curl -s -I <url>
- Binary: file <binary>; checksec <binary>; strings <binary>
- Code: read entry file → trace includes → read all related files
2. Identify tech stack:
- Language, framework, version
- Entry points (URL params, API endpoints, file inputs)
- Security mechanisms (WAF, auth, input validation)
3. If CTF:
- Read complete source
- List all inputs: GET/POST params, headers, cookies, file uploads
- List all checkpoints: if/die statements, preg_match, filter_var, escapes
Phase 2: ANALYZE — From observation to hypothesis
1. Map data flow:
Input → Validation/Filter → Processing → Output
At each step: who controls the data? what constraints exist?
2. Identify vulnerability categories:
Web: SQLi, XSS, RCE, LFI, SSRF, CSRF, IDOR, SSTI, File Upload
Binary: BOF, Format String, UAF, Integer Overflow, Race Condition
Crypto: Weak cipher, Padding Oracle, Hash extension, Nonce reuse
General: Auth bypass, PrivEsc, Info disclosure, Logic flaw
3. For each checkpoint, ask:
- What does it check? (type, length, format, range, origin)
- Bypass method? (type juggling, encoding, null byte, overflow, race)
- Is this checkpoint unnecessary? (alternative path? later code overwrites it?)
4. Identify red herrings:
- Computationally infeasible checks (hash preimage, collision)
- Dead code (after die())
- Variables overwritten by later steps
5. Form hypotheses: testable, falsifiable. Give confidence 0-1.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 148 lines · 39 tokens per session scan A 6b931e42359e
secagent-methodology is a skill published in the GitHub repository JesusConwellpy/secagent-skills (2 stars, last pushed 3mo ago), licensed MIT. It adds 39 tokens to every session and 1,193 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
osint-recon
A knowledge guide for open-source intelligence, or OSINT: collecting information from publicly available sources. It covers servers, websites, domains, and, when appropriate, people.
secknowledge-skill
A knowledge base for testing the security of websites, software, and AI systems, including agents and language models.
performing-ai-assisted-vulnerability-discovery
Using LLMs to accelerate vulnerability research and pentest workflows — generating syntax-valid fuzzing seeds and evolving grammars, fine-tuned mutation dictionaries, parallel agent-based proof-of-vulnerability generation, and evidence-driven passive analysis of real HTTP traffic via the Burp MCP server. Covers…
client-reverse
A workflow for analysing and replaying requests made by mobile apps, browser JavaScript, or desktop clients during authorised security testing.
redteam-crypto-detail-pack
Domain routing and boundary guidance for authorized cryptography weakness testing, including weak algorithms, padding oracles, key management errors, insecure randomness, and hash collision risks. Use when a task belongs to the cryptography testing domain and needs scope, evidence, pivot, or exit criteria.
redteam-logic-detail-pack
Domain routing and boundary guidance for authorized business logic vulnerability testing, including race conditions, flow bypass, price tampering, permission logic errors, and bulk operation abuse. Use when a task belongs to the logic testing domain and needs scope, evidence, pivot, or exit criteria.