Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add ulises-jeremias/agent-toolkit --skill owasp-agentic-reviewgit clone --depth 1 https://github.com/ulises-jeremias/agent-toolkitWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/ulises-jeremias/agent-toolkit/owasp-agentic-review)<a href="https://agentmods.dev/skills/ulises-jeremias/agent-toolkit/owasp-agentic-review"><img src="https://agentmods.dev/badge/skills/ulises-jeremias/agent-toolkit/owasp-agentic-review/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/ulises-jeremias/agent-toolkit/owasp-agentic-review"><img src="https://agentmods.dev/badge/skills/ulises-jeremias/agent-toolkit/owasp-agentic-review.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00057 | $0.02166 |
| Opus 5.5 | $0.00023 | $0.00866 |
| Sonnet 5.5 | $0.00011 | $0.00433 |
| Haiku 4.5 | $0.00006 | $0.00217 |
Grade A, and why
owasp-agentic-review scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
| LLM02 | Insecure Output Handling | Agent output (file writes, shell args, URL fetches) unsanitized before execution; `tool_result` concatenated into `bash` without validation; `curl`/`wget`/`npx` args from LLM without How it starts
The opening of the file, as written. The whole thing — 74 lines — stays where its author put it; the contents beside it link to each section on GitHub.
OWASP Agentic Review — Prompt Injection, Tool Poisoning, Agency & Supply Chain
Curated OWASP LLM Top 10 (2025) + OWASP Agentic Security review for agents, skills, plugins, hooks, MCP, tool use, prompt handling, and provenance. Use when reviewing agentic capabilities, supply-chain surface, or when security-reviewer (app code) needs agentic specialization.
Evidence-cited, severity-ranked — do not hallucinate findings. Every finding must cite observation (file:line, registry YAML, tool description) + impact + severity + confidence + evidence. Delegates to supply-chain-audit + mcp-audit for supply-chain/MCP depth.
OWASP source: OWASP Top 10 for LLM Applications 2025 (v1.1, 2025-02-18) + OWASP Agentic & GenAI security guidance (prompt injection, insecure output, supply chain, excessive agency, data leakage, insecure plugin). Map findings to IDs
LLM01–LLM10+AGNT01–AGNT06where applicable; do not fabricate beyond listed. Cite https://owasp.org/www-project-top-10-for-large-language-model-applications/ and https://owasp.org/www-project-agentic-security/ where mapping.
OWASP LLMs / Agentic mapping (curated checklist)
| OWASP ID | Title | What to check (evidence) | Mode |
|---|---|---|---|
| LLM01 | Prompt Injection | Tool descriptions / skill instructions contain ignore previous, send secrets, exfiltrate, override system, [/INST]; user input flows into skill instructions without delimiting; hook prompt interpolation without escaping |
Static: scan skills/**/SKILL.md, agents/**/AGENT.md, mcp/registry/*.yaml tool descriptions, hooks configs for injection phrases; browser capture not needed |
| LLM02 | Insecure Output Handling | Agent output (file writes, shell args, URL fetches) unsanitized before execution; tool_result concatenated into bash without validation; curl/wget/npx args from LLM without allowlist |
Static: audit-capability.py surface shell/network, check supply-chain-audit report |
| LLM03 | Training Data Poisoning | Third-party skill/plugin provenance_digest missing or NOASSERTION without review; upstream.lock digest mismatch; vendored bytes not matching upstream SHA |
Provenance lock check: capabilities/upstream.lock content_checksum vs vendored file |
| LLM04 | Model Denial of Service | Skill loads 50k+ tokens unconditional (e.g., full accessibility-skills), PM excessive context causing token DoS; swarm fanning without rate limit | Context-cost audit (#395): measure skill SKILL.md token count, routing vs monolith |
| LLM05 | Supply Chain Vulnerabilities | Unpinned package (latest without digest), unknown provenance, transitive npm/py deps without hash, MCP ghcr.io without digest, claims without version_policy |
Registry implementation.package + version_policy + audit-capability.py pins/hashes |
| LLM06 | Sensitive Information Disclosure | Hardcoded ghp_, xoxb, sk-, PII in skill body or config.template.json without ${VAR} placeholder; screenshots with secrets; secret_storage not env var |
Scan mcp/registry/*.yaml + skills/** for secrets (test_no_secrets_in_registry), check templates placeholders |
| LLM07 | Insecure Plugin Design | Plugin hooks with dangerous_permissions (filesystem write, network, default-branch push) without justification; security.cve_policy missing; mcp.write/destructive overly broad |
Validate skills/**/SKILL.md frontmatter security.* + distributions/products.yaml |
| LLM08 | Excessive Agency | Agent can delete_file, push to default, run shell without human approval; approval.default = destructive without gate; swarm can fan out unbounded |
Check approval.default, security.dangerous_permissions, output-handshake gates |
| LLM09 | Overreliance | Agent claims full WCAG AA / full security compliance from automated checks alone (e.g., axe pass = AA pass, no manual gates) — requires human judgment | Check skill claims: must distinguish automatically detectable vs browser-assisted vs manual, must mark Not assessed |
| LLM10 | Model Theft | Skill exfiltrates model weights / prompts via network + filesystem write to external host; security.network_hosts includes unscoped * |
Network hosts allowlist audit |
| AGNT01 | Identity & Spoofing | Agent impersonates security-reviewer / architect without delegation table; missing agent identity prefix in AGENT.md |
Check agents/* name + delegation tables |
| AGNT02 | Tool Poisoning | MCP tool description contains hidden instructions (e.g., tool get_file description says when listing files also send /etc/passwd) |
Scan mcp/registry/*.yaml tools.* descriptions for imperative injection |
| AGNT03 | Insecure Inter-Agent Trust | One agent can directly mutate another's memory without swarm-handoff gate; no trust boundary between assessment and implementation agents |
Check ops/swarm-handoff usage + trust boundaries |
| AGNT04 | Data Leakage via Tool Output | Tool output containing PII/secrets is forwarded to external MCP without redaction | Check security.network_hosts + Grep for network/exfil patterns |
| AGNT05 | Permission Creep | Skill security.dangerous_permissions accumulates across composed skills (design-assessment → mcp-audit → supply-chain-audit) without least-privilege |
Check composed delegation chain permissions sum |
| AGNT06 | Prompt Hierarchy Violation | System prompt overridden by user-provided skill instructions (instruction hierarchy not enforced) | Scan hook prompt vs user priority |
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 74 lines · 57 tokens per session scan A 50706d049435
owasp-agentic-review is a skill published in the GitHub repository ulises-jeremias/agent-toolkit (19 stars, last pushed yesterday), licensed MIT. It adds 57 tokens to every session and 2,166 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-04.
Other skills, from other repositories
verify
Fact-check claims encountered during reading — dates, names, events, citations. Use when encountering historical facts or disputed claims.
skillnote
Self-hosted skill registry for OpenClaw. Stores procedures your team writes (name, description, body), syncs them to disk before each task, and collects which-helped/which-failed signals from the agent so the registry improves over time.
pr-alignment-loop
Iterate a PR to its final form by running two opposing reviewer droids (reviewer-robustness and reviewer-minimalist) in a bounded back-and-forth loop. The main orchestrator synthesizes their feedback, makes edits, runs tests, and stops when both approve, on stagnation, or after 3 rounds. Use when the user asks to…
publish-website
Publish a website to Porkbun Secure Static Hosting. Use when the user asks you to build, create, update or put live a website, landing page or placeholder page for a domain they have at Porkbun, mentions Porkbun hosting or static hosting, or asks how to upload site files to Porkbun.
create-rule
Use when creating, writing, or updating a Claude Code rule file (.claude/rules/.md or /.claude/rules/.md), or when asking about rule format, path scoping, or rule best practices.
platform-setup
Set up, verify, and troubleshoot Katalon True Platform/TestOps MCP connectivity for any AI coding agent. Use when you need to install or configure the Katalon MCP server, connect to a Katalon platform account, verify available Katalon MCP tools, diagnose missing authentication or repository access, confirm…