Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add opendatahub-io/ai-helpers --skill security-alertgit clone --depth 1 https://github.com/opendatahub-io/ai-helpersWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/opendatahub-io/ai-helpers/security-alert)<a href="https://agentmods.dev/skills/opendatahub-io/ai-helpers/security-alert"><img src="https://agentmods.dev/badge/skills/opendatahub-io/ai-helpers/security-alert/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/opendatahub-io/ai-helpers/security-alert"><img src="https://agentmods.dev/badge/skills/opendatahub-io/ai-helpers/security-alert.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00093 | $0.01892 |
| Opus 5 | $0.00046 | $0.00946 |
| Sonnet 5 | $0.00019 | $0.00378 |
| Haiku 4.5 | $0.00009 | $0.00189 |
Grade A, and why
security-alert scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
allowed-tools: Bash(curl:https://hn.algolia.com/*) Read Write How it starts
The opening of the file, as written. The whole thing — 221 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Security Alert: Developer Supply-Chain Threat Filter
Read a set of Hacker News stories and decide which ones are worth alerting on
— meaning they plausibly report a supply-chain threat that affects the Red
Hat / RHEL ecosystem, Python, or JavaScript/TypeScript. Write those stories
to findings.json.
The pipeline controls when this skill runs and has already built the candidate story list. The scope here is semantic analysis only — do not re-fetch or reorder the candidate list, manage state, check registries, or post to Slack. Fetching individual HN thread detail via the Algolia items API is permitted up to the cap in Step 2.
Run the steps below in order. At any early-exit point, stop and take no further action.
Step 1: Read candidate stories
Read stories.json from the workspace:
if [ ! -f stories.json ]; then
echo '[]' > findings.json
exit 0
fi
cat stories.json
Each story in the array has:
| Field | Description |
|---|---|
id |
HN item ID (string) |
title |
Story headline |
url |
Linked article URL, or HN thread URL if no external link |
hn_url |
Direct HN thread link |
If the array is empty, stop here and write an empty findings array to
findings.json.
Step 2: Filter each story
Apply two independent tests to each story. A story must pass both to be included. This is a judgment call — do not rely on keyword matching alone.
Test A — Ecosystem relevance (scope gate)
The story must directly involve one of these ecosystems:
Python
- PyPI packages, pip, pipenv, Poetry, conda, or any Python-specific tooling or runtime
- Python-language libraries, frameworks, or build tools (e.g. setuptools, wheel, twine)
JavaScript / TypeScript
- npm, yarn, pnpm, Bun, Deno, or any JS/TS package registry or runtime
- Node.js tooling, bundlers (webpack, Vite, Rollup, esbuild), or JS/TS-language libraries and frameworks
Red Hat / RHEL ecosystem
- RHEL, Fedora, CentOS Stream, or RPM-based package repositories (dnf, rpm, COPR, official Red Hat repos)
- Red Hat products and platforms: OpenShift, OKD, Ansible, Ansible
Galaxy/Automation Hub, Quay.io, Podman, Buildah, RHACS, Satellite,
Insights, or any
registry.redhat.io/registry.access.redhat.comimage - Red Hat developer tooling: CodeReady, Developer Hub, RHDH, RHEL AI, InstructLab, or official Red Hat SDKs
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 7d ago First seen · 221 lines · 93 tokens per session scan A 2472b06db816
security-alert is a skill published in the GitHub repository opendatahub-io/ai-helpers (37 stars, last pushed 3d ago), licensed Apache-2.0. It adds 93 tokens to every session and 1,892 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
nft-standards
Implement NFT standards (ERC-721, ERC-1155) with proper metadata handling, minting strategies, and marketplace integration. Use when creating NFT contracts, building NFT marketplaces, or implementing digital asset systems.
spark-training-gotchas
Preflight and diagnose the ten known failure modes for ML training on NVIDIA DGX Spark. Use when a training run on DGX Spark fails to start, OOMs below the 128GB limit, slows down mid-run, or before any multi-hour training job on GB10.
parallel-feature-development
Coordinate parallel feature development with file ownership strategies, conflict avoidance rules, and integration patterns for multi-agent implementation. Use this skill when decomposing a large feature into independent work streams, when two or more agents need to implement different layers of the same system…
kpi-dashboard-design
Design effective KPI dashboards with metrics selection, visualization best practices, and real-time monitoring patterns. Use this skill when building an executive SaaS metrics dashboard tracking MRR, churn, and LTV/CAC ratios; designing an operations center with live service health and request throughput; creating a…
cost-optimization
Optimize cloud costs across AWS, Azure, GCP, and OCI through resource rightsizing, tagging strategies, reserved instances, and spending analysis. Use when reducing cloud expenses, analyzing infrastructure costs, or implementing cost governance policies.
temporal-python-testing
Test Temporal workflows with pytest, time-skipping, and mocking strategies. Covers unit testing, integration testing, replay testing, and local development setup. Use when implementing Temporal workflow tests or debugging test failures.