Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add khendzel/skills-janitor --skill janitor-securitygit clone --depth 1 https://github.com/khendzel/skills-janitorWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/khendzel/skills-janitor/janitor-security)<a href="https://agentmods.dev/skills/khendzel/skills-janitor/janitor-security"><img src="https://agentmods.dev/badge/skills/khendzel/skills-janitor/janitor-security/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/khendzel/skills-janitor/janitor-security"><img src="https://agentmods.dev/badge/skills/khendzel/skills-janitor/janitor-security.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00073 | $0.01195 |
| Opus 5 | $0.00036 | $0.00598 |
| Sonnet 5 | $0.00015 | $0.00239 |
| Haiku 4.5 | $0.00007 | $0.00120 |
Grade C, and why
janitor-security scanned grade C with 4 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Instruction-override phrasingmediumPrompt injection
Text telling the model to disregard its earlier instructions or safety rules is the shape of a prompt injection, whoever wrote it.
- **Injection phrases** — "ignore all previous instructions", "do not tell the user" Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.
Downloads and executes remote codemediumSupply chain
curl | sh runs whatever the server returns today, which is not necessarily what it returned when this was reviewed.
- **Dangerous scripts** — network piped into a shell (`curl … | bash`), decode-and-execute, credential-store access (`~/.ssh`, `~/.aws`, keychain), URL shorteners, plain-HTTP calls, uploads of variable data Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.
Enumerates other installed skillslowAgent snooping
Other skills' SKILL.md files reveal prompts, capabilities and secrets that should be invisible to peers.
**Solution**: The plugin is installed under a different root — locate it with `ls ~/.claude/skills` or check the plugin cache. Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
- **Dangerous scripts** — network piped into a shell (`curl … | bash`), decode-and-execute, credential-store access (`~/.ssh`, `~/.aws`, keychain), URL shorteners, plain-HTTP calls, uploads of variable data How it starts
The opening of the file, as written. The whole thing — 93 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Security Scan
Heuristic scan of skill content for prompt-injection and malicious patterns.
Overview
A skill is text your agent trusts: its SKILL.md is read as instructions and its scripts run on your machine. Public research (Snyk's ToxicSkills, 2026) found prompt injection in roughly a third of tested community skills. This scan flags the known bad shapes across every installed skill, in every scope (user, project, codex, plugin):
- Injection phrases — "ignore all previous instructions", "do not tell the user"
- Hidden instructions — imperative text in HTML comments (invisible when rendered), zero-width/bidi unicode between plain characters
- Payload smuggling — large decodable base64 blobs in markdown
- Dangerous scripts — network piped into a shell (
curl … | bash), decode-and-execute, credential-store access (~/.ssh,~/.aws, keychain), URL shorteners, plain-HTTP calls, uploads of variable data
Findings are heuristics, not proof: a RISK verdict means "read this before trusting it". Legit tools trip these rules too (e.g. an installer that pipes curl into bash) — the point is that YOU see it and decide.
Prerequisites
- Claude Code with the skills-janitor plugin installed (provides
scripts/security.sh) - bash 3.2+ (the stock macOS bash works; no external dependencies, no network access)
Instructions
Step 1: Run the scan
bash ~/.claude/skills/skills-janitor/scripts/security.sh # all installed skills
bash ~/.claude/skills/skills-janitor/scripts/security.sh --json # machine-readable
bash ~/.claude/skills/skills-janitor/scripts/security.sh --path ~/some/skill-dir # one directory
Step 2: Present verdicts honestly
Per-skill verdict: RISK (any HIGH finding), REVIEW (any MEDIUM), PASS. For each flagged skill show the finding titles, the file, and the evidence snippet. Do NOT call a finding "malware" — describe what the pattern does and let the user judge intent (e.g. "media-use pipes a HeyGen installer from the network into bash — a common install pattern, but verify the URL before trusting it").
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 10d ago First seen · 93 lines · 73 tokens per session scan C f21b2b570c00
janitor-security is a skill published in the GitHub repository khendzel/skills-janitor (117 stars, last pushed 29d ago), licensed MIT. It adds 73 tokens to every session and 1,195 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it C with 4 findings (instruction-override phrasing, downloads and executes remote code, enumerates other installed skills). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
deep-clean
Full-spectrum consolidation of AI agent configuration files. Goes beyond memory-only dream skills: audits and optimizes context files (AGENTS.md/AGENTS.md/GEMINI.md/.cursorrules), rules, skills, and memory. Detects stale references, dead file paths, duplicated rules, stack mismatches, contradictions, vague directives…
skill-auditor
Use when auditing Hermes skills for broken references.
aig-scanner
A.I.G Scanner — AI security scanning for infrastructure, AI tools / skills, AI Agents, and LLM jailbreak evaluation via Tencent Zhuque Lab AI-Infra-Guard. Uses built-in exec + Python script, no plugin required. Requires AIGBASEURL to be configured. Triggers on: scan AI service, AI vulnerability scan, scan AI infra…
html-draft
Use when user wants a standalone HTML diagram in flat engineering blueprint style — architecture diagrams, system flows, technical spec sheets, component maps. Generates one HTML file using Tailwind v4 (browser CDN) for layout and D3 v7 (CDN) for SVG diagrams. User-invoked only — do NOT auto-trigger. Triggers on…
idea
Use when capturing ONE new idea the user voices and wants recorded — "save this idea", "I have an idea", "log this idea", "/idea", "idea: ...". Creates a provenance-tracked folder (one folder per idea) in your ideas repo, dedups against an index, optionally mirrors to a GitHub Project view filtered by label:idea. NOT…
pm-brainstorm
A structured brainstorming session for exploring a specific product problem or opportunity and narrowing the results to ideas worth pursuing.