Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add subinium/vibesubin --skill audit-securitygit clone --depth 1 https://github.com/subinium/vibesubinWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/subinium/vibesubin/audit-security)<a href="https://agentmods.dev/skills/subinium/vibesubin/audit-security"><img src="https://agentmods.dev/badge/skills/subinium/vibesubin/audit-security.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00078 | $0.06158 |
| Opus 5 | $0.00039 | $0.03079 |
| Sonnet 5 | $0.00016 | $0.01232 |
| Haiku 4.5 | $0.00008 | $0.00616 |
Grade B, and why
audit-security scanned grade B with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Reaches for credential filesmediumPrivilege escalation
SSH keys, cloud credentials, git-credentials, .npmrc, /etc/shadow: reading these is how a config file becomes a credential leak.
- SSH keys: revoke the compromised public key from `~/.ssh/authorized_keys` on every server, generate a new keypair Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.
Runs shell commandslowCapability
Expected in a hook, worth knowing in a rule or an instructions file.
- `subprocess.run(..., shell=True)` How it starts
The opening of the file, as written. The whole thing — 404 lines — stays where its author put it; the contents beside it link to each section on GitHub.
audit-security
A security audit that the operator will actually read.
Enterprise scanners emit hundreds of warnings. Non-developers silence them within a week and then a real vulnerability slips through because nobody's reading anymore. The opposite strategy works better: a short, hand-curated list of patterns that are almost always actionable, each one triaged individually. Every hit gets classified. Every classification has a reason.
The rule
Never report more than ~20 findings. If the automated sweep returns 100 hits, triage them into categories and report the categories, not the raw list. The operator's attention is the scarcest resource and the wrong optimization is "comprehensive."
When to trigger
Any of:
- "is this safe"
- "security check" / "security audit"
- "are there any vulnerabilities"
- "any secrets leaked"
- "is my
.envexposed" - "OWASP"
- before a public release or open-sourcing
- after a major refactor (run together with
refactor-verify) - when the operator mentions a data breach, incident, or scare
If the operator asks for something outside this skill's scope (compliance audits, penetration testing, crypto review), say so plainly and suggest a specialist tool.
Upfront constraint lock-in
Before running, establish three things with the operator. Do not start the sweep until these are clear:
- Scope — the whole repo, one directory, one file, or one PR diff?
- Severity threshold — report everything found, or only HIGH/CRITICAL?
- Runtime context — is this code behind an authenticated endpoint, public, internal tool, or CLI? The same pattern is a different severity depending on context.
If the operator doesn't know the answers, pick the most conservative defaults: whole repo, report all, assume public-facing. Tell them that's what you picked.
State assumptions — before acting
Before starting the procedure, write an explicit Assumptions block. Don't pick silently between interpretations; surface the choice. If any assumption is wrong or ambiguous, pause and ask — do not proceed on a guess.
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 404 lines · 78 tokens per session scan B 215d4a889a07
audit-security is a skill published in the GitHub repository subinium/vibesubin (50 stars, last pushed 4mo ago), licensed MIT. It adds 78 tokens to every session and 6,158 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it B with 2 findings (reaches for credential files, runs shell commands). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
neo-iso-27701
Use this skill when the user needs to establish, review, or improve an ISO/IEC 27701 PIMS, inventory PII processing, analyze controller and processor responsibilities, create a privacy risk or evidence matrix, conduct a gap analysis, prepare for an audit, or create an improvement plan. Use neo-iso-27001 when the main…
neo-stop-slop
Use this skill when the user wants to polish, rewrite, shorten, or review prose so it sounds natural rather than AI-generated. Trigger for Traditional Chinese or English drafts, rough notes, source material, articles, technical docs, code comments, commit messages, PR descriptions, sales copy, or requests to remove AI…
neo-azure-pipelines
Use this skill when the user asks to create, review, debug, or modernize Azure Pipelines YAML for CI/CD, especially .NET builds, Azure App Service deploys, or IIS/on-premises deploys. Prefer bundled templates and verify task syntax against Microsoft docs when version-specific accuracy matters.
neo-clean-architecture
Use this skill when the user wants to design, implement, review, or refactor software systems conforming to Clean Architecture principles. It structures code into Domain, Application, Infrastructure, and Presentation/API layers, enforcing inward-only dependencies. It advocates rich domain models, CQRS, and the Result…
neo-code-review
Use this skill when the user asks to review or audit source code, a PR, diff, commit, or recent changes for bugs, security, performance, tests, compatibility, or maintainability, duplicated code or logic across files, or hard-coded values. Also use it after an AI agent finishes modifying code to inspect the current…
neo-iso-27001
Use this skill when the user needs to establish, review, or improve an ISO/IEC 27001 ISMS, perform information security risk discovery, define scope, create an evidence matrix, conduct a gap analysis, draft a Statement of Applicability, prepare for an internal audit, or create an improvement plan. Use neo-iso-27701…