Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add laolaoshiren/claude-code-skills-zh --skill security-auditgit clone --depth 1 https://github.com/laolaoshiren/claude-code-skills-zhWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/laolaoshiren/claude-code-skills-zh/security-audit)<a href="https://agentmods.dev/skills/laolaoshiren/claude-code-skills-zh/security-audit"><img src="https://agentmods.dev/badge/skills/laolaoshiren/claude-code-skills-zh/security-audit/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/laolaoshiren/claude-code-skills-zh/security-audit"><img src="https://agentmods.dev/badge/skills/laolaoshiren/claude-code-skills-zh/security-audit.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00020 | $0.00653 |
| Opus 5 | $0.00010 | $0.00327 |
| Sonnet 5 | $0.00004 | $0.00131 |
| Haiku 4.5 | $0.00002 | $0.00065 |
Grade A, and why
security-audit scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
代码安全审计
触发条件
当用户要求安全检查、漏洞扫描、安全审计、依赖安全检查时激活此技能。
工作流程
- 确定审计范围 — 根据用户指定的目录/文件/代码段进行分析
- 静态安全扫描 — 按检查清单逐项排查
- 依赖安全检查 — 检查 package.json / requirements.txt / go.mod 等依赖文件
- 生成审计报告 — 按严重程度分类输出
检查清单
🔴 高危
- 硬编码密钥/密码/API Key
- SQL 注入风险（字符串拼接 SQL）
- 命令注入（未过滤的 shell 命令）
- 路径遍历（未校验的文件路径）
- 反序列化漏洞
- 未校验的 JWT/Token 验证
🟡 中危
- XSS 风险（未转义的用户输入）
- CSRF 保护缺失
- 不安全的随机数生成
- 敏感信息日志泄露
- 过宽的权限设置
- 缺少 Rate Limiting
🟢 低危
- 缺少输入验证
- 依赖版本过旧
- 缺少安全头部（CSP, HSTS, X-Frame-Options）
- 错误信息泄露内部细节
- 缺少 HTTPS 强制
输出格式
## 🔒 安全审计报告
### 审计概览
- 审计范围：xxx
- 发现问题：🔴 高危 X 个 / 🟡 中危 X 个 / 🟢 低危 X 个
### 🔴 高危问题
#### 1. [文件路径:行号]
- **漏洞类型**：xxx
- **风险描述**：xxx
- **攻击场景**：攻击者可以通过 xxx 方式...
- **修复方案**：
```code
// 修复前
// 修复后
🟡 中危问题
...
🟢 低危问题
...
依赖安全
| 依赖名 | 当前版本 | 建议版本 | 风险 |
|---|
修复优先级建议
- 立即修复：...
- 本周修复：...
- 长期改进：...
## 注意事项
- 提供修复前后的代码对比
- 对于每条漏洞，说明具体的攻击向量
- 优先级基于可利用性和影响范围判断
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 11d ago First seen · 83 lines · 20 tokens per session scan A c6a811d71b21
security-audit is a skill published in the GitHub repository laolaoshiren/claude-code-skills-zh (832 stars, last pushed today), licensed MIT. It adds 20 tokens to every session and 653 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
launch-tweet
Draft a launch tweet or short thread for a solo product launch on X / Twitter. Use when the user is shipping something (new product, major feature, side project) and asks for a launch post, "help me announce X", or mentions Product Hunt / Show HN / X launch.
postmortem-solo
Run a lightweight, blame-free postmortem after an incident, failed launch, or missed deadline — for one person. Use when the user says "that didn't go well", "the launch flopped", "we had an outage", "I missed my deadline", or wants to learn from a recent failure.
bug-from-user
Convert a vague user complaint into a reproducible bug report a solo dev can act on. Use when the user pastes a confusing customer message, says "user says it's broken but I can't repro", "this email makes no sense", or wants to triage a bug report.
changelog-from-commits
Generate a user-facing CHANGELOG entry from raw git log output. Use when the user is preparing a release, says "what changed since last version", asks to write release notes, or wants to summarize a batch of commits for end users.
standup-solo
Run a 5-minute personal standup for a solo dev — what shipped yesterday, what's blocked, what's next today. Use when the user asks for a daily check-in, says "what should I work on today", "what did I do yesterday", or wants to break out of a productivity slump.
email-customer
Draft a polite-but-firm reply to a tricky customer email — refund request, scope creep, complaint, billing dispute. Use when the user pastes a customer email and asks for a reply, mentions "how do I respond", "user is asking for a refund", "they want a discount", or any awkward customer-facing communication.