Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add niels-emmer/myace --skill security-audit-checklistgit clone --depth 1 https://github.com/niels-emmer/myaceWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/niels-emmer/myace/security-audit-checklist)<a href="https://agentmods.dev/skills/niels-emmer/myace/security-audit-checklist"><img src="https://agentmods.dev/badge/skills/niels-emmer/myace/security-audit-checklist/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/niels-emmer/myace/security-audit-checklist"><img src="https://agentmods.dev/badge/skills/niels-emmer/myace/security-audit-checklist.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00033 | $0.01139 |
| Opus 5 | $0.00016 | $0.00570 |
| Sonnet 5 | $0.00007 | $0.00228 |
| Haiku 4.5 | $0.00003 | $0.00114 |
Grade A, and why
Security Audit Checklist scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 65 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Purpose
Give a security review a fixed, repeatable shape so two different reviewers checking the same change produce comparable results, and so nothing gets skipped because it wasn't top of mind that day.
When to use it
Any time you're reviewing a diff, a pull request, or a codebase specifically for security issues — whether that's the security-compliance-auditor agent doing a full pass or a quick self-check before a change ships. Run through every category below; mark items N/A with a one-line reason rather than silently skipping them.
Checklist
For each item: record PASS, FAIL, or N/A. Every FAIL needs a concrete failure scenario (the specific input/state and the specific bad outcome) and, where it fits, a citation (CWE number, OWASP Top 10/ASVS category, or NIST SSDF practice).
Injection
- User-controlled input never reaches a SQL query, shell command, template engine, or log sink by string concatenation or interpolation — parameterized queries, prepared statements, or an equivalent safe API are used instead. (Maps to CWE-89, CWE-78, OWASP A03:2021 – Injection.)
- Any use of
eval, dynamic code execution, or deserialization of untrusted data is either absent or explicitly justified and sandboxed.
Authorization and authentication
- Every endpoint or handler that touches non-public data checks both that the caller is authenticated and that they're authorized for the specific resource being accessed (object-level authorization, not just route-level). (OWASP A01:2021 – Broken Access Control.)
- Session tokens, API keys, and password reset tokens are generated with a cryptographically secure random source, expire, and are invalidated on logout/rotation.
- Privilege checks happen server-side; client-supplied role/permission fields are never trusted as-is.
Secrets handling
- No credential-shaped string (API key, token, password, connection string, private key) appears in the diff, in source, in config committed to the repo, or in a log line. Any hit here is an automatic FAIL — see the
secrets-scan-checklistskill. - Secrets are loaded from an environment variable or secret-management service, not hardcoded or committed, even in test fixtures.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago Changed · +7 lines ad811661420e
- 12d ago First seen · 58 lines · 33 tokens per session scan A a86d495da67f
Security Audit Checklist is a skill published in the GitHub repository niels-emmer/myace (1 stars, last pushed 5d ago), licensed MIT. It adds 33 tokens to every session and 1,139 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
loom-code-review
Comprehensive code review covering correctness, maintainability, performance, security, and best practices.
pressure
Pressure-test a loom plan and write a review for the plan's author. Trigger when the user invokes $pressure followed by a plan path. The argument after $pressure is the plan file path.
cross-review
The writer cannot be the final judge of the work.
code-review
Perform thorough code reviews focusing on correctness, security, and maintainability.
eng
Platform-agnostic engineering agent with three modes: --plan (propose file changes for human approval AND write the per-feature todo tickets in the same pass), --build (write code from the todo tickets — the single and final build spec), --review (one adversarial whole-change review of the working diff, run by a…
ubs
Run Ultimate Bug Scanner (UBS) for code review. Use when reviewing code, checking for bugs, scanning for security issues, validating AI-generated code, or pre-commit quality checks.