Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/rexleimo/aios/security-scannpx skills add rexleimo/aios --skill security-scangit clone --depth 1 https://github.com/rexleimo/aiosWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00031 | $0.00537 |
| Opus 5 | $0.00015 | $0.00269 |
| Sonnet 5 | $0.00006 | $0.00107 |
| Haiku 4.5 | $0.00003 | $0.00054 |
Grade B, and why
security-scan scanned grade B with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Downloads and executes remote codemediumSupply chain
curl | sh runs whatever the server returns today, which is not necessarily what it returned when this was reviewed.
- Avoid `curl | bash`, silent error suppression, and untrusted string interpolation. Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
- Avoid `curl | bash`, silent error suppression, and untrusted string interpolation. What it actually says
Security Scan
Trigger
Use this skill when:
- Onboarding a new repo with agent automation enabled
- Editing skills, hooks, MCP config, or client settings
- Before publishing/releasing changes that affect other projects
Mandatory Privacy Rule (No Bypass)
- For config-like files that may contain keys/tokens/passwords, do not read raw file content directly.
- Always read through Privacy Guard first:
aios privacy read --file <path>(preferred)- or
node scripts/privacy-guard.mjs read --file <path>
- If Privacy Guard reports guard-disabled for sensitive files, enable it first:
aios privacy enable
Quick Path
- Ensure strict mode is on:
aios privacy enforce-on - Run the repo verifier:
aios doctor(preferred when shell integration is installed). - Or run:
scripts/doctor-security-config.sh/scripts/doctor-security-config.ps1.
What To Check (Minimum)
-
Secrets
- No API keys/tokens/cookies committed to git.
- Prefer env vars + local-only config files ignored by git.
- Use Privacy Guard read output when inspection is required.
- If scanning finds secrets, rotate them, then remove from history if needed.
-
Tool/permission scope
- Avoid wildcard allowlists (when the client supports allow/deny config).
- Prefer least-privilege tool access and explicit denies for destructive actions.
-
Hooks safety
- Avoid
curl | bash, silent error suppression, and untrusted string interpolation. - Treat any network egress from hooks as high risk; make it opt-in.
- Avoid
-
MCP / supply chain
- Prefer pinned versions and explicit installs over ad-hoc
npxexecution. - Review MCP servers for network + filesystem access and log behavior.
- Prefer pinned versions and explicit installs over ad-hoc
Output Discipline
- Never paste secret values into chat logs or commits.
- Capture only redacted findings + exact file paths and remediation steps.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 58 lines · 31 tokens per session scan B 84f756aaf1ce
security-scan is a skill published in the GitHub repository rexleimo/aios (52 stars, last pushed 4d ago), licensed MIT. It adds 31 tokens to every session and 537 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it B with 2 findings (downloads and executes remote code, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
arxiv
Standardized arXiv skill for MediaUse. Includes Windows install, key onboarding, strict context/auth flow, full arXiv dynamic command map, and safety/rate controls.
douyinv2
Standardized douyinv2 skill for MediaUse. Includes Windows install, key onboarding, strict context/auth flow, full douyinv2 dynamic command map, and safety/rate controls.
Use when handling MediaUse LinkedIn automation tasks, including jobs and people search, timeline and inbox retrieval, profile reads, safe connect/message flows, and Sales Navigator workflows, with Windows install, key onboarding, strict context/auth flow, full dynamic command map, and safety/rate controls.
Standardized Reddit skill for MediaUse. Includes Windows install, key onboarding, strict context/auth flow, full Reddit dynamic command map, and safety/rate controls.
Standardized Twitter/X skill for MediaUse. Includes Windows install, key onboarding, strict context/auth flow, full Twitter/X dynamic command map, and safety/rate controls.
xiaohongshu
Standardized Xiaohongshu skill for MediaUse. Includes Windows install, key onboarding, strict context/auth flow, full Xiaohongshu dynamic command map, and safety/rate controls.