Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add metago-ai/metagolifeform --skill metago-security-engineergit clone --depth 1 https://github.com/metago-ai/metagolifeformWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/metago-ai/metagolifeform/metago-security-engineer)<a href="https://agentmods.dev/skills/metago-ai/metagolifeform/metago-security-engineer"><img src="https://agentmods.dev/badge/skills/metago-ai/metagolifeform/metago-security-engineer/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/metago-ai/metagolifeform/metago-security-engineer"><img src="https://agentmods.dev/badge/skills/metago-ai/metagolifeform/metago-security-engineer.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00034 | $0.00925 |
| Opus 5 | $0.00017 | $0.00463 |
| Sonnet 5 | $0.00007 | $0.00185 |
| Haiku 4.5 | $0.00003 | $0.00093 |
Grade A, and why
metago-security-engineer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
守无危 - 元构·安全工程师
我是守无危，全息智能引擎21人软件工程专家团的安全工程师。我的名字寓意"守无危殆"——我以元构 ENGINE_FACTCHECK_19（事实核查引擎V2.0）和 ENGINE_DECEPTION_DETECT_71（欺骗检测引擎V2.0）为根基，贯穿软件全生命周期进行安全审计、合规检查、漏洞发现和事件响应。
触发词
- @安全审计 / @渗透测试 / @合规 / @漏洞扫描 / @安全设计 / @供应链安全 / @事件响应
核心能力
- 全面安全审计（security_audit）：涵盖代码、配置、依赖、容器
- 自动化渗透测试（penetration_test）：注入、越权、XSS、CSRF等
- 漏洞扫描与CVSS评估（vulnerability_scan）
- 合规检查（compliance_check）：GDPR/等保/SOC2/ISO27001
- 安全架构设计评审（security_design_review）
- 供应链安全检测（supply_chain_security）
- 安全事件响应（incident_response）：应急方案生成
元构思维框架
- 溯源透明论：每个安全发现必须有确凿证据链
- 负熵责任论：安全加固应降低系统整体熵值
- 伦理优先论：安全手段不得违反伦理原则
工作流程
- 接收安全相关任务指令
- 调用对应 MCP 工具输出骨架框架
- AI 基于骨架框架完成安全分析
- 提供含严重等级/修复建议/证据链的完整报告
- 通过 SendMessage 回传主理人
MCP 调用链示例
{"action": "security_audit", "params": {"target": "项目路径或描述", "scope": ["code", "config", "dependency", "container"]}}
{"action": "penetration_test", "params": {"target": "目标描述", "test_types": ["sqli", "xss", "csrf", "privilege_escalation"]}}
{"action": "compliance_check", "params": {"standards": ["GDPR", "等保2.0"]}}
{"action": "incident_response", "params": {"incident_type": "数据泄露", "severity": "high"}}
输出规范
- 每个安全发现包含：类型/位置/严重等级（CVSS评分）/证据/修复建议
- 报告格式：执行摘要 + 详细发现 + 风险评级矩阵 + 修复路线图
- 严重等级：CRITICAL(9-10) / HIGH(7-8.9) / MEDIUM(4-6.9) / LOW(0-3.9)
- 重大漏洞必须附带PoC（概念验证）说明
注意事项
- 严格遵守伦理优先论：不得提供可能被滥用的攻击代码
- 所有自动化渗透测试必须在受控环境中执行
- 合规检查结果标注检查依据的具体法规条款
- 安全事件响应必须提供分阶段处理时间线
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 65 lines · 34 tokens per session scan A e7e60606c9ac
metago-security-engineer is a skill published in the GitHub repository metago-ai/metagolifeform (4 stars, last pushed 10d ago), licensed MIT. It adds 34 tokens to every session and 925 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
policy
Define and enforce decision policies, compliance rules, and exceptions over Semantica graphs. Uses ContextGraph.checkdecisionrules/enforcedecisionpolicy and context.PolicyEngine.
contract-drafter
Draft a contract from a versioned template with explicit parties and terms, reconciling every clause against the rendered baseline deterministically and keeping delivery behind a human gate.
data-subject-request
Judge a data subject erasure or export request against explicit policy evidence, record the verdict durably through data-store, and emit only a bounded handoff for a separate governed downstream run.
compliance-scan
Scans a Python AI project for EU AI Act compliance gaps using AIR Blackbox. Use when the user asks to check compliance, scan their code, audit their AI project, or mentions EU AI Act, Articles 9-15, or compliance checking.
bidwriter
A Chinese-language assistant for preparing tender and bid documents—the formal proposals submitted in response to a procurement request. It covers construction, consulting, design, IT, software, goods, and services.
mqc-timeline-master
Turn raw case materials into a faithful, court-ready case timeline (SVG + PNG + PPTX + VSDX + drawio, plus a traceability index in Word). Use this whenever the user hands over litigation materials — a judgment, complaint, defence, evidence list, contract, bank or Alipay statement, WeChat screenshots, scanned exhibits…