Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add Liberty91LTD/cti-skills --skill abuseipdb-apigit clone --depth 1 https://github.com/Liberty91LTD/cti-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/liberty91ltd/cti-skills/abuseipdb-api)<a href="https://agentmods.dev/skills/liberty91ltd/cti-skills/abuseipdb-api"><img src="https://agentmods.dev/badge/skills/liberty91ltd/cti-skills/abuseipdb-api/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/liberty91ltd/cti-skills/abuseipdb-api"><img src="https://agentmods.dev/badge/skills/liberty91ltd/cti-skills/abuseipdb-api.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00021 | $0.00560 |
| Opus 5.5 | $0.00008 | $0.00224 |
| Sonnet 5.5 | $0.00004 | $0.00112 |
| Haiku 4.5 | $0.00002 | $0.00056 |
Grade A, and why
abuseipdb-api scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
curl -s "https://api.abuseipdb.com/api/v2/check" \ What it actually says
AbuseIPDB API v2
Base URL
https://api.abuseipdb.com/api/v2
Authentication
Header: Key: $ABUSEIPDB_API_KEY
Also: Accept: application/json
Rate Limits
- Free: 1000 checks/day, 500 reports/day
- Premium: Higher limits
Key Endpoints
Check IP
curl -s "https://api.abuseipdb.com/api/v2/check" \
-G -d "ipAddress={ip}" -d "maxAgeInDays=90" -d "verbose" \
-H "Key: $ABUSEIPDB_API_KEY" -H "Accept: application/json"
Useful fields:
data.abuseConfidenceScore— 0-100 abuse confidencedata.totalReports— number of abuse reportsdata.numDistinctUsers— unique reportersdata.lastReportedAt— most recent reportdata.isp— ISP namedata.usageType— usage type (Data Center, ISP, etc.)data.countryCode— countrydata.domain— associated domaindata.isTor— Tor exit node flagdata.reports[]— individual reports (withverbose)
Check Network (CIDR)
curl -s "https://api.abuseipdb.com/api/v2/check-block" \
-G -d "network={cidr}" -d "maxAgeInDays=90" \
-H "Key: $ABUSEIPDB_API_KEY" -H "Accept: application/json"
Confidence Score Interpretation
| Score | Meaning |
|---|---|
| 0 | No reports, clean |
| 1-25 | Low confidence of abuse |
| 26-50 | Moderate — some reports |
| 51-75 | High — significant abuse reports |
| 76-100 | Very high — widely reported as abusive |
Response Summary Format
ip: <IP>
abuse_confidence: <0-100>
total_reports: <number>
distinct_reporters: <number>
last_reported: <date>
isp: <ISP>
usage_type: <type>
country: <country>
is_tor: <true/false>
verdict: clean|low-risk|suspicious|malicious
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2mo ago First seen · 71 lines · 21 tokens per session scan A 60e134afa111
abuseipdb-api is a skill published in the GitHub repository Liberty91LTD/cti-skills (36 stars, last pushed 4d ago), licensed MIT. It adds 21 tokens to every session and 560 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
blind-sqli
Blind SQL injection under hostile WAF — manual bypass playbook for when sqlmap fails because common tokens (SUBSTRING, IF, AND, WHERE, single quotes) are filtered. Covers token-fingerprinting probe loops, arithmetic-multiplication boolean evaluation, hex-encoded literals, and exponential-probe binary search. Loaded on…
verb-tampering
HTTP verb/method tampering — auth bypass via HEAD/OPTIONS/arbitrary methods, X-HTTP-Method-Override, TRACE/PUT/DELETE exposure, framework routing flaws.
hpp
HTTP Parameter Pollution — parser discrepancies between proxy/server/app, WAF bypass, auth/ACL bypass, injection delivery.
oauth
OAuth 2.0 / OIDC attacks — redirecturi bypass, state CSRF, code leak via Referer, responsetype confusion, PKCE downgrade, scope creep, ATO chains.
php-type-juggling
PHP type juggling and magic hash attacks — exploit loose comparison (==) with 0e-prefixed hash collisions and NULL returns to bypass authentication.
race-condition
Race condition / TOCTOU exploitation — concurrent and parallel-request attacks against web applications that check then act, write session state before validating it, or perform slow operations that widen the race window. Covers single-endpoint races (double-spend, coupon abuse, balance overflow) and multi-endpoint…