Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add swDomass/AI_orchestrator --skill deep-security-auditgit clone --depth 1 https://github.com/swDomass/AI_orchestratorWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/swdomass/ai_orchestrator/deep-security-audit)<a href="https://agentmods.dev/skills/swdomass/ai_orchestrator/deep-security-audit"><img src="https://agentmods.dev/badge/skills/swdomass/ai_orchestrator/deep-security-audit/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/swdomass/ai_orchestrator/deep-security-audit"><img src="https://agentmods.dev/badge/skills/swdomass/ai_orchestrator/deep-security-audit.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00041 | $0.00548 |
| Opus 5 | $0.00020 | $0.00274 |
| Sonnet 5 | $0.00008 | $0.00110 |
| Haiku 4.5 | $0.00004 | $0.00055 |
Grade A, and why
deep-security-audit scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
System Prompt Addition
You are executing a multi-agent deep security audit with 6 specialized expert perspectives followed by a CISO synthesis.
Phase 1–6 — Expert Agent Scans (read-only, each ~30 min):
- Penetration Tester: Exploit chains, injection, path traversal, auth bypass, privilege escalation, SSRF, deserialization, race conditions, credential theft, DoS.
- Security Architect: Trust boundaries, data flow analysis, auth/authz model, defense-in-depth gaps, threat model completeness, failure modes, blast radius.
- Code Auditor (SAST): OWASP Top 10, CWE mapping, injection flaws, broken access control, crypto failures, security misconfiguration, unsafe deserialization — line-by-line with file:line references.
- Supply Chain Analyst: Dependency audit (pinning, CVEs), lock files, dynamic imports, external CLI tools (PATH hijacking), build/CI pipeline, third-party API integrations, transitive dependencies.
- Data & Privacy Analyst: Secrets management, credential exposure, PII handling, data at rest/in transit, logging & retention, data leakage vectors.
- Forensics / IR Specialist: Audit trail completeness, log integrity & tamper resistance, anomaly detection, incident response readiness, recovery & continuity, evidence preservation.
Phase 7 — CISO Synthesis: Cross-validate findings across all 6 experts. Deduplicate. Build multi-step attack chains. Assign final CRITICAL/HIGH/MEDIUM/LOW severity. Create prioritized remediation roadmap (Immediate / Short-term / Medium-term). Note dissenting opinions.
Phase 8 — Fix Implementation (optional, skip with #no-fix):
Implement fixes in severity order (CRITICAL → HIGH → MEDIUM).
Run test suite after all fixes. Note manual actions required.
Each finding must include: file:line, CWE (if applicable), attack vector, evidence, fix, confidence.
Output report to docs/deep-security-audit-YYYYMMDD-HHMMSS.md.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 39 lines · 41 tokens per session scan A 0562cb697be9
deep-security-audit is a skill published in the GitHub repository swDomass/AI_orchestrator (5 stars, last pushed 3d ago), licensed MIT. It adds 41 tokens to every session and 548 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
pr
Use when reviewing an incoming GitHub pull request — runs the multi-level (L1-L5) audit against the PR's real diff range, posts findings as one batched review (inline, summary, or local-only), offers the standard fix chain on NEEDSFIX, and optionally merges. The maintainer-side counterpart to /hyperflow:issue. Trigger…
audit
Use when the user wants a code review on recent changes — quality, spec, security, or performance feedback. Triggers a multi-level (L1-L5) review with a standalone Reviewer; on NEEDSFIX, offers to apply findings via /hyperflow:plan. Trigger with /hyperflow:audit, "review this change", "review my PR", "audit the diff"…
trace
Use when encountering bugs, test failures, runtime errors, broken builds, or "this doesn't work" reports. Systematic root-cause analysis before any patch — never blind-patches symptoms. Standalone, ends with a final-integration review of the fix. Trigger with /hyperflow:trace, "debug this", "find the root cause", "why…
implementing-github-advanced-security-for-code-scanning
Configure GitHub Advanced Security with CodeQL to perform automated static analysis and vulnerability detection across repositories at enterprise scale.
issue
Use when starting a chain from a GitHub issue — turning an issue URL or number into a triaged, planned, dispatched, and reviewed pull request. Classifies the thread (bug → root-cause discipline, feature → plan chain, question → drafted reply), synthesizes a spec from the issue's own acceptance criteria, then runs the…
loop-converge
Author and optionally direct-launch a two-node loop-graph run whose North Star is code convergence — delete unused code, merge duplicates, reuse, slim. Use when the user invokes /loop-converge, or asks to loop on dead code, duplication, unused exports, DRY cleanup, or merging twin implementations. Starts the owner…