Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/telagod/code-abyss/analyzing-securitynpx skills add telagod/code-abyss --skill analyzing-securitygit clone --depth 1 https://github.com/telagod/code-abyssWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00062 | $0.01008 |
| Opus 5 | $0.00031 | $0.00504 |
| Sonnet 5 | $0.00012 | $0.00202 |
| Haiku 4.5 | $0.00006 | $0.00101 |
Grade A, and why
analyzing-security scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
安全校验关卡
判断先于执行：决定「是否做 / 选什么 / 如何取舍」（栈、方案、架构、权衡）前，先读领域判断内核
skills/_kernel/security/SKILL.md——它管 judgment，本秘典管 execution；冲突时以内核判断为准。
自动化扫描捕捉模式，但严重度判定与处置取决于上下文——sink、信任边界、补偿控制。
何时使用
| 场景 | 必跑 | 理由 |
|---|---|---|
| 新模块落地 | ✅ | 引入新攻击面 |
| 安全相关变更 | ✅ | 直接触及威胁面 |
| 重构完成 | ✅ | 防止重构引入退化 |
| 提交前（含敏感数据/外部输入处理） | ✅ | 最后一道闸 |
| 攻防任务交付 | ✅ | 验收前自检 |
| 仅文档/样式改动 | ❌ | 无攻击面变化 |
何时不使用
- 依赖更新（用 SCA 工具如
npm audit、pip-audit，不是模式扫描） - 运行时漏洞（用 DAST，不是静态扫描）
- 配置审计（用 CIS Benchmark 或专用工具）
解读输出
严重度（critical / high / medium / low）+ 类别（注入 / 敏感信息 / XSS / 反序列化 / 路径遍历 / SSRF / 弱加密 / 不安全随机 / 调试残留）。
必修
- Critical（SQL 注入、命令注入、硬编码密钥、AWS Key、私钥）→ 阻断交付，无例外。
- High（XSS、反序列化、路径遍历、SSRF）→ 修复或显式接受风险（需 DESIGN.md 留痕 + 补偿控制）。
上下文降级条件
- Medium/Low 可在 DESIGN.md 标注「已知/已评估」后保留。判据：
- 弱加密 MD5/SHA1 用于非安全场景（如 hash bucket）→ 可接受
random用于非安全场景（如 jitter）→ 可接受- 调试残留在 dev-only 构建 → 可接受，prod 构建必须剔除
假阳处理
每条规则均有 excludePattern，若仍误报：
- 检查命中文本是否真为 sink（看上下文，不只是模式）
- 若确认假阳，在 DESIGN.md 记录 + 行内注释（
// nosec: <规则 ID> <理由>）
与其他 skill 联动
- 命中 critical/high → 同步触发 securing-systems 路由的对应秘典（如 SQL 注入查
pentest.md） - 新模块场景 → 与 verifying-modules 串行，先扫安全再校验文档
- 变更场景 → 与 analyzing-changes 串行，先看变更范围再决定扫描深度
使用
node scripts/security_scanner.js <路径> # 默认全扫
node scripts/security_scanner.js <路径> -v # 详细，含命中代码片段
node scripts/security_scanner.js <路径> --json # 机读格式，供 CI
node scripts/security_scanner.js <路径> --exclude vendor,dist
完整规则矩阵、危险模式速查、误报豁免清单详见 references/rules.md。
收口
Critical/High 必修后方可交付。安全决策须于 DESIGN.md 记录：威胁模型、信任边界、已知风险、补偿控制。
What ships with it
3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 75 lines · 62 tokens per session scan A b8e9c03d60ec
analyzing-security is a skill published in the GitHub repository telagod/code-abyss (240 stars, last pushed 1mo ago), licensed MIT. It adds 62 tokens to every session and 1,008 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
codexkit-a-b-test-planner
Design rigorous A/B test plans with hypothesis, sample size calculation, Minimum Detectable Effect (MDE), randomization strategy, and decision rules. Includes guardrail metrics and rollout playbook. Use when planning product experiments, conversion optimization, or data-driven feature decisions.
codexkit-api-design-reviewer
Review REST and GraphQL API designs for consistency, usability, and best practices. Covers naming conventions, versioning strategy, error format, pagination, authentication patterns, and breaking change detection. Use when reviewing API specs, designing new APIs, or auditing existing endpoints.
codexkit-architecture-decision-writer
Write Architecture Decision Records (ADRs) following the Michael Nygard format. Captures context, options considered, decision rationale, and consequences. Use when making technology choices, framework selections, or any architectural decision that future developers need to understand.
codexkit-audit-readiness-checker
Assess organizational readiness for financial audits (internal or external). Map assertions to account balances, check evidence completeness, score readiness using a Red/Amber/Green framework, and generate a remediation timeline. Aligned with SOX, IFRS, and GAAP audit standards. Use before scheduled audits or when…
codexkit-business-case-writer
Write structured business cases with problem framing, options analysis, financial modeling (NPV/ROI/Payback), risk assessment, and implementation roadmap. Follows HBR business case structure. Use when seeking budget approval, proposing new initiatives, or justifying investment decisions.
codexkit-campaign-brief-writer
Write agency-standard creative briefs for marketing campaigns. Structure Background, Objective (SMART), Target Audience persona, Key Message, Mandatories, KPIs, Timeline, and Budget Allocation. Use when briefing agencies, creative teams, or internal marketing on a new campaign.