Borrowing it
Nothing to install: this file belongs to nifrajs/nifra. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/nifrajs/nifra/main/.claude/skills/security-checkup/SKILL.mdgit clone --depth 1 https://github.com/nifrajs/nifraWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/nifrajs/nifra/security-checkup)<a href="https://agentmods.dev/skills/nifrajs/nifra/security-checkup"><img src="https://agentmods.dev/badge/skills/nifrajs/nifra/security-checkup.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00087 | $0.00987 |
| Opus 5 | $0.00044 | $0.00494 |
| Sonnet 5 | $0.00017 | $0.00197 |
| Haiku 4.5 | $0.00009 | $0.00099 |
Grade A, and why
security-checkup scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 94 lines — stays where its author put it; the contents beside it link to each section on GitHub.
security-checkup
A deterministic security scanner. It shells out to pinned tools, normalizes their output into one
Finding schema, writes two artifacts, and exits with a contract CI can gate on. No model calls.
It complements, and does not replace, nifra's own securityBaseline() route-assurance preset:
security-checkup scans the whole repo (deps, secrets, patterns); securityBaseline() proves
per-route invariants at nifra check. Ship both.
Run it
bun .claude/skills/security-checkup/scripts/run.ts
| flag | behavior | exit |
|---|---|---|
| (default) | all probes; artifacts written | 1 if any un-suppressed finding >= high |
--fast |
deps + secrets only (pre-commit) | 1 on any un-suppressed >= high |
--report-only |
scan + write artifacts | always 0 (dashboards, never blocks) |
--strict-tools |
pinned-tool version drift is fatal | 2 on drift |
--severity <sev> |
override gate threshold (critical..info) | 1 at/above threshold |
--out <dir> |
artifact dir (default .security) |
- |
Exit codes: 0 clean / report-only, 1 findings at-or-above threshold, 2 operational failure
(unreadable repo, --strict-tools drift, malformed probe output). A crashed probe is a 2, never a
silent 0; a missing scanner prints DEGRADED: <probe> and still gates on the rest.
Probes (pinned)
| probe | tool | pin | detects |
|---|---|---|---|
| deps | osv-scanner | 2.4.0 | vulnerable dependencies |
| secrets | gitleaks | 8.30.1 | committed secrets (value never written to the artifact) |
| patterns | semgrep | 1.99.0 | taint / unsafe-API rules in rules/semgrep.yml |
| verify | bun run verify |
repo | the project gate, incl. nifra route assurance |
| outdated | bun outdated |
repo | stale deps (advisory, info) |
Update pins in scripts/probes.ts (TOOL_PINS). Drift is reported as a high finding, or fatal
under --strict-tools.
Artifacts
Written to .security/ (git-ignore it or commit it, your call):
What ships with it
7 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 94 lines · 87 tokens per session scan A 67ed9765cfc4
security-checkup is a skill published in the GitHub repository nifrajs/nifra (2 stars, last pushed 5d ago), licensed MIT. It adds 87 tokens to every session and 987 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
flywheel
Development flywheel - autonomous cycle of run, observe, fix, verify. Use for continuous development with browser automation.
veryfront
Build Veryfront apps. Use for real-time errors, route preview, HMR control, and scaffolding pages/APIs/components/AI tools.
deploy-safely
Build, test, push, deploy, and verify with rollback through Git on failure.
contribute
Onboard to veryfront-code architecture, testing, conventions, and PR process.
debug-build
Diagnose and fix build failures using structured error output.
debug-runtime
Diagnose runtime errors by connecting to dev server via MCP.