security-alert

security-alert is a skill for Claude Code from opendatahub-io/ai-helpers. It costs 93 tokens per session (1,892 once invoked), scanned A, original, Apache-2.0.

A filter for Hacker News stories that may describe software supply-chain threats affecting Red Hat systems, Python packages, or JavaScript and TypeScript packages.

In plain words
What is it for?
It helps review candidate Hacker News stories and write the relevant findings to a report file.
Why use it?
It reduces a broad news list to security stories relevant to the ecosystems you work with.

Skill for Claude Code

Written for Claude Code: allowed-tools in frontmatter.

Part of the odh-security plugin — 2 skills shipped together

Good fit It helps review candidate Hacker News stories and write the relevant findings to a report file.

Compare 6 skills from other repositories ↓
Install with agentmods
npx agentmods add skills/opendatahub-io/ai-helpers/security-alert
Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent
npx skills add opendatahub-io/ai-helpers --skill security-alert
Clone the repo
git clone --depth 1 https://github.com/opendatahub-io/ai-helpers

Made for: Claude Code.

Or install odh-security, the plugin that ships this one along with the rest of its 2 skills.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for security-alert

README.md
[![agentmods](https://agentmods.dev/badge/skills/opendatahub-io/ai-helpers/security-alert/github.svg)](https://agentmods.dev/skills/opendatahub-io/ai-helpers/security-alert)
Your own site
<a href="https://agentmods.dev/skills/opendatahub-io/ai-helpers/security-alert"><img src="https://agentmods.dev/badge/skills/opendatahub-io/ai-helpers/security-alert/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for security-alert

Your own site · 80×15
<a href="https://agentmods.dev/skills/opendatahub-io/ai-helpers/security-alert"><img src="https://agentmods.dev/badge/skills/opendatahub-io/ai-helpers/security-alert.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 93 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 1,892 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 1 finding. A grade says what 26 rules found in the file — not that it is safe. Third-party audits
  • NVIDIA SkillSpector pass 7 Sept 2026
How audits are shown
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00093 $0.01892
Opus 5 $0.00046 $0.00946
Sonnet 5 $0.00019 $0.00378
Haiku 4.5 $0.00009 $0.00189

Measured 7d ago against content hash 2472b06db816, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-10, from the pricing page.

Security

Grade A, and why

security-alert scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

allowed-tools: Bash(curl:https://hn.algolia.com/*) Read Write
plugins/odh-security/skills/security-alert/SKILL.md · 221 lines

How it starts

The opening of the file, as written. The whole thing — 221 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Security Alert: Developer Supply-Chain Threat Filter

Read a set of Hacker News stories and decide which ones are worth alerting on — meaning they plausibly report a supply-chain threat that affects the Red Hat / RHEL ecosystem, Python, or JavaScript/TypeScript. Write those stories to findings.json.

The pipeline controls when this skill runs and has already built the candidate story list. The scope here is semantic analysis only — do not re-fetch or reorder the candidate list, manage state, check registries, or post to Slack. Fetching individual HN thread detail via the Algolia items API is permitted up to the cap in Step 2.

Run the steps below in order. At any early-exit point, stop and take no further action.


Step 1: Read candidate stories

Read stories.json from the workspace:

if [ ! -f stories.json ]; then
  echo '[]' > findings.json
  exit 0
fi
cat stories.json

Each story in the array has:

Field Description
id HN item ID (string)
title Story headline
url Linked article URL, or HN thread URL if no external link
hn_url Direct HN thread link

If the array is empty, stop here and write an empty findings array to findings.json.


Step 2: Filter each story

Apply two independent tests to each story. A story must pass both to be included. This is a judgment call — do not rely on keyword matching alone.


Test A — Ecosystem relevance (scope gate)

The story must directly involve one of these ecosystems:

Python

  • PyPI packages, pip, pipenv, Poetry, conda, or any Python-specific tooling or runtime
  • Python-language libraries, frameworks, or build tools (e.g. setuptools, wheel, twine)

JavaScript / TypeScript

  • npm, yarn, pnpm, Bun, Deno, or any JS/TS package registry or runtime
  • Node.js tooling, bundlers (webpack, Vite, Rollup, esbuild), or JS/TS-language libraries and frameworks

Red Hat / RHEL ecosystem

  • RHEL, Fedora, CentOS Stream, or RPM-based package repositories (dnf, rpm, COPR, official Red Hat repos)
  • Red Hat products and platforms: OpenShift, OKD, Ansible, Ansible Galaxy/Automation Hub, Quay.io, Podman, Buildah, RHACS, Satellite, Insights, or any registry.redhat.io / registry.access.redhat.com image
  • Red Hat developer tooling: CodeReady, Developer Hub, RHDH, RHEL AI, InstructLab, or official Red Hat SDKs

Read the full file on GitHub · 221 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 7d ago First seen · 221 lines · 93 tokens per session scan A 2472b06db816

Subscribe to this mod's changes

security-alert is a skill published in the GitHub repository opendatahub-io/ai-helpers (37 stars, last pushed 3d ago), licensed Apache-2.0. It adds 93 tokens to every session and 1,892 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.

Related

Other skills, from other repositories

nft-standards

Implement NFT standards (ERC-721, ERC-1155) with proper metadata handling, minting strategies, and marketplace integration. Use when creating NFT contracts, building NFT marketplaces, or implementing digital asset systems.

wshobson/agents · 48 tokens

spark-training-gotchas

Preflight and diagnose the ten known failure modes for ML training on NVIDIA DGX Spark. Use when a training run on DGX Spark fails to start, OOMs below the 128GB limit, slows down mid-run, or before any multi-hour training job on GB10.

wshobson/agents · 63 tokens

parallel-feature-development

Coordinate parallel feature development with file ownership strategies, conflict avoidance rules, and integration patterns for multi-agent implementation. Use this skill when decomposing a large feature into independent work streams, when two or more agents need to implement different layers of the same system…

wshobson/agents · 105 tokens

kpi-dashboard-design

Design effective KPI dashboards with metrics selection, visualization best practices, and real-time monitoring patterns. Use this skill when building an executive SaaS metrics dashboard tracking MRR, churn, and LTV/CAC ratios; designing an operations center with live service health and request throughput; creating a…

wshobson/agents · 85 tokens

cost-optimization

Optimize cloud costs across AWS, Azure, GCP, and OCI through resource rightsizing, tagging strategies, reserved instances, and spending analysis. Use when reducing cloud expenses, analyzing infrastructure costs, or implementing cost governance policies.

wshobson/agents · 48 tokens

temporal-python-testing

Test Temporal workflows with pytest, time-skipping, and mocking strategies. Covers unit testing, integration testing, replay testing, and local development setup. Use when implementing Temporal workflow tests or debugging test failures.

wshobson/agents · 45 tokens