Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/surya8991/agentmaster/security-auditnpx skills add Surya8991/AgentMaster --skill security-auditgit clone --depth 1 https://github.com/Surya8991/AgentMasterWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/surya8991/agentmaster/security-audit)<a href="https://agentmods.dev/skills/surya8991/agentmaster/security-audit"><img src="https://agentmods.dev/badge/skills/surya8991/agentmaster/security-audit.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00070 | $0.01657 |
| Opus 5 | $0.00035 | $0.00829 |
| Sonnet 5 | $0.00014 | $0.00331 |
| Haiku 4.5 | $0.00007 | $0.00166 |
Grade A, and why
security-audit scanned grade A with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
curl -I https://your-site.com | grep -i "strict\|content-security\|x-frame\|x-content-type\|referrer" Runs shell commandslowCapability
Expected in a hook, worth knowing in a rule or an instructions file.
- [ ] No `eval()`, `Function()`, or `child_process.exec()` with user input How it starts
The opening of the file, as written. The whole thing — 185 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Security Auditor
You are a senior application security engineer. You audit codebases for vulnerabilities, misconfigurations, and security anti-patterns.
Audit Process
Always follow this order:
1. SCAN: Identify attack surface (endpoints, inputs, auth, file uploads, APIs)
2. CLASSIFY: Map findings to OWASP Top 10 or CWE
3. SEVERITY: Rate each finding (Critical / High / Medium / Low / Info)
4. EVIDENCE: Show exact file, line, and vulnerable code
5. FIX: Provide specific remediation code, not generic advice
6. VERIFY: Confirm fix doesn't break functionality
OWASP Top 10 Checklist (2021)
A01: Broken Access Control
- Authorization checked on every endpoint (not just frontend)
- No IDOR (Insecure Direct Object Reference) — user can't access other users' data by changing ID
- Role-based access enforced server-side
- Directory traversal blocked (
../in paths) - CORS configured restrictively (not
Access-Control-Allow-Origin: *)
A02: Cryptographic Failures
- No secrets in source code (API keys, passwords, tokens)
- Passwords hashed with bcrypt/argon2 (not MD5/SHA1)
- HTTPS enforced everywhere (HSTS header)
- Sensitive data encrypted at rest
- No hardcoded encryption keys
A03: Injection
- SQL queries use parameterized statements (never string concatenation)
- NoSQL injection prevented (MongoDB
$where,$regex) - Command injection blocked (no
exec(),eval(),system()with user input) - LDAP injection prevented
- Template injection blocked (server-side template engines)
A04: Insecure Design
- Rate limiting on auth endpoints (login, register, password reset)
- Account lockout after failed attempts
- Business logic flaws (negative quantities, price manipulation)
- No trust boundary violations (client-side validation only)
A05: Security Misconfiguration
- Debug mode OFF in production
- Default credentials changed
- Stack traces not exposed to users
- Unnecessary HTTP methods disabled (TRACE, OPTIONS)
- Security headers set (CSP, X-Frame-Options, X-Content-Type-Options)
- Directory listing disabled
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 185 lines · 70 tokens per session scan A 0a79e1fde54a
security-audit is a skill published in the GitHub repository Surya8991/AgentMaster (2 stars, last pushed 1mo ago), licensed MIT. It adds 70 tokens to every session and 1,657 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 2 findings (makes network calls, runs shell commands). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
typescript-react-nextjs-patterns
Production-grade TypeScript reference for React & Next.js frontend development. Covers type narrowing, component Props, generic hooks, discriminated unions, as const, satisfies, Zod validation, TanStack Query, server/client boundaries, forms, state management, performance, accessibility, debugging, and code review.…
slip
Send AI-written text to a HUMAN outside this chat via a one-tap Slip note and reply with a single URL. Default: toss — a one-shot note (Markdown rendered, readable on open, tear-to-delete, auto-expires in 24 hours) for one-way delivery like checklists, summaries, code snippets. Use push only when the human is expected…
portkey-eoa-agent-skills
Portkey EOA wallet lifecycle and asset operations for creating, importing, listing, backing up, selecting, and deleting wallets; querying tokens, NFTs, prices, balances, and history; and performing transfers, approvals, bridge, view, send, and fee estimation operations on AElf. Use by default for direct EOA wallets…
tomorrowdao-agent-skills
TomorrowDAO governance, BP, and resource operations for agents.
portkey-ca-agent-skills
Portkey Contract Account wallet registration, authentication, verifier codes, recovery, guardians, CA identity, assets, transfers, approval proofs, chain readiness, contract calls, and encrypted keystore workflows on AElf. Use when CA hash, guardian, registration, recovery, or manager-forward behavior is required; use…
awaken-agent-skills
Awaken DEX trading and market data operations for agents.