Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add Karthick-Ramachandran/persist-os --skill security-reviewgit clone --depth 1 https://github.com/Karthick-Ramachandran/persist-osWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/karthick-ramachandran/persist-os/security-review)<a href="https://agentmods.dev/skills/karthick-ramachandran/persist-os/security-review"><img src="https://agentmods.dev/badge/skills/karthick-ramachandran/persist-os/security-review/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/karthick-ramachandran/persist-os/security-review"><img src="https://agentmods.dev/badge/skills/karthick-ramachandran/persist-os/security-review.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00061 | $0.00385 |
| Opus 5.5 | $0.00024 | $0.00154 |
| Sonnet 5.5 | $0.00012 | $0.00077 |
| Haiku 4.5 | $0.00006 | $0.00038 |
Grade A, and why
security-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
Goal
Find security risks in a change before it is accepted.
Inputs
- The change as a diff or summary.
- Test results, when they exist.
Workflow
- Identify changed trust boundaries: file writes, paths, dependencies, auth, stored secrets, network calls, telemetry, MCP.
- Run scripts/scan-secrets.sh over the staged diff and treat matches as blockers until cleared. If scripts/ is unavailable (deleted or cannot execute), perform the same scan by reading the diff directly.
- Check path validation, overwrite policy, and symlink handling.
- Check dependency, template, and configuration risk.
- Check that tests cover the security-sensitive behavior.
- Classify findings as blockers, risks, or documented tradeoffs.
- Hand back the verdict with the finding list.
Decisions
- If a credential is present in the change → blocker; stop and ask for its removal.
- If writes can escape the repository root → blocker.
- If the change conflicts with accepted repository memory → stop and ask for a human decision.
Verification
- Every trust boundary the change touches has a finding or an explicit all-clear.
- Blockers name the exact file and line.
- No finding is generic filler.
Resources
- For the security model → docs/20-security/SECURITY_MODEL.md
- For threat context → docs/20-security/THREAT_MODEL.md (when present)
Output
- Verdict: accept, accept with risks, or block.
- Finding list with files, lines, and severity.
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago Changed · -15 lines · +13 tokens per session a1cfaf253bd8
- 2mo ago First seen · 62 lines · 48 tokens per session scan A 44e4e9551884
security-review is a skill published in the GitHub repository Karthick-Ramachandran/persist-os (9 stars, last pushed 16d ago), licensed MIT. It adds 61 tokens to every session and 385 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
evidence-anchors
Ground documents in verifiable citations. Use whenever writing or editing ANY document a human will approve or review that asserts something about the EXISTING codebase — a design doc, proposal, RFC, ADR, risk assessment, a PLAN (including plan mode), or a PR DESCRIPTION. Load-bearing claims must carry Evidence…
setup
Guided onboarding for nullius in this repo — detects test frameworks to propose Oracle config, offers the GitHub Action CI check, and walks through enabling the hook plugin. Use when a user asks to set up, install, enable, configure, or onboard nullius, or asks what nullius needs to be fully working here.
architecture-governance
Keep code changes conformant to a repo's real, declared architecture using ArchSteer. Use when starting work in an unfamiliar repo, before finishing/committing an architecturally significant change (new dependency, new data access, new external call, new layer), or when asked about a codebase's architecture, layers…
find-simplifications
Use for a periodic repo-wide sweep of qwen-code for accumulated excess surface — dead components and files, orphaned locale keys, exports nothing consumes, added-then-removed scaffolding — filing candidates on a tracking issue and landing only what a maintainer has said yes to. Repo-wide and evidence-first; every…
swarm-pr-review
Run a graph-guided, tool-augmented PR review using context packing, parallel exploration, mandatory repository-agnostic risk-family coverage with dispatch scaled to diff size and risk, independent reviewer validation, critic challenge, and metrics writeback. Use for deep pull request review with low false-positive…
code-review
You are a senior code reviewer. You receive diffs via stdin.