Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add transilienceai/communitytools --skill source-code-scanninggit clone --depth 1 https://github.com/transilienceai/communitytoolsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/transilienceai/communitytools/source-code-scanning)<a href="https://agentmods.dev/skills/transilienceai/communitytools/source-code-scanning"><img src="https://agentmods.dev/badge/skills/transilienceai/communitytools/source-code-scanning/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/transilienceai/communitytools/source-code-scanning"><img src="https://agentmods.dev/badge/skills/transilienceai/communitytools/source-code-scanning.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00082 | $0.01267 |
| Opus 5.5 | $0.00033 | $0.00507 |
| Sonnet 5.5 | $0.00016 | $0.00253 |
| Haiku 4.5 | $0.00008 | $0.00127 |
Grade A, and why
source-code-scanning scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 115 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Source Code Security Review
Quick Start
- Identify - languages, frameworks, package managers present
- Automated SAST - run tools appropriate to the stack
- Dependency CVEs - scan lockfiles/manifests for known CVEs
- Secrets scan - detect hardcoded credentials/tokens
- Manual review - trace high-risk sinks (exec, eval, query, deserialize)
- Malicious code - check for backdoors, obfuscation, suspicious network calls
- Report - findings with CWE/CVE refs, severity, PoC, remediation
Workflow
Phase 1: Enumerate
- Languages: ls **/*.{py,js,ts,java,go,rb,php,cs,rs}
- Packages: find package.json, requirements.txt, go.mod, pom.xml, Gemfile, composer.json, Cargo.toml
- Entry points: main(), index.*, app.*, server.*
- Config files: .env*, config.*, settings.*, *.yaml, *.toml
Phase 2: Automated SAST
See sast-tools.md for commands per language.
Key tools:
- Multi-language: Semgrep (
semgrep --config=auto .) - Python: Bandit (
bandit -r . -f json) - JavaScript/TS: ESLint security plugin, njsscan
- Java: SpotBugs + FindSecBugs
- Go: gosec (
gosec ./...) - PHP: PHPCS Security Audit
- Ruby: Brakeman (
brakeman -o report.json) - All: CodeQL (via
gh codeql)
Phase 3: Dependency CVE Scan
See dependency-cve-scanning.md for commands.
| Ecosystem | Command |
|---|---|
| npm/yarn | npm audit --json / yarn audit |
| Python | pip-audit -r requirements.txt |
| Java | dependency-check --scan . |
| Go | govulncheck ./... |
| Ruby | bundle audit |
| Generic | trivy fs . / grype dir:. |
Phase 4: Secrets Detection
See secrets-detection.md.
trufflehog filesystem . --json
gitleaks detect --source . -v
Phase 5: Manual Review
Focus on high-risk sinks — see manual-review.md:
- Injection sinks:
exec,eval,query,system,popen - Deserialization:
pickle.loads,ObjectInputStream,unserialize - Crypto: hardcoded keys, weak algorithms (MD5, SHA1, DES, ECB)
- Auth: JWT validation, session management, RBAC enforcement
- File ops: path construction with user input
What ships with it
6 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 115 lines · 82 tokens per session scan A ea9410b1ccbe
source-code-scanning is a skill published in the GitHub repository transilienceai/communitytools (591 stars, last pushed 2mo ago), licensed MIT. It adds 82 tokens to every session and 1,267 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
sonarqube-tactics
A guide to testing SonarQube, a platform that reviews source code for bugs and security issues.
ctf-source-audit
A source-code auditing guide for capture-the-flag (CTF) challenges, where the vulnerable code is deliberately included in places such as repositories, backups, or environment leaks.
omv-critic
Performs adversarial pre-submission review of an Evidence.v1 finding plus optional ThreatMap.v1 and Verification.v1 sidecars. Use before /omv-report when the user wants likely CNA rejection reasons, report argument quality review, a rejectrisk rating, or a recommendation of which researchergoal (VulDB, CVE, GHSA…
sast-danger-mapper
Maps dangerous operations in a source file: memory ops, type casts, arithmetic near trust boundaries, free/dealloc patterns. Pattern matching task — list what you see, don't speculate. Use via /sast command.
sast-devils-advocate
Adversarial validator for SAST findings. Your ONLY job is to DISPROVE the candidate. Find every reason it's not exploitable. If you can't disprove it, it survives. Use via /sast command.
sast
Source code vulnerability hunting (SAST). Decomposes analysis into specialized passes: map entry points, map dangerous ops, trace flows, find gaps, adversarial validation, exploit. Usage: /sast [--lang c|cpp|rust|java|python|go|php] [--min-score 4] [--max-files 30] [--skip-static] [--best-of N].