Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/matrixfounder/agentic-development/security-auditnpx skills add MatrixFounder/Agentic-development --skill security-auditgit clone --depth 1 https://github.com/MatrixFounder/Agentic-developmentWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00043 | $0.03258 |
| Opus 5 | $0.00022 | $0.01629 |
| Sonnet 5 | $0.00009 | $0.00652 |
| Haiku 4.5 | $0.00004 | $0.00326 |
Grade B, and why
security-audit scanned grade B with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Instruction-override phrasingmediumPrompt injection
Text telling the model to disregard its earlier instructions or safety rules is the shape of a prompt injection, whoever wrote it.
1. **Prompt Injection (LLM01)**: Can user input override system prompts? Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.
Reads MCP configurationlowAgent snooping
mcp.json carries server URLs and auth tokens; reading it lets a mod discover and abuse other integrations.
- **MCP / Agentic (OWASP ASI Top 10 2026)** — MCP config provenance (`mcp.json`, `.mcp.json`, `claude_desktop_config.json`, incl. `.vscode/`), auto-approve keys, permission-bypass flags, unpinned `npx -y`/`uvx` servers, Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.
How it starts
The opening of the file, as written. The whole thing — 161 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Security Audit v3.7
0. Methodology — Two Layers (audit-067 C-10)
This skill runs two complementary layers; neither substitutes for the other:
- Deterministic floor (§2) — regex patterns + external scanners. Reproducible, cheap, CI-gateable (
--fail-on), zero judgment. It is a floor, not the audit: a clean scan is not clearance, because regex is categorically blind to semantic classes — business-logic authz, cross-file taint flows, semantic MCP tool-description poisoning (§3 Agentic limitation note). - LLM semantic pass (§3–§4) — long-context taint/logic review against the checklists plus threat modeling: the layer that catches what regex cannot. Frontier evidence that LLM-driven semantic review finds real vulnerabilities beyond pattern matching: DARPA AIxCC finals (2025), Google Big Sleep, Codex Security / Claude Code Security review agents (full citations: audit-067 §Bibliography).
Licensing footnote (semgrep): the open-source offering is Semgrep CE since the Dec 2024 licensing change; Opengrep (community fork, Jan 2025) is a drop-in alternative where CE constraints matter. The external-tool roster treats either as the same scanner slot.
1. Red Flags (Anti-Rationalization)
STOP and READ THIS if you are thinking:
- "I'll skip the script because I just checked the code manually" -> WRONG. Humans miss regex patterns. EXECUTE the script.
- "I have no way to run it, so I'll write down what it would have said" -> WRONG, and the worst of them. Inventing scanner output manufactures a passed gate nobody can see through. There is exactly ONE legitimate way not to execute — §2's
NOT RUNbranch — and it is legitimate precisely because it is visible. - "This is an internal tool, so AuthZ doesn't matter" -> WRONG. Zero Trust applies everywhere.
- "Dependencies are probably fine" -> WRONG. Supply chain attacks are the #1 vector.
- "I don't have time for a full audit" -> WRONG. Breach cleanup takes 100x longer.
- "The LLM output is safe to use directly" -> WRONG. LLM output is untrusted input. Sanitize it.
What ships with it
20 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- docs/vdd-round3-critique.md 5.7 KB
- docs/vdd-round4-critique.md 7.4 KB
- examples/usage_example.md 2.4 KB
- references/checklists/api_security.md 4.4 KB
- references/checklists/fuzzing_invariants.md 7.2 KB
- references/checklists/llm_security.md 5.4 KB
- references/checklists/mcp_agentic_security.md 7.8 KB
- references/checklists/owasp_top_10.md 8.2 KB
- references/checklists/secret_rotation.md 3.5 KB
- references/checklists/solana_security.md 4.3 KB
- references/checklists/solidity_security.md 4.6 KB
- references/checklists/threat_model.md 3.1 KB
- scripts/audit/__init__.py 772 B runs code
- scripts/audit/config.py 2.1 KB runs code
- scripts/audit/external.py 2.6 KB runs code
- scripts/audit/helpers.py 3.4 KB runs code
- scripts/audit/patterns.py 22 KB runs code
- scripts/audit/scanners.py 25 KB runs code
- scripts/run_audit.py 7.2 KB runs code
- tests/test_smoke.py 16 KB runs code
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 161 lines · 43 tokens per session scan B 08645e5e1a56
security-audit is a skill published in the GitHub repository MatrixFounder/Agentic-development (5 stars, last pushed 19d ago), licensed Apache-2.0. It adds 43 tokens to every session and 3,258 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it B with 2 findings (instruction-override phrasing, reads mcp configuration). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
batch
Execute batch operations on multiple files in parallel. Automatically discovers files, splits into chunks, and processes with parallel worker agents. Use /batch followed by operation and file pattern.
extension-creator
Create, scaffold, customize, validate, and locally test Qwen Code extensions. Use when the user wants a new Qwen Code extension, needs help choosing an extension template, wants to add QWEN.md context, commands, skills, agents, MCP servers, settings, hooks, channels, or LSP servers, or asks how to link and test an…
notion
Notion API for creating and managing pages, databases, and blocks. Use when the user wants to create a Notion page, query a Notion database, update Notion properties, search Notion, add content to Notion, manage Notion blocks, or interact with Notion data sources and workspaces via the API.
pr-feedback
Fetches PR review feedback and inline comments, categorizes them, and presents options to the user. Use when the user asks to get, read, address, or fix review comments on a pull request.
argent-native-profiler
Native profiling for CPU hotspots, UI hangs, memory issues. iOS via xctrace; Android via Perfetto. Use when diagnosing native-level performance issues.
argent-tv-interact
Control and inspect TV apps via argent — Apple TV (tvOS), Android TV (leanback), and Amazon Fire TV (Vega). Boot the target, read focus, navigate with the D-pad remote, type, screenshot, and on Vega debug the JS runtime (evaluate, console logs, network inspector). Use when a task targets a TV (runtimeKind "tv", or…