Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/kouroshez/coding-os/security-webnpx skills add kouroshez/coding-os --skill security-webgit clone --depth 1 https://github.com/kouroshez/coding-osWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00128 | $0.04879 |
| Opus 5 | $0.00064 | $0.02440 |
| Sonnet 5 | $0.00026 | $0.00976 |
| Haiku 4.5 | $0.00013 | $0.00488 |
Grade A, and why
security-web scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
**Client-side `accept=`, JS MIME and JS size checks are UX only** — replayed in curl they vanish. Never drop a server-side check because the UI has one. How it starts
The opening of the file, as written. The whole thing — 268 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Web / Backend Security — OWASP Top-10 (2025) + 2026 Practice
A practical playbook for hardening server-side code. Anchored on OWASP Top-10 (2025) — released November 2025, the current standard, replaces the 2021 list. Targets the project's stack — Go+Fiber business backend + Python+FastAPI AI adapter + PostgreSQL — with concrete code per category.
When to Use This Skill
- Writing or reviewing any backend route / handler / middleware.
- Adding a new third-party SDK / dependency.
- Setting up TLS / HSTS / CSP headers.
- Auditing existing code for OWASP categories.
- Pre-launch security review.
- Investigating a security incident or pentest finding.
For client-side mobile hardening, see security-mobile. For auth specifically, see auth-patterns.
OWASP Top-10 (2025) — Per Category
The full per-category walk-through with concrete defenses + code samples is in references/owasp-top-10.md. The skim summary, in 2025 ranking order:
| ID | Category | 2021 → 2025 change | Top defense |
|---|---|---|---|
| A01 | Broken Access Control | same #1 | Default deny; use case asserts ownership; multi-tenant via Postgres RLS |
| A02 | Security Misconfiguration | ↑ from #5 to #2 | Security headers; no DEBUG in prod; default admin paths protected; least-privilege containers |
| A03 | Software Supply Chain Failures | renamed + expanded from "Vulnerable & Outdated Components" (was #6) | SBOM per release; pin commits not tags in CI; OIDC short-lived tokens; staged rollouts; MFA on registry/repo accounts |
| A04 | Cryptographic Failures | ↓ from #2 to #4 | TLS 1.2+; Argon2id for passwords; SHA-256 for refresh-token hashing; KMS-encrypted PII |
| A05 | Injection | ↓ from #3 to #5 | Parameterized queries everywhere; never concat user input into SQL/shell/templates |
| A06 | Insecure Design | ↓ from #4 to #6 | Server-authoritative checks; idempotency; rate limiting; threat modeling |
| A07 | Authentication Failures | renamed (was "Identification and Authentication Failures") | See auth-patterns skill |
| A08 | Software or Data Integrity Failures | same #8 | No insecure deserialization; signed updates; pinned action SHAs |
| A09 | Security Logging and Alerting Failures | renamed (was "Monitoring") | Auth events logged with request_id; alerts on anomalies; runbooks per alert |
| A10 | Mishandling of Exceptional Conditions | NEW in 2025 | Catch at source; fail-closed transactions; centralized error handler; resource cleanup in finally |
What ships with it
4 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 268 lines · 128 tokens per session scan A 25eb9c6b4f58
security-web is a skill published in the GitHub repository kouroshez/coding-os (6 stars, last pushed yesterday), licensed Apache-2.0. It adds 128 tokens to every session and 4,879 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
potpie-source-ingestion
Use when the user explicitly asks to ingest, refresh, or deeply understand a repository, PR, issue, ticket, runbook, incident report, document, or web link into Potpie. The harness performs todo-driven discovery, uses local/GitHub/integration tools and read-only subagents when available, builds evidence-backed…
potpie-repo-baseline
Use when establishing, refreshing, or deeply understanding a repository's baseline memory in Potpie: purpose, application type, features, services/modules, environments, deploy shape, dependencies, API contracts, datastores, integrations, ownership, and explicit preferences. The harness reads authored and…
graph-mutation-plan
Cookbook for composing an applygraphmutations plan — stable entitykey patterns, the canonical label/edge vocabulary, evidence/invalidation/confidence discipline, and a worked example. Load this when building a non-trivial mutation plan.
obsidian-layout-adjustment
Workflow for working with the user on changing how Obsidian looks using CSS snippets. Use this whenever the user asks to restyle Obsidian, tune a vault's visual layout, adjust tabs, sidebars, note surfaces, properties, backlinks, graph panes, file explorer rows, icons, links, shadows, active states, or CSS snippets.…
alfworld-locate-target-object
Navigates to a suspected location and identifies a target object. Use when your goal requires finding a specific object (e.g., "potato", "plate") and its location is not immediately known. Moves to a relevant receptacle (like a fridge or cabinet), checks its contents, and outputs the object's location or confirms its…
scienceworld-growth-focuser
Use when you have planted a seed or need to track a plant's growth stage (sprouting, flowering, reproduction). Applies the 'focus on' action to a specific plant or biological entity to signal intent and monitor its development. Trigger after planting or when you need to observe life cycle progression in the…