Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/kazdenc/builder-skills/security-scannpx skills add kazdenc/builder-skills --skill security-scangit clone --depth 1 https://github.com/kazdenc/builder-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/kazdenc/builder-skills/security-scan)<a href="https://agentmods.dev/skills/kazdenc/builder-skills/security-scan"><img src="https://agentmods.dev/badge/skills/kazdenc/builder-skills/security-scan.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00067 | $0.01850 |
| Opus 5 | $0.00034 | $0.00925 |
| Sonnet 5 | $0.00013 | $0.00370 |
| Haiku 4.5 | $0.00007 | $0.00185 |
Grade A, and why
security-scan scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 150 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Scan code for OWASP Top 10 vulnerabilities. Report severity-rated findings with file:line references and fix recommendations. Flag what matters; skip what doesn't apply.
Scan Categories
Work through each OWASP category. For each, search for the specific code patterns listed.
1. Injection (A03:2021)
| Pattern to find | Risk | What to verify |
|---|---|---|
| String concatenation in SQL queries | SQL injection | Use parameterized queries / prepared statements |
| Template literals in database calls | NoSQL injection | Use query builders or ORM methods with bound parameters |
exec(), spawn(), system() with user input |
Command injection | Validate/whitelist input, avoid shell execution |
| User input in LDAP filters | LDAP injection | Escape special characters, use parameterized filters |
| User input in regex constructors | ReDoS | Validate regex complexity, use re2 or set timeouts |
eval(), Function(), vm.runInContext() |
Code injection | Remove entirely; never evaluate user-controlled strings |
2. Broken Authentication (A07:2021)
| Pattern to find | Risk | What to verify |
|---|---|---|
| Plain-text password storage | Credential theft | Use bcrypt/scrypt/argon2 with proper work factor |
| Missing rate limiting on login endpoints | Brute force | Implement rate limiting and account lockout |
| Session tokens in URLs or localStorage | Session hijack | Use httpOnly secure cookies |
| JWT without expiration or with weak signing | Token forgery | Set short exp, use RS256 or ES256, rotate keys |
| Missing MFA on sensitive operations | Account takeover | Require step-up auth for destructive actions |
| Hardcoded credentials or default passwords | Unauthorized access | Use environment variables and secrets management |
3. Sensitive Data Exposure (A02:2021)
| Pattern to find | Risk | What to verify |
|---|---|---|
| API keys, tokens, passwords in source | Credential leak | Move to environment variables / secrets manager |
| Secrets in log output | Log exfiltration | Redact sensitive fields before logging |
| Missing TLS / HTTP used for sensitive data | Man-in-the-middle | Enforce HTTPS, use HSTS header |
| PII in error responses | Information disclosure | Return generic errors to clients, log details server-side |
| Sensitive data in client-side state | Browser exposure | Keep secrets server-side, minimize client-side PII |
| Missing encryption at rest | Data breach | Encrypt sensitive database columns and file storage |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 6d ago First seen · 150 lines · 67 tokens per session scan A 23613864f2eb
security-scan is a skill published in the GitHub repository kazdenc/builder-skills (44 stars, last pushed 6mo ago), licensed MIT. It adds 67 tokens to every session and 1,850 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
commercial-opportunity-review
Review Product, offering, catalog, quote, and sale evidence for commercial opportunities.
product-line-performance-review
Roll real Product evidence into a ProductLine review without changing the canonical reporting boundary.
stakeholder-brief
Prepare a concise owner or stakeholder brief with current decisions, evidence, bets, outcomes, roadmap, and provenance.
weekly-intelligence
Review cited market, competitor, customer, and delivery changes for one explicit business-product scope.
demand-triage
Prepare classification, evidence gaps, and score inputs for product demand without crossing the funding boundary.
investment-preparation
Prepare an evidence-linked product investment packet while preserving the governed funding decision.