Anything Analyzer is a protocol-analysis toolkit that captures traffic from browsers, desktop and terminal programs, scripts, mobile devices, and other equipment, then uses AI to analyze the resulting requests. It combines browser capture, MITM proxying, JavaScript hooks, fingerprint spoofing, and MCP integration so AI agents and IDEs can inspect APIs, encryption, security issues, and service calls. The catalogue skills expose these capture and analysis workflows to agent tools.
Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add Mouseww/anything-analyzer --skill code-auditgit clone --depth 1 https://github.com/Mouseww/anything-analyzerWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/mouseww/anything-analyzer/code-audit)<a href="https://agentmods.dev/skills/mouseww/anything-analyzer/code-audit"><img src="https://agentmods.dev/badge/skills/mouseww/anything-analyzer/code-audit/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/mouseww/anything-analyzer/code-audit"><img src="https://agentmods.dev/badge/skills/mouseww/anything-analyzer/code-audit.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00031 | $0.00676 |
| Opus 5.5 | $0.00012 | $0.00270 |
| Sonnet 5.5 | $0.00006 | $0.00135 |
| Haiku 4.5 | $0.00003 | $0.00068 |
Grade A, and why
code-audit scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
This is a copy
100% identical to code-audit — 0 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.
What it actually says
Source Code Security Audit
ACTION REQUIRED（读完后立刻执行）
NOW: 读取../field-journal/precedent-pentest.md或代码审计授权NOW: 确认有源码/仓库访问（无源码二进制 → 转 RE skill）NOW: 明确语言栈与范围（目录/服务/PR diff）NEXT: tool-index；semgrep 等ACT: 威胁建模草图 → 自动扫描 → 人工验证
适用场景
- 白盒审计、PR/差分安全审查
- Semgrep / CodeQL / Bandit / gosec 等 SAST
- 危险 API、注入点、鉴权缺失、加密误用
- 与
supply-chain-security/分工：本 skill 偏自有代码逻辑，供应链偏依赖与管道
工作流
1. 范围与威胁模型
□ 信任边界：用户输入、文件、反序列化、SSRF、鉴权中间件
□ 高价值资产：鉴权、支付、管理端、密钥处理
2. 自动扫描
semgrep --config auto .
# 或项目规则包
semgrep --config p/owasp-top-ten .
3. 人工验证（MUST）
□ 每个 SAST 命中：可达性？可利用性？误报？
□ 鉴权：IDOR/越权、缺校验、错误的多租户隔离
□ 注入：SQL/命令/模板/LDAP
□ 加密：硬编码密钥、ECB、自定义 crypto
4. 产出
Finding：位置 + 数据流 + PoC + 修复建议
可选 ATT&CK / CWE 编号
工具链
| 工具 | 语言/场景 |
|---|---|
| Semgrep | 多语言快速规则 |
| CodeQL | 深数据流（GitHub） |
| Bandit | Python |
| gosec / staticcheck | Go |
| SpotBugs / FindSecBugs | Java |
参考
references/sast-review-checklist.md../supply-chain-security/../api-security/../llm-security/（Agent 代码）
路由上下文
上游: MASTER R26
角色: ops/role-map.md cae
下游: 依赖漏洞 → supply-chain；运行时验证 → pentest-tools
任务完成自检
- 是否人工验证而非只贴扫描器输出？
- 是否含修复建议？
- 是否限定在授权仓库范围？
- Checklist？
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 82 lines · 31 tokens per session scan A 122dafd86828
code-audit is a skill published in the GitHub repository Mouseww/anything-analyzer (3,775 stars, last pushed 10d ago), licensed Apache-2.0. It adds 31 tokens to every session and 676 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. It is 100% identical to code-audit, differing in 0 lines, and is treated as a copy.
Other skills, from other repositories
tuicr
Use tuicr's review CLI to read and add comments in active TUI review sessions, and launch tuicr in cmux, tmux, Zellij, or Herdr when a user needs an interactive review pane.
liveagent-code-review
Review an open GitHub pull request or the current local branch and working tree with parallel, independent reviewers and evidence-based validation. Use when the user asks for code review, invokes the Code Review action from Git Review, or explicitly mentions this skill.
omh-image-cards
This is an OMH img-summary workflow skill, projected for Agent Skills hosts (Claude Code, Codex, Cursor, opencode, OpenClaw, pi).
omh-verification-gate
This is an OMH verification-gate workflow skill, projected for Agent Skills hosts (Claude Code, Codex, Cursor, opencode, OpenClaw, pi).
omh-ai-slop-cleaner
This is an OMH ai-slop-cleaner workflow skill, projected for Agent Skills hosts (Claude Code, Codex, Cursor, opencode, OpenClaw, pi).
omh-code-review
This is an OMH code-review workflow skill, projected for Agent Skills hosts (Claude Code, Codex, Cursor, opencode, OpenClaw, pi).