Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add ratnesh-maurya/cursor-claude-personas --skill security-scanning-security-dependenciesgit clone --depth 1 https://github.com/ratnesh-maurya/cursor-claude-personasWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/ratnesh-maurya/cursor-claude-personas/security-scanning-security-dependencies)<a href="https://agentmods.dev/skills/ratnesh-maurya/cursor-claude-personas/security-scanning-security-dependencies"><img src="https://agentmods.dev/badge/skills/ratnesh-maurya/cursor-claude-personas/security-scanning-security-dependencies/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/ratnesh-maurya/cursor-claude-personas/security-scanning-security-dependencies"><img src="https://agentmods.dev/badge/skills/ratnesh-maurya/cursor-claude-personas/security-scanning-security-dependencies.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00038 | $0.00341 |
| Opus 5 | $0.00019 | $0.00170 |
| Sonnet 5 | $0.00008 | $0.00068 |
| Haiku 4.5 | $0.00004 | $0.00034 |
Grade A, and why
security-scanning-security-dependencies scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
Dependency Vulnerability Scanning
You are a security expert specializing in dependency vulnerability analysis, SBOM generation, and supply chain security. Scan project dependencies across multiple ecosystems to identify vulnerabilities, assess risks, and provide automated remediation strategies.
Use this skill when
- Auditing dependencies for vulnerabilities or license risks
- Generating SBOMs for compliance or supply chain visibility
- Planning remediation for outdated or vulnerable packages
- Standardizing dependency scanning across ecosystems
Do not use this skill when
- You only need runtime security testing
- There is no dependency manifest or lockfile
- The environment blocks running security scanners
Context
The user needs comprehensive dependency security analysis to identify vulnerable packages, outdated dependencies, and license compliance issues. Focus on multi-ecosystem support, vulnerability database integration, SBOM generation, and automated remediation using modern 2024/2025 tools.
Requirements
$ARGUMENTS
Instructions
- Clarify goals, constraints, and required inputs.
- Apply relevant best practices and validate outcomes.
- Provide actionable steps and verification.
- If detailed examples are required, open
resources/implementation-playbook.md.
Safety
- Avoid running auto-fix or upgrade steps without approval.
- Treat dependency changes as release-impacting and test accordingly.
Resources
resources/implementation-playbook.mdfor detailed patterns and examples.
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 47 lines · 38 tokens per session scan A fc375a7cdb43
security-scanning-security-dependencies is a skill published in the GitHub repository ratnesh-maurya/cursor-claude-personas (8 stars, last pushed 5mo ago), licensed MIT. It adds 38 tokens to every session and 341 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
requirements-authoring
To author, update, and validate functional/non-functional requirements as atomic units with user approval.
ijfw-plan
Use when the user says 'plan this', 'plan it', 'make a plan', 'let's plan', 'draft a plan', 'how should we tackle this', 'break this down', or invokes '/ijfw-plan'. Produces a falsifiable PLAN.md (software, book, campaign, design, research) with task breakdown, dependency wave-table, and success criteria — gated by…
hitl
Rosetta CRITICAL MUST skill to load as Prep Step 3 Step 2 — immediately after orchestrator-contract, right before loading any workflow. Loads the session-wide approval-gate protocol governing when to stop and wait vs proceed. WITHOUT IT decisions proceed silently, violating enterprise policy. Activate it for ALL tasks…
research
To run systematic deep research via meta-prompting — grounded references, incremental tracking, self-validation.
nextauth
NextAuth.js authentication for Next.js. Covers providers, sessions, and callbacks. Use for Next.js authentication. USE WHEN: user mentions "NextAuth", "Next.js auth", "Auth.js", asks about "Next.js authentication", "App Router auth", "next-auth", "authentication providers" DO NOT USE FOR: generic OAuth (use oauth2…
git-workflow
Git workflow best practices. Covers branching, commits, and collaboration. Use for version control guidance. USE WHEN: user mentions "git", "commit", "branch", "pull request", "PR", "merge", "rebase", "version control", asks about "commit message", "branching strategy", "git best practices", "conventional commits"…