Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add Ozzeron/prompt-pack --skill security-reviewgit clone --depth 1 https://github.com/Ozzeron/prompt-packWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/ozzeron/prompt-pack/security-review)<a href="https://agentmods.dev/skills/ozzeron/prompt-pack/security-review"><img src="https://agentmods.dev/badge/skills/ozzeron/prompt-pack/security-review/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/ozzeron/prompt-pack/security-review"><img src="https://agentmods.dev/badge/skills/ozzeron/prompt-pack/security-review.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 3 findings, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Excessive Agency · line 152 Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.Fix: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
- medium Excessive Agency · line 153 Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.Fix: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
- low Excessive Agency · line 72 Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.Fix: Limit the skill's scope to its documented purpose. Remove instructions that enable the agent to perform actions outside its stated functionality.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00086 | $0.02613 |
| Opus 5 | $0.00043 | $0.01307 |
| Sonnet 5 | $0.00017 | $0.00523 |
| Haiku 4.5 | $0.00009 | $0.00261 |
Grade A, and why
security-review scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Runs shell commandslowCapability
Expected in a hook, worth knowing in a rule or an instructions file.
- Patterns worth grepping: `eval\(`, `exec\(`, `dangerouslySetInnerHTML`, `innerHTML\s*=`, `JSON\.parse.*req\.`, `\.query\(.*\+`, `child_process`, `shell.*true`, `allowedOrigins.*\*`, `localStorage.*token`, `console\.log How it starts
The opening of the file, as written. The whole thing — 186 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Security Auditor
You audit web application code, configuration, and auth flows for exploitable vulnerabilities and weak security posture. You run as a dedicated security pass — separate from correctness or maintainability review — with fresh eyes focused entirely on attack surface. You are not a penetration tester and you do not threat-model entire systems; you read code that's about to merge and find things that will hurt if deployed.
When to use
- After a code-review pass is already done or running in parallel — this skill covers the orthogonal security dimension
- Before merging auth changes, file upload handlers, input-parsing logic, or any endpoint that touches user data
- When a PR changes dependency versions, access-control logic, or environment/config handling
- On a full module or repo section if security was previously neglected and a baseline is needed
- When a new data-handling feature is added (new user input path, new external integration, new admin action)
Scope
In scope:
- Source code diffs and targeted module reads
- Auth and session logic
- Input handling and output encoding
- API endpoint security (routes, middleware ordering, authz checks)
- Secrets and sensitive data handling
- Dependency security (package.json, requirements.txt, lock files, audit output)
- Security-relevant config (CORS, CSP, cookie flags, security headers)
- File upload handling
- Frontend code touching user data or third-party scripts
Out of scope:
- Full penetration testing or exploit development
- Threat modeling workshops or architecture reviews
- Enterprise compliance frameworks (SOC2, ISO 27001, HIPAA) — those need dedicated specialists
- Infrastructure-level security (firewall rules, VPC config) unless config files are in the repo
- Generating security test payloads or running active scans
- Reviewing code outside the stated scope just because it's in the repo
Inherits
meta/engineering-principles— grounds security findings in practical engineering trade-offs, not theoretical perfectionmeta/token-discipline— prevents unbounded repo scanning; keeps review scoped to what was actually changed
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago Changed · -111 lines · +61 tokens per session 65b0b93d8c78
- 9d ago First seen · 297 lines · 25 tokens per session scan A 248387a2feaa
security-review is a skill published in the GitHub repository Ozzeron/prompt-pack (8 stars, last pushed 4d ago), licensed MIT. It adds 86 tokens to every session and 2,613 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 1 finding (runs shell commands). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
gentle-ai-collab-perfect
Trigger: contributing to Gentleman-Programming/gentle-ai as an external collaborator. Strict issue-first workflow, honest PR bodies, contributor-vs-maintainer scope, chained-PR strategy, verification protocol, docstring coverage. Load whenever the active repo is Gentleman-Programming/gentle-ai and any part of the…
issue-creation
Trigger: issue creation, bug reports, feature requests, or issue approval. Create and triage GitHub issues from repository evidence.
sdd-tasks
Break an SDD change into implementation tasks. Trigger: orchestrator launches task planning for a change.
work-unit-commits
Plan commits as reviewable work units. Trigger: implementation, commit splitting, chained PRs, or keeping tests and docs with code.
systemic-issue-triage
Trigger: new issue, bug report, triage, backlog, issue flood, community report, root cause, dead-end, blocked user. Attack issues by root class, never one-by-one; fixes must shrink the system, not grow it.
sdd-research
Trigger: SDD research, external evidence, source-backed research. Produce auditable evidence for a selected research lane.