Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add trilwu/secskills --skill vetting-agent-extensionsgit clone --depth 1 https://github.com/trilwu/secskillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/trilwu/secskills/vetting-agent-extensions)<a href="https://agentmods.dev/skills/trilwu/secskills/vetting-agent-extensions"><img src="https://agentmods.dev/badge/skills/trilwu/secskills/vetting-agent-extensions/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/trilwu/secskills/vetting-agent-extensions"><img src="https://agentmods.dev/badge/skills/trilwu/secskills/vetting-agent-extensions.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00110 | $0.02918 |
| Opus 5 | $0.00055 | $0.01459 |
| Sonnet 5 | $0.00022 | $0.00584 |
| Haiku 4.5 | $0.00011 | $0.00292 |
Grade C, and why
vetting-agent-extensions scanned grade C with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Downloads and executes remote codehighSupply chain
curl | sh runs whatever the server returns today, which is not necessarily what it returned when this was reviewed.
runs it is a `curl | bash` with extra steps; the question is whether the Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
runs it is a `curl | bash` with extra steps; the question is whether the Copies of this mod
1 near-identical copy found in the catalogue:
- vetting-agent-extensions — 98% identical, 2 lines differ
How it starts
The opening of the file, as written. The whole thing — 238 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Vetting Agent Extensions
An agent extension is not a library you call — it is text and configuration that your model reads as instructions and tooling your agent runs on your behalf. A malicious dependency has to wait for you to call it. A malicious skill is already in the context window, and a malicious MCP server may execute the moment the agent starts. The trust decision happens before either runs, and it is the decision this skill is about.
This is an adoption gate, not a code audit. The question is not "does this server have a CVE" — it is "if I install this, what can it make my agent do, and what can it read on its way out."
When to Use
- Deciding whether to install a skill pack, plugin, or marketplace entry into Claude Code, Cursor, Cline, or a similar agent
- Reviewing an MCP server before adding it to an agent's config — especially
one that ships its own
.mcp.json,.env, or startup wiring - Judging a repo that mixes skills, MCP config, and bootstrap scripts, where installing the repo wires all three at once
- Assessing whether third-party agent content that gets loaded into context (skill bodies, tool descriptions, resources, bundled notes) can steer the model or leak the current engagement
When NOT to Use
- Auditing an MCP server's own code for vulnerabilities — injection
surfaces, tool scope, authz, transport — use
auditing-mcp-servers. That skill reviews a server you are building or breaking; this one decides whether to trust one someone else built. - Dependency, package, lockfile, and CI/CD supply-chain risk — use
auditing-supply-chain. An extension's npm/pip dependencies are its problem; route them there. - Prompt-injection and tool-abuse testing of an LLM application you are
assessing — use
securing-ai-systems. - Reviewing a diff to an extension you have already adopted — use
reviewing-code-changes; come back here only if the diff changes what loads into context or what runs on startup.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 11d ago First seen · 238 lines · 110 tokens per session scan C fcbc12338ff6
vetting-agent-extensions is a skill published in the GitHub repository trilwu/secskills (138 stars, last pushed 6d ago), licensed MIT. It adds 110 tokens to every session and 2,918 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it C with 2 findings (downloads and executes remote code, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
google-cloud-solution-guided-gke-ai-migration
Guides the migration of existing AI workloads (Cloud Run, Gemini API, Gemini Enterprise Agent Platform) to self-hosted GKE inference using gcloud and kubectl. Use when the user has an existing AI inference workload (on Cloud Run, the Gemini API, Gemini Enterprise Agent Platform, or a custom VM) and wants to move it to…
agent-platform-tuning
Agent Platform Model Tuning. Use when you need to fine-tune open models or Gemini models using Agent Platform infrastructure. Don't use for model training outside Agent Platform, model deployment to endpoints (use agent-platform-deploy), or managing serving endpoints (use agent-platform-endpoint-management).
developing-genkit-js
Develop AI-powered applications using Genkit in Node.js/TypeScript. Use when the user asks about Genkit, AI agents, flows, or tools in JavaScript/TypeScript, or when encountering Genkit errors, validation issues, type errors, or API problems.
agent-platform-prompt-management
Manages and orchestrates prompts in Agent Platform. Use when you need to create, list, retrieve, version, or delete managed prompts in Agent Platform. Don't use for model training, model deployment to endpoints, or managing non-Agent Platform prompts.
agent-platform-rag-engine-management
Manage and query Agent Platform RAG Engine Corpora and retrieve grounded contexts using the Google GenAI SDK. Use when listing RAG corpora or files, inspecting a corpus, retrieving contexts, or generating content grounded in a RAG corpus. Do not use for standard database queries (use SQL/Spanner skills), Google…
gke-inference
Deploys and optimizes AI/ML inference workloads on GKE, using GPUs, TPUs, and model servers. Use when deploying GKE inference servers, configuring GKE GPU resources for inference, or deploying LLMs on GKE. Don't use for generic batch jobs or HPC task queues (use gke-batch-hpc instead).