Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add Pixel-Process-UG/superkit-agents --skill security-reviewgit clone --depth 1 https://github.com/Pixel-Process-UG/superkit-agentsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/pixel-process-ug/superkit-agents/security-review)<a href="https://agentmods.dev/skills/pixel-process-ug/superkit-agents/security-review"><img src="https://agentmods.dev/badge/skills/pixel-process-ug/superkit-agents/security-review/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/pixel-process-ug/superkit-agents/security-review"><img src="https://agentmods.dev/badge/skills/pixel-process-ug/superkit-agents/security-review.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00057 | $0.02389 |
| Opus 5.5 | $0.00023 | $0.00956 |
| Sonnet 5.5 | $0.00011 | $0.00478 |
| Haiku 4.5 | $0.00006 | $0.00239 |
Grade A, and why
security-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 266 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Security Review
Overview
Systematically review code for security vulnerabilities, apply secure coding patterns, and ensure applications follow defense-in-depth principles. This skill covers the OWASP Top 10, authentication pattern selection, input validation, secrets management, dependency auditing, security headers, and threat modeling.
Announce at start: "I'm using the security-review skill to assess security posture."
Phase 1: Scope and Threat Assessment
Goal: Identify the attack surface and prioritize review areas.
Actions
- Identify all user-facing endpoints and input surfaces
- Map authentication and authorization boundaries
- List external dependencies and their trust levels
- Identify sensitive data flows (PII, credentials, payment)
- Determine compliance requirements (SOC 2, GDPR, HIPAA)
STOP — Do NOT proceed to Phase 2 until:
- Attack surface is mapped
- Sensitive data flows are identified
- Compliance requirements are known
Phase 2: OWASP Top 10 Audit
Goal: Systematically check against each OWASP category.
OWASP Top 10 Checklist (2021)
| # | Category | Key Check | Pass/Fail |
|---|---|---|---|
| 1 | Broken Access Control | Authorization verified on every endpoint, deny by default | |
| 2 | Cryptographic Failures | No plaintext secrets, strong algorithms (AES-256, bcrypt) | |
| 3 | Injection | Parameterized queries, no string concatenation for SQL/commands | |
| 4 | Insecure Design | Threat model exists, rate limiting, abuse cases considered | |
| 5 | Security Misconfiguration | No defaults in production, minimal permissions, error messages leak nothing | |
| 6 | Vulnerable Components | Dependencies audited, no known CVEs, update policy in place | |
| 7 | Auth Failures | MFA available, passwords hashed, session management secure | |
| 8 | Data Integrity Failures | Verify signatures, validate CI/CD pipeline integrity | |
| 9 | Logging Failures | Log auth events, access control failures, input validation failures | |
| 10 | SSRF | Validate/allowlist URLs, no internal network access from user input |
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 266 lines · 57 tokens per session scan A 08952acbbdd8
security-review is a skill published in the GitHub repository Pixel-Process-UG/superkit-agents (3 stars, last pushed 7mo ago), licensed MIT. It adds 57 tokens to every session and 2,389 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
idea-refine
Refines raw ideas into sharp, actionable concepts through structured divergent and convergent thinking. Use when an idea is still vague, when you need to stress-test assumptions before committing to a plan, or when you want to expand options before converging on one. Triggers on "ideate", "refine this idea", or…
chinese-git-workflow
A reference for configuring Git with Chinese code-hosting services such as Gitee, Coding.net, GitLab China, and CNB, including SSH, HTTPS, credentials, CI, and repository mirroring.
chinese-documentation
A Chinese technical-documentation style guide covering spacing, punctuation, numbers, terminology, and links when Chinese and English appear together.
create-slack-app
Use when a developer wants to create, scaffold, or bootstrap a new Slack app or agent from scratch with the Slack CLI. Covers prerequisites, authentication, choosing a workspace to install into, and creating a project from a Bolt (JS or Python) template locally. Trigger on "create a Slack app", "new Bolt app", "start…
subagent-driven-development
A development workflow in which a fresh coding agent implements each independent task, another review checks that task, and a final review examines the complete set of changes.
music
A tool for creating and working with music using Mureka, an AI music service. It handles new songs, instrumental tracks, remixes, extensions, and audio analysis.