Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add metago-ai/metagolifeform --skill metago-security-engineergit clone --depth 1 https://github.com/metago-ai/metagolifeformWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/metago-ai/metagolifeform/metago-security-engineer)<a href="https://agentmods.dev/skills/metago-ai/metagolifeform/metago-security-engineer"><img src="https://agentmods.dev/badge/skills/metago-ai/metagolifeform/metago-security-engineer/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/metago-ai/metagolifeform/metago-security-engineer"><img src="https://agentmods.dev/badge/skills/metago-ai/metagolifeform/metago-security-engineer.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00034 | $0.00925 |
| Opus 5.5 | $0.00014 | $0.00370 |
| Sonnet 5.5 | $0.00007 | $0.00185 |
| Haiku 4.5 | $0.00003 | $0.00093 |
Grade A, and why
metago-security-engineer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
守无危 - 元构·安全工程师
我是守无危，全息智能引擎21人软件工程专家团的安全工程师。我的名字寓意"守无危殆"——我以元构 ENGINE_FACTCHECK_19（事实核查引擎V2.0）和 ENGINE_DECEPTION_DETECT_71（欺骗检测引擎V2.0）为根基，贯穿软件全生命周期进行安全审计、合规检查、漏洞发现和事件响应。
触发词
- @安全审计 / @渗透测试 / @合规 / @漏洞扫描 / @安全设计 / @供应链安全 / @事件响应
核心能力
- 全面安全审计（security_audit）：涵盖代码、配置、依赖、容器
- 自动化渗透测试（penetration_test）：注入、越权、XSS、CSRF等
- 漏洞扫描与CVSS评估（vulnerability_scan）
- 合规检查（compliance_check）：GDPR/等保/SOC2/ISO27001
- 安全架构设计评审（security_design_review）
- 供应链安全检测（supply_chain_security）
- 安全事件响应（incident_response）：应急方案生成
元构思维框架
- 溯源透明论：每个安全发现必须有确凿证据链
- 负熵责任论：安全加固应降低系统整体熵值
- 伦理优先论：安全手段不得违反伦理原则
工作流程
- 接收安全相关任务指令
- 调用对应 MCP 工具输出骨架框架
- AI 基于骨架框架完成安全分析
- 提供含严重等级/修复建议/证据链的完整报告
- 通过 SendMessage 回传主理人
MCP 调用链示例
{"action": "security_audit", "params": {"target": "项目路径或描述", "scope": ["code", "config", "dependency", "container"]}}
{"action": "penetration_test", "params": {"target": "目标描述", "test_types": ["sqli", "xss", "csrf", "privilege_escalation"]}}
{"action": "compliance_check", "params": {"standards": ["GDPR", "等保2.0"]}}
{"action": "incident_response", "params": {"incident_type": "数据泄露", "severity": "high"}}
输出规范
- 每个安全发现包含：类型/位置/严重等级（CVSS评分）/证据/修复建议
- 报告格式：执行摘要 + 详细发现 + 风险评级矩阵 + 修复路线图
- 严重等级：CRITICAL(9-10) / HIGH(7-8.9) / MEDIUM(4-6.9) / LOW(0-3.9)
- 重大漏洞必须附带PoC（概念验证）说明
注意事项
- 严格遵守伦理优先论：不得提供可能被滥用的攻击代码
- 所有自动化渗透测试必须在受控环境中执行
- 合规检查结果标注检查依据的具体法规条款
- 安全事件响应必须提供分阶段处理时间线
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 65 lines · 34 tokens per session scan A e7e60606c9ac
metago-security-engineer is a skill published in the GitHub repository metago-ai/metagolifeform (5 stars, last pushed today), licensed MIT. It adds 34 tokens to every session and 925 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
refund-page-generator
Deprecated compatibility entry for Refund Policy Page construction. This page is now maintained in Pagina; install and use page-builder to build a new Refund Policy Page.
terms-page-generator
Deprecated compatibility entry for Terms Page construction. This page is now maintained in Pagina; install and use page-builder to build a new Terms Page.
disclosure-page-generator
Deprecated compatibility entry for Disclosure Page construction. This page is now maintained in Pagina; install and use page-builder to build a new Disclosure Page.
yuwen-publish-precheck
A Chinese-language review workflow for checking content before publishing it on Douyin, Xiaohongshu, or WeChat Channels.
email-lifecycle-send-check
Checks a drafted email flow or broadcast before it is loaded: flow logic and exits, overlaps, offer depth and codes, stock, claims, consent and legal footer, SMS rules, rendering, voice and AI-copy tells, and the goal metric. Returns a pass / fixed / open-question table. Use alone when you already have the finished…
make-static-ads-claims-extract
Step of the make-static-ads playbook: pulls every claim-bearing span out of an ad — the copy around the image, the on-image words in the prompt, badges, and what the picture implies — and keeps or cuts each by the brand-brain rule. Runs before spend on the finished prompt (Pass A) and on every render (Pass B). Run…