agentmods.dev

security-risk-scan

security-risk-scan is a skill for Claude Code, Codex from staruhub/CrewClaw. It costs 26 tokens per session (212 once invoked), scanned A, original, Apache-2.0.

A code-review guide for finding security risks in changes involving access, user input, secrets, permissions, network or file operations, and other sensitive actions.

In plain words
What is it for?
It is for reviewing pull requests or code changes for authentication, authorization, input checks, secret leakage, logging risks, and destructive operations.
Why use it?
It helps reviewers look beyond ordinary bugs and check whether a change could expose data, grant improper access, or trigger unsafe actions.

Skill for Claude CodeCodex

Written for no agent in particular: nothing here depends on one.

not rated 25repo +1 18d ago A scan 26 tokens original Apache-2.0

Good fit It is for reviewing pull requests or code changes for authentication, authorization, input checks, secret leakage, logging risks, and destructive operations.

Compare 6 skills from other repositories ↓
Install with agentmods
npx agentmods add skills/staruhub/crewclaw/security-risk-scan
View source ↗ staruhub/CrewClaw crewhire.fly.dev
Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent
npx skills add staruhub/CrewClaw --skill security-risk-scan
Clone the repo
git clone --depth 1 https://github.com/staruhub/CrewClaw

Made for: Claude Code, Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for security-risk-scan

README.md
[![agentmods](https://agentmods.dev/badge/skills/staruhub/crewclaw/security-risk-scan/github.svg)](https://agentmods.dev/skills/staruhub/crewclaw/security-risk-scan)
Your own site
<a href="https://agentmods.dev/skills/staruhub/crewclaw/security-risk-scan"><img src="https://agentmods.dev/badge/skills/staruhub/crewclaw/security-risk-scan/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for security-risk-scan

Your own site · 80×15
<a href="https://agentmods.dev/skills/staruhub/crewclaw/security-risk-scan"><img src="https://agentmods.dev/badge/skills/staruhub/crewclaw/security-risk-scan.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 26 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 212 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00026 $0.00212
Opus 5.5 $0.00010 $0.00085
Sonnet 5.5 $0.00005 $0.00042
Haiku 4.5 $0.00003 $0.00021

Measured 2mo ago against content hash fbf49366851d, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

security-risk-scan scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2mo ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

experts/code-review-shrimp/skills/review/security-risk-scan/SKILL.md · 38 lines

What it actually says

Security Risk Scan

Overview

Find practical security risks introduced by a change.

When to Use

Use when a PR touches auth, user input, network calls, file access, tokens, payments, admin actions, or deployment logic.

Workflow

  1. Map trust boundaries.
  2. Check authentication and authorization.
  3. Check validation and output encoding.
  4. Search for secret leakage.
  5. Identify destructive or irreversible actions.

Common Pitfalls

  • Do not claim exploitability without evidence.
  • Do not request tokens for read-only review.
  • Do not ignore logs that may leak user data.

Verification Checklist

  • Auth and input validation were considered.
  • Secret patterns were checked.
  • High-risk actions require human confirmation.
Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2mo ago First seen · 38 lines · 26 tokens per session scan A fbf49366851d

Subscribe to this mod's changes

security-risk-scan is a skill published in the GitHub repository staruhub/CrewClaw (25 stars, last pushed 18d ago), licensed Apache-2.0. It adds 26 tokens to every session and 212 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Code reviewLLMSecurityagent-frameworkai-agentsai-employeedeveloper-toolslocal-first
Related

security-risk-scan compared with skills from other repositories

security-risk-scan next to 6 skills from other repositories
ModTypeStarsLast pushLicenceScanTokensWorks with
security-risk-scanstaruhub/CrewClawSkill2518d agoApache-2.0A26Claude Code, Codex
pro-pptjin-bo/agentaoSkill3112d agoMITA204Claude Code, Codex
zootopia-pptjin-bo/agentaoSkill3112d agoMITA152Claude Code, Codex
kanban-tasksjin-bo/agentaoSkill3112d agoMITA221Claude Code, Codex
flint-chart-authorjin-bo/agentaoSkill3112d agoMITA197Claude Code, Codex
ocrjin-bo/agentaoSkill3112d agoMITA99Claude Code, Codex
daily-digestjin-bo/agentaoSkill3112d agoMITA18Claude Code, Codex