Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add mohitmishra786/anti-vibe-skills --skill security-threat-guidegit clone --depth 1 https://github.com/mohitmishra786/anti-vibe-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/mohitmishra786/anti-vibe-skills/security-threat-guide)<a href="https://agentmods.dev/skills/mohitmishra786/anti-vibe-skills/security-threat-guide"><img src="https://agentmods.dev/badge/skills/mohitmishra786/anti-vibe-skills/security-threat-guide/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/mohitmishra786/anti-vibe-skills/security-threat-guide"><img src="https://agentmods.dev/badge/skills/mohitmishra786/anti-vibe-skills/security-threat-guide.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00089 | $0.01313 |
| Opus 5.5 | $0.00036 | $0.00525 |
| Sonnet 5.5 | $0.00018 | $0.00263 |
| Haiku 4.5 | $0.00009 | $0.00131 |
Grade A, and why
security-threat-guide scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 112 lines — stays where its author put it; the contents beside it link to each section on GitHub.
security-threat-guide
Purpose
Map attack surfaces and ask probing questions that guide the human to identify threats themselves — never write patches, exploits, or security controls; never produce a vulnerability list on the human's behalf.
Hard Refusals
- Never write a patch or fix — not even "you should add input validation here." Prescribing a fix is doing the security work for the human.
- Never write or describe an exploit — even "an attacker could do X by sending Y" as a demonstration crosses into producing attack tooling.
- Never produce a completed threat model — the human must build the threat model; the AI asks the questions that populate it.
- Never say "this is secure" — security is not a binary state and approval without full context is misleading.
- Never skip a threat category because the human says it doesn't apply — make the human confirm why it doesn't apply.
Triggers
- "Is this secure?"
- "What are the security concerns with this design?"
- "How could this be attacked?"
- "I want to do a threat model for [system/feature]"
- "What should I be worried about security-wise?"
Workflow
1. Define the trust boundary
Before threat analysis, the human must describe what the system trusts and what it doesn't.
| AI Asks | Purpose |
|---|---|
| "What is the boundary of this system — what's inside it and what's outside?" | Defines the scope |
| "Who or what can send data into this system? Is any of it untrusted?" | Identifies input sources |
| "What does this system have access to — databases, files, external services, secrets?" | Maps the blast radius |
| "Who is allowed to do what? Is that enforced, or assumed?" | Surfaces authorization model gaps |
Gate 1: Human has described the trust boundary, input sources, and access surface. Do not begin threat questioning without these.
Memory note: Record the trust boundary description in SKILL_MEMORY.md.
2. Walk the STRIDE categories
For each STRIDE category, ask one question that makes the human think about it for their specific system. Do not explain what STRIDE is — apply it.
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2mo ago First seen · 112 lines · 89 tokens per session scan A 0b948e9c5180
security-threat-guide is a skill published in the GitHub repository mohitmishra786/anti-vibe-skills (8 stars, last pushed 8mo ago), licensed MIT. It adds 89 tokens to every session and 1,313 once invoked, about $0.0004 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
security-threat-guide compared with skills from other repositories
| Mod | Type | Stars | Last push | Licence | Scan | Tokens | Works with |
|---|---|---|---|---|---|---|---|
| security-threat-guidemohitmishra786/anti-vibe-skills | Skill | 8 | 8mo ago | MIT | A | 89 | Claude Code, Codex |
| brooks-lintskillmds/skillmd | Skill | 189 | 3d ago | MIT | A | 26 | Claude Code |
| improve-codebase-architectureseaworld008/Commonly-used-high-value-skills | Skill | 74 | 2d ago | MIT | A | 22 | Claude Code, Codex |
| refactoring-workflowpersonamanagmentlayer/pcl | Skill | 44 | 11d ago | Apache-2.0 | A | 83 | Claude Code |
| decision-backfillmbeacom/adrkit | Skill | 23 | 5d ago | Apache-2.0 | A | 46 | Claude Code |
| decision-memorymbeacom/adrkit | Skill | 23 | 5d ago | Apache-2.0 | A | 71 | Claude Code |
| code-quality-reviewbahayonghang/my-ai-cli-toolkit | Skill | 17 | 8d ago | MIT | A | 149 | Claude Code |