Borrowing it
Nothing to install: this file belongs to rsalmn/ExtremeRouter. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/rsalmn/ExtremeRouter/main/.agents/skills/extreme-router-code-audit/SKILL.mdgit clone --depth 1 https://github.com/rsalmn/ExtremeRouterWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/rsalmn/extremerouter/extreme-router-code-audit)<a href="https://agentmods.dev/skills/rsalmn/extremerouter/extreme-router-code-audit"><img src="https://agentmods.dev/badge/skills/rsalmn/extremerouter/extreme-router-code-audit.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00125 | $0.01451 |
| Opus 5 | $0.00063 | $0.00726 |
| Sonnet 5 | $0.00025 | $0.00290 |
| Haiku 4.5 | $0.00013 | $0.00145 |
Grade A, and why
extreme-router-code-audit scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 103 lines — stays where its author put it; the contents beside it link to each section on GitHub.
ExtremeRouter — Critical Thinking & Mandatory Code Audit
Konteks: ExtremeRouter (alias 9Router) adalah self-hosted AI gateway, dibangun dari base 9Router sebagai starting point. Stack: Next.js 16, React 19, Node.js 20+, SQLite. Kode sudah tersedia di folder lokal — jangan cari/reference ke GitHub.
Mode Berpikir yang Wajib Dipakai
- Jangan langsung nulis kode. Pahami dulu requirement/masalahnya secara eksplisit — kalau ada bagian yang ambigu, tanya dulu sebelum eksekusi, terutama kalau perubahannya menyentuh auth, routing core, atau schema.
- Cari root cause, bukan gejala. Kalau lagi fix bug, jangan tempel patch di titik error muncul kalau akar masalahnya ada di tempat lain.
- Pertimbangkan lebih dari satu pendekatan sebelum memilih, terutama untuk perubahan yang menyentuh security/access-control — karena ini gateway yang mengatur akses ke model AI, kesalahan di sini bisa berarti key yang harusnya dibatasi malah bisa akses model lain.
- Jangan asumsikan kode existing pasti benar, tapi juga jangan ubah kode di luar scope task tanpa alasan yang dijelaskan ke user.
- Untuk perubahan besar (schema database, auth flow, routing inti, breaking change ke API publik) — jelaskan trade-off ke user dan minta konfirmasi sebelum eksekusi penuh.
Fitur Paling Kritis: Per-Key Model Access Control
- Kontrol granular model AI mana yang boleh diakses tiap API key — ini TIDAK ada di base 9Router dan jadi core value project ini.
- Setiap perubahan yang menyentuh layer routing, auth, atau middleware WAJIB dicek: apakah aturan akses per-key masih dihormati? Adakah path baru yang berpotensi bypass access control (endpoint baru yang lupa dipasangi guard yang sama)?
- Fitur target lain (belum semua selesai): Playground, Health Monitor, Circuit Breaker.
ATURAN WAJIB: Audit Setelah Setiap Perubahan Kode
Sebelum bilang "selesai" ke user, jalankan audit ini setiap kali selesai menulis, mengubah, menambah, atau refactor kode. Ini bukan opsional, dan berlaku juga untuk bug fix sekecil apapun.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 7d ago First seen · 103 lines · 125 tokens per session scan A 72e1612c1178
extreme-router-code-audit is a skill published in the GitHub repository rsalmn/ExtremeRouter (30 stars, last pushed yesterday), licensed MIT. It adds 125 tokens to every session and 1,451 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
human-review
Produce a plain-English review of the files you just edited and gate the changes behind an explicit Approve/Undo choice. Use when the Stop hook from the human-review-skill plugin asks for a review (you'll see a prompt referencing an edit log), OR when the developer's most recent message is "1", "2", "approve", or…
code-reviewer
Perform thorough code reviews — bugs, security issues, performance bottlenecks, style violations, and architectural concerns.
security-auditor
Audit code for security vulnerabilities — OWASP Top 10, injection flaws, auth issues, secrets exposure, and dependency risks.
code-review
Comprehensive code review assistant that analyzes code quality, security, and best practices.
review
Review before merge. Stage-1 spec-compliance gate, then risk-selected Stage-2 review axes from the canonical set. analyst always runs, callers can pin extra always-on axes, and explicit deep review runs the full 16-axis set. Run after /test. Do NOT invoke code-qualities-assessment, doc-accuracy, golden-principles, or…
code-qualities-assessment
Assess code maintainability through 5 foundational qualities (cohesion, coupling, encapsulation, testability, non-redundancy) with quantifiable scoring rubrics. Works at method/class/module levels across multiple languages. Produces markdown reports with remediation guidance. Use when you ask to "assess…