Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add kanfu-panda/pdlc-skills --skill pdlc-securitygit clone --depth 1 https://github.com/kanfu-panda/pdlc-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/kanfu-panda/pdlc-skills/pdlc-security)<a href="https://agentmods.dev/skills/kanfu-panda/pdlc-skills/pdlc-security"><img src="https://agentmods.dev/badge/skills/kanfu-panda/pdlc-skills/pdlc-security/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/kanfu-panda/pdlc-skills/pdlc-security"><img src="https://agentmods.dev/badge/skills/kanfu-panda/pdlc-skills/pdlc-security.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00008 | $0.00673 |
| Opus 5 | $0.00004 | $0.00336 |
| Sonnet 5 | $0.00002 | $0.00135 |
| Haiku 4.5 | $0.00001 | $0.00067 |
Grade A, and why
pdlc-security scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
安全审计
对指定服务或应用进行安全审计，检查常见安全漏洞。
审计范围
-
OWASP Top 10 检查
- SQL 注入
- XSS（跨站脚本）
- CSRF（跨站请求伪造）
- 不安全的直接对象引用
- 安全配置错误
- 敏感数据泄露
- 缺失的访问控制
- 不安全的反序列化
- 使用含已知漏洞的组件
- 日志记录和监控不足
-
认证与授权
- 密码存储方式（是否加盐哈希）
- Token 生成与验证
- 接口权限控制
- 会话管理
-
数据安全
- 敏感信息是否加密存储
- 环境变量中是否有硬编码密钥
- 日志中是否打印敏感数据
- API 响应中是否泄露内部信息
-
依赖安全
- 检查依赖包是否有已知漏洞
- 检查是否使用了过时的库版本
输出格式
⚠️ 必须创建文件，不可仅在对话中输出。
【必须创建文件】 在 docs/07_reviews/code/ 下创建安全审计报告：
- 文件名:
YYYYMMDD-<服务名>-security-audit.md - 文档顶部包含 PDLC 追溯头：
<!-- PDLC-TRACE --> <!-- 功能名称: <服务名> --> <!-- 阶段: 安全审计 --> <!-- 创建时间: <ISO 8601> --> - 按严重程度分级：紧急 / 高危 / 中危 / 低危 / 信息
- 每个问题包含：位置、描述、风险、修复建议、参考链接
- 创建后验证：确认文件已存在于
docs/07_reviews/code/目录 - 在对话中输出报告摘要，但完整报告必须在文件中
要求
- 给出具体的代码位置和修复代码示例
- 关键漏洞标注修复优先级
审计目标: $ARGUMENTS
本命令的 handoff 输出：
✅ 安全审计报告 完成
📦 产出：docs/04_testing/security/<feature-id>-audit.md
👉 下一步：（本次流程结束，无后续）
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 11d ago First seen · 84 lines · 8 tokens per session scan A 8ce101a65c15
pdlc-security is a skill published in the GitHub repository kanfu-panda/pdlc-skills (13 stars, last pushed today), licensed MIT. It adds 8 tokens to every session and 673 once invoked, about $0.0000 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
postgres-database-migration
Use this skill for planning, testing, and safely executing PostgreSQL schema migrations — especially when working with production data or shared databases. Trigger when user asks to: Test a schema migration before applying it to production Add, remove, or rename columns safely on a live table Change a column's data…
setup-timescaledb-hypertables
Use this skill when creating database schemas or tables for Timescale, TimescaleDB, TigerData, or Tiger Cloud, especially for time-series, IoT, metrics, events, or log data. Use this to improve the performance of any insert-heavy table. Trigger when user asks to: Create or design SQL schemas/tables AND…
design-postgis-tables
Comprehensive PostGIS spatial table design reference covering geometry types, coordinate systems, spatial indexing, and performance patterns for location-based applications.
migrate-postgres-tables-to-hypertables
Use this skill to migrate identified PostgreSQL tables to Timescale/TimescaleDB hypertables with optimal configuration and validation. Trigger when user asks to: Migrate or convert PostgreSQL tables to hypertables Execute hypertable migration with minimal downtime Plan blue-green migration for large tables Validate…
pgvector-semantic-search
Use this skill for setting up vector similarity search with pgvector for AI/ML embeddings, RAG applications, or semantic search. Trigger when user asks to: Store or search vector embeddings in PostgreSQL Set up semantic search, similarity search, or nearest neighbor search Create HNSW or IVFFlat indexes for vectors…
find-hypertable-candidates
Use this skill to analyze an existing PostgreSQL database and identify which tables should be converted to Timescale/TimescaleDB hypertables. Trigger when user asks to: Analyze database tables for hypertable conversion potential Identify time-series or event tables in an existing schema Evaluate if a table would…