Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/mturac/hermes-supercode-skills/security-sentinelnpx skills add mturac/hermes-supercode-skills --skill security-sentinelgit clone --depth 1 https://github.com/mturac/hermes-supercode-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/mturac/hermes-supercode-skills/security-sentinel)<a href="https://agentmods.dev/skills/mturac/hermes-supercode-skills/security-sentinel"><img src="https://agentmods.dev/badge/skills/mturac/hermes-supercode-skills/security-sentinel.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00146 | $0.01583 |
| Opus 5 | $0.00073 | $0.00792 |
| Sonnet 5 | $0.00029 | $0.00317 |
| Haiku 4.5 | $0.00015 | $0.00158 |
Grade A, and why
security-sentinel scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
curl -sI https://example.com How it starts
The opening of the file, as written. The whole thing — 207 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Security Sentinel
You are a security assessment specialist. You work within strict ethical boundaries: only authorized targets, only proportionate techniques, and always responsible disclosure of findings. Your goal is to help the user understand and improve their security posture, not to demonstrate exploits.
Authorization — Required Before Any Active Scanning
Before running any active scan (port scans, vulnerability scanners, or anything that sends probes to a target), confirm:
- Does the user own or have written authorization for this target? Ask explicitly. Do not assume.
- Is the scope clear? What domains, IPs, and services are in scope? What is explicitly excluded?
- Are there third-party concerns? Shared hosting, CDN edge servers, and managed services may have their own acceptable use policies.
Passive reconnaissance (DNS lookups, WHOIS, checking public headers) does not require authorization — these use only publicly available information.
Workflow
1. Scope Definition
Target: example.com
Authorization: confirmed by user (owner)
Scope:
included:
- example.com (web application)
- *.example.com (subdomains)
- DNS configuration
- SSL/TLS configuration
- Email security (SPF/DKIM/DMARC)
excluded:
- Third-party CDN infrastructure
- Payment processor endpoints
2. Passive Reconnaissance
These checks are safe and do not require authorization:
# DNS records — full picture
dig example.com ANY +noall +answer
dig example.com TXT # SPF, DKIM, DMARC
dig example.com MX # Mail routing
dig example.com CAA # Certificate authority restrictions
# WHOIS — registration and contact
whois example.com | head -40
# HTTP headers — technology and security headers
curl -sI https://example.com
# Check for common security headers:
# Strict-Transport-Security, Content-Security-Policy,
# X-Content-Type-Options, X-Frame-Options, Referrer-Policy
3. Active Scanning (Requires Authorization)
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 207 lines · 146 tokens per session scan A 9df48586ad81
security-sentinel is a skill published in the GitHub repository mturac/hermes-supercode-skills (2 stars, last pushed 3mo ago), licensed MIT. It adds 146 tokens to every session and 1,583 once invoked, about $0.0007 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
swift-networking
Builds a protocol-based async/await networking layer with URLSession, testable abstractions, error handling, and mock support for Swift projects. Use when user says "add networking", "create an API layer", "fetch data from API", "build a network service", "add URLSession", "implement HTTP requests", "create a REST…
swift-architecture-audit
Audits an existing Swift/SwiftUI/UIKit codebase for MVVM compliance, testability issues, architectural violations, concurrency problems, and anti-patterns. Use when user says "audit the codebase", "review the architecture", "why is this hard to test", "onboard to this project", "analyze the code structure", "find…
swift-code-review
Reviews Swift, SwiftUI, and UIKit code for MVVM compliance, testing standards, naming conventions, async correctness, and anti-patterns. Produces structured feedback grouped by severity. Use when user says "review this code", "check this PR", "code review", "is this correct", "give me feedback on", "review my…
swiftui-component
Creates SwiftUI views and screens following MVVM with thin view layers, ViewModel extraction, previews, accessibility support, and loading/error states. Use when user says "create a SwiftUI view", "build a screen", "add a new view", "create a component", "build the UI for", "add a SwiftUI screen", or "make a new…
swift-persistence
Implements a persistence layer using SwiftData or CoreData following MVVM — models, repository abstraction, and testable in-memory setup. Use when user says "add CoreData", "set up SwiftData", "persist data", "save to database", "add a data model", "create Core Data entities", or "use SwiftData models".
swift-project-setup
Bootstraps a new Swift/SwiftUI/UIKit project with MVVM architecture, standard folder structure, testing targets, and CLAUDE.md configuration. Use when user says "create a new project", "setup a new app", "start a new iOS project", "scaffold a Swift project", "initialize an Xcode project", or "new SwiftUI app".