Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add Liberty91LTD/cti-skills --skill abuseipdb-apigit clone --depth 1 https://github.com/Liberty91LTD/cti-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/liberty91ltd/cti-skills/abuseipdb-api)<a href="https://agentmods.dev/skills/liberty91ltd/cti-skills/abuseipdb-api"><img src="https://agentmods.dev/badge/skills/liberty91ltd/cti-skills/abuseipdb-api/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/liberty91ltd/cti-skills/abuseipdb-api"><img src="https://agentmods.dev/badge/skills/liberty91ltd/cti-skills/abuseipdb-api.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00021 | $0.00560 |
| Opus 5 | $0.00010 | $0.00280 |
| Sonnet 5 | $0.00004 | $0.00112 |
| Haiku 4.5 | $0.00002 | $0.00056 |
Grade A, and why
abuseipdb-api scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
curl -s "https://api.abuseipdb.com/api/v2/check" \ What it actually says
AbuseIPDB API v2
Base URL
https://api.abuseipdb.com/api/v2
Authentication
Header: Key: $ABUSEIPDB_API_KEY
Also: Accept: application/json
Rate Limits
- Free: 1000 checks/day, 500 reports/day
- Premium: Higher limits
Key Endpoints
Check IP
curl -s "https://api.abuseipdb.com/api/v2/check" \
-G -d "ipAddress={ip}" -d "maxAgeInDays=90" -d "verbose" \
-H "Key: $ABUSEIPDB_API_KEY" -H "Accept: application/json"
Useful fields:
data.abuseConfidenceScore— 0-100 abuse confidencedata.totalReports— number of abuse reportsdata.numDistinctUsers— unique reportersdata.lastReportedAt— most recent reportdata.isp— ISP namedata.usageType— usage type (Data Center, ISP, etc.)data.countryCode— countrydata.domain— associated domaindata.isTor— Tor exit node flagdata.reports[]— individual reports (withverbose)
Check Network (CIDR)
curl -s "https://api.abuseipdb.com/api/v2/check-block" \
-G -d "network={cidr}" -d "maxAgeInDays=90" \
-H "Key: $ABUSEIPDB_API_KEY" -H "Accept: application/json"
Confidence Score Interpretation
| Score | Meaning |
|---|---|
| 0 | No reports, clean |
| 1-25 | Low confidence of abuse |
| 26-50 | Moderate — some reports |
| 51-75 | High — significant abuse reports |
| 76-100 | Very high — widely reported as abusive |
Response Summary Format
ip: <IP>
abuse_confidence: <0-100>
total_reports: <number>
distinct_reporters: <number>
last_reported: <date>
isp: <ISP>
usage_type: <type>
country: <country>
is_tor: <true/false>
verdict: clean|low-risk|suspicious|malicious
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago First seen · 71 lines · 21 tokens per session scan A 60e134afa111
abuseipdb-api is a skill published in the GitHub repository Liberty91LTD/cti-skills (18 stars, last pushed 1mo ago), licensed MIT. It adds 21 tokens to every session and 560 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
dev-engineer
Adds logic, state management, TypeScript types, and CRUD operations to UI. Works AFTER ui-first-builder creates the interface. Implements Zustand stores, form handling with React Hook Form + Zod, and prepares for backend connection. Triggers: add logic, add functionality, make it work, state management, form…
integrations
One-request, complete setup of external services — payment (Stripe, PromptPay, Omise, 2C2P), email, auth, analytics, storage and other integrations, including Thai-market services. Installs SDKs, creates API routes, env templates, and UI components in one pass. Use when the user asks to add payments, email, login…
api-documenter
Auto-generate API documentation from code and comments. Use when API endpoints change, or user mentions API docs. Creates OpenAPI/Swagger specs from code. Triggers on API file changes, documentation requests, endpoint additions.
api-debug
Debug REST, GraphQL, webhook, and OAuth/API-key integrations with layered request, auth, schema, and response checks.
eep-adopt-app
User wants the Entity Engagement Protocol in their application—EEP, signed webhooks, SSE, gates, "agent-ready API," or running eep-dev/agent-adopt. Use for adopt EEP, add EEP, EEP webhooks, not for generic REST without EEP.
vigilante-issue-implementation-on-php
Implement a GitHub issue end-to-end when Vigilante dispatches work for a PHP repository with Composer, static analysis, and security guidance.