Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/srtab/daiv/security-auditnpx skills add srtab/daiv --skill security-auditgit clone --depth 1 https://github.com/srtab/daivWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00153 | $0.01544 |
| Opus 5 | $0.00077 | $0.00772 |
| Sonnet 5 | $0.00031 | $0.00309 |
| Haiku 4.5 | $0.00015 | $0.00154 |
Grade A, and why
security-audit scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 145 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Security Audit
1. Establish Scope
Determine the audit target before proceeding:
If a pull request or merge request is referenced:
- Fetch the PR/MR to identify source and target branches using the available tools;
- Fetch the diff between branches.
- Identify any files changed adjacent to the diff that may affect security (e.g., middleware, auth decorators, shared utilities).
If a diff, file list, or code snippet is already in context: Proceed directly — no need to re-fetch.
If scope is ambiguous: Infer from conversation history. If still unclear, ask one focused scoping question before proceeding.
Scope the audit to changed code paths plus any critical adjacent components (auth layers, input boundaries, data access objects, encryption utilities).
Error Recovery
If a tool call fails, switch to an alternative tool (e.g., platform tool instead of bash git diff) and continue from where you are. Never re-invoke the skill tool to restart the audit.
2. Run the Audit
Work through each category in the checklist. For each category, note any findings before moving on. Skip categories clearly out of scope (e.g., no database code → skip SQLi).
For full detection heuristics per category, see → references/checklist.md
Checklist categories:
- Authentication & authorization (privilege boundaries, missing checks)
- Input validation & injection (SQLi, XSS, command injection, SSRF, path traversal)
- Secrets management (hardcoded tokens, credentials in logs or error messages)
- Data protection (encryption at rest/in transit, PII handling, unnecessary data retention)
- Dependency & supply-chain risks (unpinned, outdated, or suspicious packages)
- Error handling (stack traces or sensitive data in responses)
- Cryptography (weak algorithms, insecure randomness, key management)
- API security (missing auth on endpoints, CORS misconfiguration, rate limiting)
3. Apply the Signal Filter
Before writing any finding, verify it clears this bar:
What ships with it
3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 145 lines · 153 tokens per session scan A 44a4dfd5f4e7
security-audit is a skill published in the GitHub repository srtab/daiv (22 stars, last pushed 4d ago), licensed Apache-2.0. It adds 153 tokens to every session and 1,544 once invoked, about $0.0008 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
using-superpowers
Use when starting any conversation - establishes how to find and use skills, requiring Skill tool invocation before ANY response including clarifying questions.
karpathy
Coding principles for simplicity, clarity, and surgical precision. Use when you want Claude to think before coding, keep solutions minimal, make surgical changes, and define verifiable success criteria. Triggers on: karpathy mode, think before coding, simplicity first, surgical changes.
skill-creator
Create new skills, modify and improve existing skills, and measure skill performance. Use when users want to create a skill from scratch, edit, or optimize an existing skill, run evals to test a skill, benchmark skill performance with variance analysis, or optimize a skill's description for better triggering accuracy.
planning-with-files
Implements Manus-style file-based planning for complex tasks. Creates taskplan.md, findings.md, and progress.md. Use when starting complex multi-step tasks, research projects, or any task requiring >5 tool calls. Now with automatic session recovery after /clear.
frontend-design
Create distinctive, production-grade frontend interfaces with high design quality. Use this skill when the user asks to build web components, pages, or applications. Generates creative, polished code that avoids generic AI aesthetics.
data-visualization
Use for creating publication-quality charts and multi-panel analysis summaries. Triggers when tasks involve visualizing data, plotting results, creating charts, or producing visual reports from analysis output.