Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add renky1025/agent-skills --skill skill-security-checkgit clone --depth 1 https://github.com/renky1025/agent-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/renky1025/agent-skills/skill-security-check)<a href="https://agentmods.dev/skills/renky1025/agent-skills/skill-security-check"><img src="https://agentmods.dev/badge/skills/renky1025/agent-skills/skill-security-check/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/renky1025/agent-skills/skill-security-check"><img src="https://agentmods.dev/badge/skills/renky1025/agent-skills/skill-security-check.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 2 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Tool Misuse · line 115 Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).Fix: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults.
- medium Privilege Escalation · line 115 Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.Fix: Avoid sudo/root unless strictly required. Prefer least-privilege patterns. If elevation is needed, document the justification and scope.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00208 | $0.02125 |
| Opus 5.5 | $0.00083 | $0.00850 |
| Sonnet 5.5 | $0.00042 | $0.00425 |
| Haiku 4.5 | $0.00021 | $0.00213 |
Grade A, and why
skill-security-check scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 124 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Skill 安装前安全检查 (Multi-Language)
Purpose
在安装一个 skill 之前，把它当作不可信代码做只读静态审查，产出一份带风险等级、最终评级和 置信度的 Markdown 报告，并给出「可以安装 / 需用户确认 / 不建议安装」的明确建议。它回答的是 "这个 skill 会不会外泄数据、越权、驻留或混淆代码"，不是"这个 skill 好不好用"。
支持语言: JavaScript/TypeScript, Python, Rust, Java, Go, C/C++, Ruby, PHP, Shell, PowerShell, Perl
When to Use
- 安装来自 GitHub、npm、PyPI、Crates.io 或其他源的第三方 skill。
- 安装社区贡献的 skill。
- 更新已安装的 skill 到新版本。
- 用户对某个 skill 的安全性有疑问，或要求"检查一下这个 skill"。
- 触发词：安全检查、安全审查、安装前检查、skill 安全、security check、security audit、 is this skill safe。
When NOT to Use
- 代码质量 / 重构审查（不涉及不可信来源）-> 交给
claude-simplify或clean-code。 - 自己正在编写、且完全可信的 skill -> 无需安装前审查；如需自查，只跑工具即可。
- 运行时防护 / 入侵检测 / 沙箱 -> 本 skill 是安装前的一次性静态审查，不是运行时安全产品。
- 非 skill 的普通依赖审计（如
npm audit场景）-> 用对应生态的工具。 - 要求执行或"试跑"目标代码来验证 -> 本 skill 只做只读静态分析，拒绝执行被检查代码。
Workflow
- 获取 skill 文件：本地路径直接读取；远程链接先下载到临时目录再扫描。
- 优先跑工具：
node <skill>/scripts/security-check.js <skill-path>。工具对目标目录执行 11 项静态扫描并写出报告。 - 人工复核：按
references/checklist.md逐项确认；工具覆盖不到或结果可疑时，用references/grep-patterns.md的 grep 定位具体代码位置。 - 判定等级：按
references/report-format.md汇总为风险等级 / 最终评级 / 置信度。 - 给出建议：明确写「可以安装 / 请先看需要用户知晓的点 / 不建议安装」，并保存报告。
Decision Rules
- 目标是本地目录 -> 直接扫描；是远程仓库/包 -> 先下载到临时目录，扫描下载结果。
- 命中第 1 项数据外泄、第 6 项权限提升、或第 5 项恶意动态执行 -> 至少 HIGH 风险，除下方 Priority 的受控声明情形外不得降级。
- 目标 skill 声明了
network_access: user-configured-origin-> 按「需要用户知晓并在人工 审查后放行」处理，不自动判 SAFE；仍须确认代码只使用用户配置的 base URL（见references/checklist.md第 1 项「网络能力声明」）。 - 命中第 7 项持久化或第 11 项浏览器会话复用 -> 通常是「需要用户知晓的点」，不是漏洞，但必须 写进报告。
- 命中第 9 项代码混淆 -> 置信度降为 LOW/MEDIUM，并在报告中标注需人工复核。
- 某项无法判定 -> 记为「需要人工确认」，不得猜测结论。
- 支持语言之外的代码 -> 明确说明未覆盖，不给出结论。
- 报告落盘位置 -> 当前目录
security-report-<skill-name>.md。
Constraints
- 只读分析，绝不执行被检查 skill 的任何代码，也不运行其安装脚本。
- 静态分析不能替代完整安全审计；报告必须写明这一限制。
- 「已声明能力」不是安全证明，只能把网络请求降级为「需要用户知晓」。
- 不得对未覆盖的语言或高度混淆代码给出确定结论。
- 报告中的 skill 名称、路径、代码位置必须来自实际扫描目标，不得编造。
Priority
- 硬阻断优先：数据外泄、权限提升、恶意动态执行 -> 不得因「已声明用途」降为 SAFE。
- 受控的已声明能力可降为「需要用户知晓」，但仅在确认代码不存在固定第三方上报端点、 隐蔽 telemetry 或跨主机重定向之后。
- 工具结果与人工判断冲突时，以人工复核为准，并把该项标为 MEDIUM + 需人工确认。
What ships with it
22 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- .gitignore 248 B
- examples/security-report-article-deconstructor.md 1.4 KB
- examples/security-report-attention-daily.md 2.0 KB
- examples/security-report-fengshuixue.md 1.4 KB
- examples/security-report-infocard.md 2.0 KB
- examples/security-report-translate-polisher.md 1.4 KB
- jest.config.js 404 B runs code
- package.json 558 B
- README.md 5.7 KB
- references/checklist.md 6.5 KB
- references/grep-patterns.md 1.3 KB
- references/report-format.md 2.7 KB
- references/six-layer-architecture.md 103 KB
- scripts/security-check.js 41 KB runs code
- scripts/security-check.test.js 2.4 KB runs code
- src/config/protected-files.ts 2.5 KB runs code
- src/config/risk-patterns.ts 4.9 KB runs code
- src/index.test.ts 99 B runs code
- src/index.ts 136 B runs code
- src/types/constants.ts 1.6 KB runs code
- src/types/index.ts 4.1 KB runs code
- tsconfig.json 508 B
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago Changed · -215 lines · +81 tokens per session ea2810b6cfeb
- 1mo ago First seen · 339 lines · 127 tokens per session scan A f0d2352cef19
skill-security-check is a skill published in the GitHub repository renky1025/agent-skills (11 stars, last pushed 15d ago), licensed MIT. It adds 208 tokens to every session and 2,125 once invoked, about $0.0008 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
edgeone skill scanner
A local static scanner that checks agent-skill files for security risks before they are installed or used. Static analysis examines files without running them.
babysit
Use when a user asks to babysit, monitor, keep checking, keep an eye on, or report when a pull request, CI run, ticket, deployment, or other changing target reaches an outcome.
rubber-duck
Adversarial "rubber duck" review that turns explaining-out-loud into a hallucination check. The main session is the PRESENTER (it did the work — a design doc, investigation, or analysis — and holds the real reasoning) and reconstructs the topic to a LISTENER — a spawned subagent pinned to a DIFFERENT-vendor model that…
project-wiki
A system for creating and maintaining a project wiki: a set of organized documents that explain a software project's plans, rules, references, and progress.
mindos-zh
A local knowledge-base assistant for storing and finding decisions, meeting notes, procedures, troubleshooting lessons, and preferences across conversations and coding agents. It works only with the MindOS knowledge base.
mindos
MindOS: local knowledge assistant & shared KB. Keeps decisions, notes, SOPs, debugging lessons, research findings, preferences across sessions/agents. Core: save notes, search KB, organize files, run workflows, review, append CSV, hand off context, distill lessons. NOT for app source or paths outside KB. Triggers…