Borrowing it
Nothing to install: this file belongs to shenjingnan/haimen. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/shenjingnan/haimen/main/.agents/skills/security-audit/SKILL.mdgit clone --depth 1 https://github.com/shenjingnan/haimenWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/shenjingnan/haimen/security-audit)<a href="https://agentmods.dev/skills/shenjingnan/haimen/security-audit"><img src="https://agentmods.dev/badge/skills/shenjingnan/haimen/security-audit/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/shenjingnan/haimen/security-audit"><img src="https://agentmods.dev/badge/skills/shenjingnan/haimen/security-audit.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00018 | $0.00436 |
| Opus 5 | $0.00009 | $0.00218 |
| Sonnet 5 | $0.00004 | $0.00087 |
| Haiku 4.5 | $0.00002 | $0.00044 |
Grade A, and why
security-audit scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
安全审计
上下文获取
以下命令将在技能加载时自动执行，结果将注入到上下文中供分析：
- 安全审计结果: !
bash .agents/skills/security-audit/scripts/run-security-audit.sh
你的任务
根据上方注入的审计结果，按以下步骤处理：
1. 分析结果
逐项检查每个检查项的输出，判断是否存在安全问题：
- cargo audit — 检查 Cargo.lock 中已知漏洞的依赖
- cargo deny check — 检查许可协议合规性和依赖安全性
2. 修复漏洞
如果发现漏洞或过时依赖，对每个问题包依次处理：
-
尝试自动修复：
cargo update或手动更新到最新兼容版本：
cargo update -p <包名> -
验证：运行
cargo check && cargo test -- --test-threads=1 -
验证失败则回滚：
git checkout -- Cargo.toml Cargo.lock
3. 最终验证
修复完成后，确认所有检查通过：
cargo fmt --check && cargo clippy -- -D warnings && cargo test -- --test-threads=1
前置条件
cargo install cargo-audit # 漏洞扫描
cargo install cargo-deny # 许可/依赖检查
原则
- 优先通过
cargo update自动修复，无法修复时手动指定版本 - 升级后必须通过测试验证
- 如果某个漏洞无法通过升级修复，考虑在
deny.toml中配置豁免（需确认风险可接受）
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 65 lines · 18 tokens per session scan A 6f3e6f044145
security-audit is a skill published in the GitHub repository shenjingnan/haimen (7 stars, last pushed yesterday), licensed MIT. It adds 18 tokens to every session and 436 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
dd-code-generation
Use pup CLI for immediate Datadog operations or generate code for integration into applications.
omh-rust
This is a Hermes-native rust workflow skill.
bevy-ecs
Structure a Bevy app around its Entity Component System: build the App with plugins, define Component/Resource types, write systems with Query/Res/Commands, filter and order systems, and use the Time resource for frame-rate-independent motion. Use when building or debugging a Bevy game in Rust — when the user mentions…
rust-project
Modern Rust project architecture guide for 2025. Use when creating Rust projects (CLI, web services, libraries). Covers workspace structure, error handling, async patterns, and idiomatic Rust best practices.
gcs-rust-download-object-api
Fix "DownloadObjectRequest not found" error in google-cloud-storage Rust crate. Use when: (1) Trying to download objects from GCS using the Rust SDK, (2) Looking for a download request type in http::objects::download module, (3) Compile error about missing type. The downloadobject method uses GetObjectRequest from the…
azure-keyvault-secrets-rust
Client library for Azure Key Vault Secrets — secure storage for passwords, API keys, and other secrets.