Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add Phaedra-Solutions/cursor-rules --skill security-auditgit clone --depth 1 https://github.com/Phaedra-Solutions/cursor-rulesWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/phaedra-solutions/cursor-rules/security-audit)<a href="https://agentmods.dev/skills/phaedra-solutions/cursor-rules/security-audit"><img src="https://agentmods.dev/badge/skills/phaedra-solutions/cursor-rules/security-audit/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/phaedra-solutions/cursor-rules/security-audit"><img src="https://agentmods.dev/badge/skills/phaedra-solutions/cursor-rules/security-audit.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00071 | $0.02225 |
| Opus 5.5 | $0.00028 | $0.00890 |
| Sonnet 5.5 | $0.00014 | $0.00445 |
| Haiku 4.5 | $0.00007 | $0.00222 |
Grade B, and why
security-audit scanned grade B with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Downloads and executes remote codemediumSupply chain
curl | sh runs whatever the server returns today, which is not necessarily what it returned when this was reviewed.
- Never install a tool without asking, and never with `curl … | sh`. Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
curl -s https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json \ How it starts
The opening of the file, as written. The whole thing — 138 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Security audit
When to use
- The user asks for a security audit, vulnerability scan or dependency check.
- Before a release, or after a new advisory that may affect the stack.
- After
core/supply-chainor a stack rule flags an outdated or vulnerable dependency.
For a single package lookup use cve-check. For a new dependency use dependency-vet. For suspected malware or a compromised package, stop and use incident-supply-chain.
Before you start
-
Confirm the scope with the user: whole repo or a path; dependencies only, or also code, secrets, containers and CI.
-
The scanners query public advisory databases over the network. Ask before running them if the project is sensitive or the user hasn't approved network use.
-
Run the detector from this skill's folder. It is read-only and prints what applies:
sh <skill-dir>/scripts/detect-stack.sh <project-dir> -
For every tool marked NOT INSTALLED, ask before installing it, and install only from the official source.
osv-scanneralone covers most lockfiles, so offer it first. -
Don't run anything that changes dependencies during the audit:
npm audit fix,pnpm audit --fix,osv-scanner fix,cargo audit fix,pip-audit --fix.
Steps
-
Detect. Run the detector. Note each directory with a lockfile; run the dependency scanners in each one. Record the versions of the runtime and main frameworks.
-
Scan dependencies. Prefer JSON output so you can triage accurately:
Ecosystem Command Any lockfile or SBOM osv-scanner scan source -r --format json .npm npm audit --jsonandnpm audit signaturespnpm pnpm audit --jsonYarn 2+ / Yarn 1 yarn npm audit --all --recursive --json/yarn audit --jsonBun bun audit --jsonPython (uv) uv audit(uv ≥ 0.10.12)Python (pip) pip-audit -r requirements.txt -f jsonGo govulncheck -format json ./...Rust cargo audit --json,cargo deny check advisoriesPHP composer audit --format=jsonRuby bundle-audit check --update --format json.NET dotnet package list --vulnerable --include-transitive --format json(SDK 10+);dotnet list package --vulnerable --include-transitive(SDK ≤ 9)Java, Kotlin, Dart osv-scanner scan source -r .
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 138 lines · 71 tokens per session scan B 266da70074d5
security-audit is a skill published in the GitHub repository Phaedra-Solutions/cursor-rules (4 stars, last pushed 2d ago), licensed MIT. It adds 71 tokens to every session and 2,225 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it B with 2 findings (downloads and executes remote code, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-11-01.
Other skills, from other repositories
deployment-patterns
Deployment workflows, CI/CD pipeline patterns, Docker containerization, health checks, rollback strategies, and production readiness checklists for web applications.
deployment
Use when taking an app from source to live: choosing the deploy target from requirements (Hetzner+Coolify vs Vercel vs a third), then wiring container → CI → registry → host with build secrets, healthchecks and rollback. NOT one platform's mechanics (that is coolify, vercel, railway, render), NOT the Dockerfile alone…
agent-devops-engineer
Skill "agent-devops-engineer" from travisjneuman/.claude, covering devops engineer agent, capabilities, cloud platforms, infrastructure as code and container orchestration.
devops
Comprehensive DevOps engineering practices for Kubernetes, CI/CD, Bash scripting, Ansible, and cloud infrastructure.
operating-infra
Author, inspect, troubleshoot, review, and apply (after explicit confirmation) infrastructure across IaC, Kubernetes, cloud resources, containers, CI/CD, and Linux hosts. Use when changing Terraform/OpenTofu, Kubernetes, Helm, Kustomize, Dockerfiles, GitHub Actions workflow/job/permissions semantics, AWS, GCP, Cloud…
mlops-automation
Automate an MLOps project with mise tasks, lefthook hooks, Docker images, GitHub Actions, and MLflow tracking on a SQL backend. Use when adding a task runner, git hooks, CI/CD, or experiment tracking to a working package.