Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add racastellanosm/agent-skills --skill secops-scannergit clone --depth 1 https://github.com/racastellanosm/agent-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/racastellanosm/agent-skills/secops-scanner)<a href="https://agentmods.dev/skills/racastellanosm/agent-skills/secops-scanner"><img src="https://agentmods.dev/badge/skills/racastellanosm/agent-skills/secops-scanner/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/racastellanosm/agent-skills/secops-scanner"><img src="https://agentmods.dev/badge/skills/racastellanosm/agent-skills/secops-scanner.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00115 | $0.01399 |
| Opus 5.5 | $0.00046 | $0.00560 |
| Sonnet 5.5 | $0.00023 | $0.00280 |
| Haiku 4.5 | $0.00012 | $0.00140 |
Grade A, and why
secops-scanner scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 99 lines — stays where its author put it; the contents beside it link to each section on GitHub.
SecOps Scanner & Security Audit Skill (100% Dockerized)
This skill guides AI agents and engineers to execute comprehensive, multi-layered security audits across any software repository following the Zero Host Dependencies philosophy:
🛡️ Zero Host Dependencies Invariant:
The host machine requires only Docker.
All security scanners (SAST, SCA, IaC, Container Image, and Secret Detection) MUST execute inside isolated, ephemeral containers mounting the project in read-only mode (:ro). Zero local language runtimes, Python/Node CLIs, or host binaries are required.
🧭 Core Audit Pipeline (5 Security Pillars)
[ 1. SAST ] ➔ [ 2. SCA / OSV ] ➔ [ 3. IaC & Images ] ➔ [ 4. Secrets ] ➔ [ 5. Code Review & Report ]
(Semgrep) (OSV-Scanner) (Aqua Trivy) (Gitleaks) (SECURITY-AUDIT-REPORT.md)
When the user requests a security audit (or specific scan layer), execute the corresponding ephemeral Docker containers from the project root (prefixing with rtk if available on the host):
1. SAST — Static Application Security Testing (Semgrep)
Auto-detects project languages (TypeScript, JavaScript, React, Python, Go, PHP, Rust, Java) and scans source code against OWASP Top 10 and security rulesets:
docker run --rm --pull=always -v "$(pwd):/src:ro" semgrep/semgrep:latest semgrep scan --config=auto --quiet /src
2. SCA — Dependency & Lockfile Vulnerability Scanning (Google OSV-Scanner)
Scans all lockfiles (bun.lock, package-lock.json, pnpm-lock.yaml, yarn.lock, go.mod, Cargo.lock, requirements.txt, poetry.lock, composer.lock) against the Google Open Source Vulnerabilities (OSV.dev) database:
docker run --rm --pull=always -v "$(pwd):/src:ro" ghcr.io/google/osv-scanner:latest scan source -r /src
3. IaC & Container Security (Aqua Trivy)
- 3A. Dockerfile, Compose & IaC Misconfigurations:
docker run --rm --pull=always -v "$(pwd):/src:ro" aquasec/trivy:latest config --severity HIGH,CRITICAL,MEDIUM /src - 3B. Built Container Image CVE Scan (when inspecting local images):
docker run --rm --pull=always -v /var/run/docker.sock:/var/run/docker.sock aquasec/trivy:latest image --severity HIGH,CRITICAL "<image-name:tag>"
What ships with it
5 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 99 lines · 115 tokens per session scan A 1c0f205d3356
secops-scanner is a skill published in the GitHub repository racastellanosm/agent-skills (1 stars, last pushed 2d ago), licensed MIT. It adds 115 tokens to every session and 1,399 once invoked, about $0.0005 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-18.
Other skills, from other repositories
aos-fatos
Skill para buscar e comentar as checagens de fatos mais recentes do portal Aos Fatos (aosfatos.org), filtrando por selo de veracidade (verdadeiro, falso, não é bem assim), formato de conteúdo, ano e/ou canal temático — combináveis entre si (ex: formato + ano + selo) — ou a partir da descrição livre de algo que a…
gerador-soul
Gera um arquivo SOUL.md completo e estruturado para qualquer agente ou assistente de IA. Use esta skill SEMPRE que a pessoa usuária quiser criar um SOUL.md, definir a identidade de um agente, descrever a "alma" de um assistente, ou usar os gatilhos "/soul", "/soul.md" ou "gerar soul". Ative também quando a pessoa…
image-to-gif
Anima elementos de uma imagem enviada (setas tracejadas andando, setas piscando no sentido em que apontam, cards se iluminando, destaques) e entrega um arquivo GIF em loop infinito, preservando o resto da imagem pixel a pixel. Opcionalmente traduz os textos da imagem antes de animar. Use sempre que a pessoa enviar uma…
craque-neto
Faz análise de risco de projetos gritando a real, sem bajulação, no tom de voz do ex-jogador José Ferreira Neto, o 'Craque Neto', apresentador do 'Donos da Bola' (Band) e da 'Rádio Craque Neto'. A resposta é só a bronca do Neto: texto corrido de até 200 palavras, primeira pessoa, linguagem do povo, palavrão pesado…
eeat-audit
Audita textos ou URLs de posts publicados segundo os parâmetros de E-E-A-T (Experience, Expertise, Authoritativeness, Trustworthiness) do Google e atribui uma nota de 0 a 5 a cada pilar, com nota global ponderada. Use esta skill SEMPRE que a pessoa usuária pedir para auditar, avaliar, analisar ou revisar um texto ou…
extrair-imagens
Extrai as imagens e demais mídias incorporadas (pasta ppt/media) de apresentações do Google Slides (link ou atalho .gslides) ou de arquivos PowerPoint (.pptx, .pptm, .ppsx, .potx) enviados na conversa, e entrega a pasta media pronta para uso. Use esta skill SEMPRE que a pessoa usuária pedir para extrair, baixar…