Borrowing it
Nothing to install: this file belongs to rsalmn/ExtremeRouter. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/rsalmn/ExtremeRouter/main/.agents/skills/extreme-router-code-audit/SKILL.mdgit clone --depth 1 https://github.com/rsalmn/ExtremeRouterWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/rsalmn/extremerouter/extreme-router-code-audit)<a href="https://agentmods.dev/skills/rsalmn/extremerouter/extreme-router-code-audit"><img src="https://agentmods.dev/badge/skills/rsalmn/extremerouter/extreme-router-code-audit/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/rsalmn/extremerouter/extreme-router-code-audit"><img src="https://agentmods.dev/badge/skills/rsalmn/extremerouter/extreme-router-code-audit.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00125 | $0.01451 |
| Opus 5.5 | $0.00050 | $0.00580 |
| Sonnet 5.5 | $0.00025 | $0.00290 |
| Haiku 4.5 | $0.00013 | $0.00145 |
Grade A, and why
extreme-router-code-audit scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 103 lines — stays where its author put it; the contents beside it link to each section on GitHub.
ExtremeRouter — Critical Thinking & Mandatory Code Audit
Konteks: ExtremeRouter (alias 9Router) adalah self-hosted AI gateway, dibangun dari base 9Router sebagai starting point. Stack: Next.js 16, React 19, Node.js 20+, SQLite. Kode sudah tersedia di folder lokal — jangan cari/reference ke GitHub.
Mode Berpikir yang Wajib Dipakai
- Jangan langsung nulis kode. Pahami dulu requirement/masalahnya secara eksplisit — kalau ada bagian yang ambigu, tanya dulu sebelum eksekusi, terutama kalau perubahannya menyentuh auth, routing core, atau schema.
- Cari root cause, bukan gejala. Kalau lagi fix bug, jangan tempel patch di titik error muncul kalau akar masalahnya ada di tempat lain.
- Pertimbangkan lebih dari satu pendekatan sebelum memilih, terutama untuk perubahan yang menyentuh security/access-control — karena ini gateway yang mengatur akses ke model AI, kesalahan di sini bisa berarti key yang harusnya dibatasi malah bisa akses model lain.
- Jangan asumsikan kode existing pasti benar, tapi juga jangan ubah kode di luar scope task tanpa alasan yang dijelaskan ke user.
- Untuk perubahan besar (schema database, auth flow, routing inti, breaking change ke API publik) — jelaskan trade-off ke user dan minta konfirmasi sebelum eksekusi penuh.
Fitur Paling Kritis: Per-Key Model Access Control
- Kontrol granular model AI mana yang boleh diakses tiap API key — ini TIDAK ada di base 9Router dan jadi core value project ini.
- Setiap perubahan yang menyentuh layer routing, auth, atau middleware WAJIB dicek: apakah aturan akses per-key masih dihormati? Adakah path baru yang berpotensi bypass access control (endpoint baru yang lupa dipasangi guard yang sama)?
- Fitur target lain (belum semua selesai): Playground, Health Monitor, Circuit Breaker.
ATURAN WAJIB: Audit Setelah Setiap Perubahan Kode
Sebelum bilang "selesai" ke user, jalankan audit ini setiap kali selesai menulis, mengubah, menambah, atau refactor kode. Ini bukan opsional, dan berlaku juga untuk bug fix sekecil apapun.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2mo ago First seen · 103 lines · 125 tokens per session scan A 72e1612c1178
extreme-router-code-audit is a skill published in the GitHub repository rsalmn/ExtremeRouter (49 stars, last pushed 1mo ago), licensed MIT. It adds 125 tokens to every session and 1,451 once invoked, about $0.0005 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
human-review
Produce a plain-English review of the files you just edited and gate the changes behind an explicit Approve/Undo choice. Use when the Stop hook from the human-review-skill plugin asks for a review (you'll see a prompt referencing an edit log), OR when the developer's most recent message is "1", "2", "approve", or…
code-reviewer
Perform thorough code reviews — bugs, security issues, performance bottlenecks, style violations, and architectural concerns.
security-auditor
Audit code for security vulnerabilities — OWASP Top 10, injection flaws, auth issues, secrets exposure, and dependency risks.
code-review
Comprehensive code review assistant that analyzes code quality, security, and best practices.
implement-audit
Adversarial review of freshly-built code — find what was missed, what's inconsistent, what breaks. The single code reviewer for the loop. Auto-fired by /implement (phase-4.7); standalone-callable after any substantial change. Writes an implement-audit: line into the report.
spec-audit
Adversarial pre-review of any freshly-written or materially-rewritten SPEC or spec folder, running reviewer consensus (correctness) plus the spirit-check agent (fidelity to the user's verbatim ask — spec.md's Input and Clarifications, or a single-file SPEC's § 0 / § 0a — and to the behavior contract) in one pass and…