Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add tanviet12/vbsec --skill vbs-scan-securitygit clone --depth 1 https://github.com/tanviet12/vbsecWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/tanviet12/vbsec/vbs-scan-security)<a href="https://agentmods.dev/skills/tanviet12/vbsec/vbs-scan-security"><img src="https://agentmods.dev/badge/skills/tanviet12/vbsec/vbs-scan-security/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/tanviet12/vbsec/vbs-scan-security"><img src="https://agentmods.dev/badge/skills/tanviet12/vbsec/vbs-scan-security.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Data Exfiltration · line 126 Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.Fix: Remove unnecessary filesystem scanning. If file access is needed, use explicit, scoped paths. Avoid reading ~/.ssh, ~/.aws, or credential directories.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00105 | $0.06242 |
| Opus 5.5 | $0.00042 | $0.02497 |
| Sonnet 5.5 | $0.00021 | $0.01248 |
| Haiku 4.5 | $0.00011 | $0.00624 |
Grade B, and why
vbs-scan-security scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 22d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Recursive force deletemediumDestructive command
rm -rf with a variable or a broad path is one typo away from removing the wrong tree.
**Scan root:** nếu `Scan root` khác `.` (scope `commit id`, `pr id`), mọi lần đọc/grep file phải đọc tại `$SCAN_ROOT/<path>`. Đó là snapshot đúng commit/PR; KHÔNG đọc bản trong thư mục hiện tại (có thể đang ở branch khác Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.
How it starts
The opening of the file, as written. The whole thing — 419 lines — stays where its author put it; the contents beside it link to each section on GitHub.
vbsec — Security Scanner cho Vibe Coders (Antigravity variant)
Quét lỗ hổng bảo mật cho code do AI sinh ra (vibe code). Bộ skill này check 21 lỗi bảo mật phổ biến nhất của vibe code, kế thừa kiến trúc SMALL/LARGE mode, tổng quát hóa cross-language + chuyên sâu cho Go/PHP/Python/TypeScript/.NET.
Public repo: https://github.com/tanviet12/vbsec License: MIT Platform: Google Antigravity. Phiên bản Claude Code spawn parallel sub-agents; phiên bản này dùng sequential chunking để giữ portability — chậm hơn ~3× nhưng output identical.
Invocation
Trong Antigravity Agent Manager chat box:
- Auto-trigger: nói tự nhiên — "scan security cho repo này", "kiểm tra bảo mật", "audit security". Antigravity tự match description và load skill.
- Explicit slash command: nếu workspace có file
.agent/workflows/vbs-scan-security.md(xem README để biết cách tạo), gõ/vbs-scan-securityđể invoke.
| Argument | Scope | Mô tả |
|---|---|---|
| (không args) | Toàn repo | Mặc định — quét toàn bộ repo |
all |
Toàn repo | Alias explicit |
uncommitted / diff |
Uncommitted changes | Staged + unstaged |
staged |
Staged files only | Pre-commit scan |
commit within Xdays |
Recent commits | Quét commit X ngày gần đây |
commit id <sha> |
Specific commit | Quét 1 commit |
pr id <number> |
Pull request | Quét PR diff (cần gh CLI) |
Lựa chọn ngôn ngữ output: lang=vi / --vi (mặc định) hoặc lang=en / --en.
Cờ tùy chọn (v0.7+, mặc định TẮT):
| Flag | Alias | Mô tả |
|---|---|---|
--sca |
sca |
Tra cứu CVE live qua OSV.dev cho dependency (NuGet/Go/npm/Composer/PyPI). Xem references/dependency-scan.md. Cần network. |
--auto-fix |
auto-fix |
Tự sinh patch, verify bằng build command, revert nếu fail. Xem workflows/auto-fix.md. Ghi đè file nguồn — cần git repo. |
--run-tests |
— | Chỉ có tác dụng cùng --auto-fix: cho phép chạy test của project (go test ./..., dotnet test) để verify bản nâng version dependency. Test có thể đụng hệ thống thật (DB, dịch vụ trong .env) — chỉ bật khi test an toàn. Không bật → bump dependency chỉ là gợi ý patch. |
What ships with it
60 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- references/chunking-strategy.md 5.0 KB
- references/data-flow-classification.md 8.4 KB
- references/dependency-scan.md 9.2 KB
- references/i18n/en.md 8.3 KB
- references/i18n/vi.md 9.0 KB
- references/language-detection.md 5.4 KB
- references/load-rules.sh 3.9 KB runs code
- references/output-format.md 25 KB
- references/sub-agent-prompts.md 14 KB
- references/validate-report.py 6.8 KB runs code
- rules/generic/01-hardcoded-secret.md 5.4 KB
- rules/generic/02-sql-injection.md 5.2 KB
- rules/generic/03-xss.md 4.9 KB
- rules/generic/04-idor.md 5.7 KB
- rules/generic/05-slopsquatting.md 6.1 KB
- rules/generic/06-brute-force.md 6.2 KB
- rules/generic/07-mass-assignment.md 6.3 KB
- rules/generic/08-insecure-deserialization.md 6.3 KB
- rules/generic/09-ssrf.md 6.7 KB
- rules/generic/10-path-traversal.md 6.3 KB
- rules/generic/11-csrf.md 7.4 KB
- rules/generic/12-broken-access-control.md 7.5 KB
- rules/generic/13-weak-password-hashing.md 5.2 KB
- rules/generic/14-jwt-none-algorithm.md 5.3 KB
- rules/generic/15-cors-misconfig.md 5.3 KB
- rules/generic/16-unrestricted-file-upload.md 5.9 KB
- rules/generic/17-verbose-error-debug-mode.md 5.8 KB
- rules/generic/18-missing-rate-limit.md 10 KB
- rules/generic/19-race-condition.md 6.4 KB
- rules/generic/20-outdated-dependency.md 7.2 KB
- rules/generic/21-command-injection.md 6.6 KB
- rules/generic/22-vulnerable-dependency.md 5.1 KB
- rules/languages/dotnet/02-sql-injection.md 5.7 KB
- rules/languages/dotnet/07-mass-assignment.md 6.0 KB
- rules/languages/dotnet/08-insecure-deserialization.md 5.7 KB
- rules/languages/dotnet/17-verbose-error-debug-mode.md 5.0 KB
- rules/languages/dotnet/21-command-injection.md 5.3 KB
- rules/languages/dotnet/README.md 1.7 KB
- rules/languages/go/02-sql-injection.md 5.2 KB
- rules/languages/go/08-insecure-deserialization.md 5.0 KB
- rules/languages/go/09-ssrf.md 5.8 KB
- rules/languages/go/17-verbose-error-debug-mode.md 6.1 KB
- rules/languages/go/21-command-injection.md 5.2 KB
- rules/languages/go/README.md 2.7 KB
- rules/languages/php/02-sql-injection.md 5.8 KB
- rules/languages/php/08-insecure-deserialization.md 6.2 KB
- rules/languages/php/11-csrf.md 6.2 KB
- rules/languages/php/17-verbose-error-debug-mode.md 6.5 KB
- rules/languages/php/21-command-injection.md 6.7 KB
- rules/languages/php/README.md 2.9 KB
- rules/languages/python/02-sql-injection.md 7.2 KB
- rules/languages/python/07-mass-assignment.md 7.3 KB
- rules/languages/python/08-insecure-deserialization.md 7.3 KB
- rules/languages/python/09-ssrf.md 7.5 KB
- rules/languages/python/11-csrf.md 7.6 KB
- rules/languages/python/14-jwt-none-algorithm.md 7.5 KB
- rules/languages/python/15-cors-misconfig.md 8.0 KB
- rules/languages/python/17-verbose-error-debug-mode.md 8.4 KB
- rules/languages/python/21-command-injection.md 8.5 KB
- rules/languages/python/README.md 3.4 KB
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 22d ago Changed · +50 lines · +30 tokens per session c797d354d062
- 26d ago Changed · +32 lines scan A → B 45e5b8c9fd41
- 1mo ago First seen · 337 lines · 75 tokens per session scan A e0c9cba9a96b
vbs-scan-security is a skill published in the GitHub repository tanviet12/vbsec (295 stars, last pushed 22d ago), licensed MIT. It adds 105 tokens to every session and 6,242 once invoked, about $0.0004 per session on Opus 5.5. A static security scan graded it B with 1 finding (recursive force delete). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
ship-it-or-fix-it
Oracle-frozen Builder and independent-Judge convergence cycle. Load ONLY when the operator explicitly sets Governance Dial G2 for the task, or explicitly names this skill or an active work unit already running it. Never auto-activate on task class, such as security, auth, or payments. If a task seems to warrant G2 and…
test-verification
Requires behavioral, failure-path, and durable-seam evidence for tests and review. Use when writing tests, reviewing test coverage, assessing behavioral test quality, or accepting high-risk behavior on test evidence.
portable-adaptive-planning
Use for planning, roadmaps, design, architecture, sequencing, or before consequential work when no current FINAL plan plus GO covers it. Fire before changes to data or schemas, credentials or auth, production or releases, repository or source-home boundaries, irreversible work, or materially costly mistakes. Re-enter…
write-maintainable-code
Evaluate minimum-sufficient implementation routes and enforce the selected route for a fixed, authorized outcome. Use after outcome, scope, authority, and acceptance evidence are fixed. Do not choose outcomes, set acceptance, adjudicate governance, grade finished work, design tests alone, conduct security audits, or…
reasoning-doctrine
The working method for every nontrivial task: frame the objective, ground load-bearing facts, converge on a route, execute without drift, and verify before delivery. Use for analysis, planning, implementation, debugging, document work, reviews, and multi-stage tasks.
deep-review
Multi-angle code review that adapts to what is being reviewed — a mid-flight worktree increment, a full PR before production, a merge-window integration sweep, or a security-only pass. Findings are scored, adversarially refuted, widened to the same defect elsewhere in the codebase, and reported to the native review…