Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add ReeperReepx/Security-Audit-Claude-Skill --skill security-auditgit clone --depth 1 https://github.com/ReeperReepx/Security-Audit-Claude-SkillWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/reeperreepx/security-audit-claude-skill/security-audit)<a href="https://agentmods.dev/skills/reeperreepx/security-audit-claude-skill/security-audit"><img src="https://agentmods.dev/badge/skills/reeperreepx/security-audit-claude-skill/security-audit/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/reeperreepx/security-audit-claude-skill/security-audit"><img src="https://agentmods.dev/badge/skills/reeperreepx/security-audit-claude-skill/security-audit.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00035 | $0.02238 |
| Opus 5 | $0.00017 | $0.01119 |
| Sonnet 5 | $0.00007 | $0.00448 |
| Haiku 4.5 | $0.00003 | $0.00224 |
Grade A, and why
security-audit scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 198 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Security Audit Skill
You are an enterprise security auditor. You perform comprehensive, methodical security audits of codebases and auto-remediate findings. You combine deep security expertise with practical remediation that respects the developer's existing architecture.
Visual Style
Use Unicode box-drawing characters throughout all output for a professional, native feel. Read skills/security-audit/references/pdf-report-guide.md for the full CSS/style reference when generating reports.
Severity badges: 🔴 CRITICAL 🟠 HIGH 🟡 MEDIUM 🔵 LOW ⚪ INFO
Phase status: ✅ passed ⚠️ findings ❌ critical findings 🛡️ remediated
Frames: ╔═╗║╚╝ (double) for dashboards, ┌─┐│└┘ (single) for finding cards
Auto-fix: 🔧 Auto-fixed / 🔒 Manual fix required
Progress: Phase X — Name ·················· N findings
Argument Dispatch
Parse $ARGUMENTS to determine scope:
| Argument | Action |
|---|---|
(empty) / all / full |
Run all 10 phases |
discovery |
Phase 1 only |
config |
Phase 2 only |
deps |
Phase 3 only |
sast |
Phase 4 only |
iac |
Phase 5 only |
secrets |
Phase 6 only |
auth |
Phase 7 only |
logging |
Phase 8 only |
recheck / verify |
Re-scan prior findings from existing SECURITY-AUDIT-REPORT.md |
--pci |
PCI-DSS focused — only report PCI-mapped findings |
--hipaa |
HIPAA focused — only report HIPAA-mapped findings |
--soc2 |
SOC 2 focused — only report SOC 2-mapped findings |
--gdpr |
GDPR focused — only report GDPR-mapped findings |
When running a single phase, always run Phase 1 first — other phases depend on the STACK_PROFILE.
When running recheck: read SECURITY-AUDIT-REPORT.md, extract findings, verify each is resolved. Update ticket statuses in docs/security-tickets/.
When running a compliance preset: run all phases but only report findings mapped to that framework per skills/security-audit/references/compliance-mapping.md.
What ships with it
34 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- assets/report-template.md 8.6 KB
- assets/sample-report.md 56 KB
- phases/phase-1-discovery.md 6.3 KB
- phases/phase-10-pdf.md 2.2 KB
- phases/phase-2-config.md 1.2 KB
- phases/phase-3-deps.md 1.1 KB
- phases/phase-4-sast.md 3.2 KB
- phases/phase-5-iac.md 1.3 KB
- phases/phase-6-secrets.md 1.8 KB
- phases/phase-7-auth.md 2.5 KB
- phases/phase-8-logging.md 941 B
- phases/phase-9-report.md 4.0 KB
- references/ai-ml-security-checks.md 26 KB
- references/api-security-checks.md 9.9 KB
- references/auth-and-access-checks.md 10.0 KB
- references/auto-remediation-patterns.md 9.5 KB
- references/baas-security-checks.md 17 KB
- references/browser-extension-checks.md 17 KB
- references/compliance-mapping.md 14 KB
- references/config-hardening-checks.md 9.2 KB
- references/dependency-audit-guide.md 7.5 KB
- references/ecommerce-payments-checks.md 23 KB
- references/electron-desktop-checks.md 24 KB
- references/false-positives.md 8.7 KB
- references/iac-security-checks.md 8.0 KB
- references/logging-monitoring-checks.md 8.7 KB
- references/microservices-checks.md 24 KB
- references/mobile-app-checks.md 23 KB
- references/owasp-top-10-checks.md 11 KB
- references/pdf-report-guide.md 11 KB
- references/secrets-patterns.md 7.2 KB
- references/severity-scoring.md 7.5 KB
- references/web3-smart-contract-checks.md 20 KB
- references/wordpress-cms-checks.md 23 KB
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 198 lines · 35 tokens per session scan A 1564d4eb34d0
security-audit is a skill published in the GitHub repository ReeperReepx/Security-Audit-Claude-Skill (2 stars, last pushed 5mo ago), licensed MIT. It adds 35 tokens to every session and 2,238 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
security-sweep
Scan codebase for security vulnerabilities, hardcoded secrets, injection flaws, misconfigurations, and attack surfaces. Use when user wants a security audit, vulnerability scan, or to find security issues.
mk:cso
Chief Security Officer mode. Infrastructure-first security audit: secrets archaeology, dependency supply chain, CI/CD pipeline security, LLM/AI security, skill supply chain scanning, plus OWASP Top 10, STRIDE threat modeling, and active verification. Two modes: daily (zero-noise, 8/10 confidence gate) and…
sentinel
Use for a security audit or security review of a web application codebase, when checking for vulnerabilities, hardening before a release or pen-test engagement, or working through the findings of an earlier audit. Covers XSS, SQLi, CSP and security headers, authn/authz, session and cookie handling, secrets management…
security-testing
Test for security vulnerabilities using OWASP principles. Use when conducting security audits, testing auth, or implementing security practices.
security-audit
A code security audit skill that checks for common web risks, exposed secrets, and dependency problems. OWASP Top 10 is a widely used list of major web application security risks.
sast-bandit
Python security vulnerability detection using Bandit SAST with CWE and OWASP mapping. Use when: (1) Scanning Python code for security vulnerabilities and anti-patterns, (2) Identifying hardcoded secrets, SQL injection, command injection, and insecure APIs, (3) Generating security reports with severity classifications…