Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add UnitOneAI/SecuritySkills --skill llm-top-10git clone --depth 1 https://github.com/UnitOneAI/SecuritySkillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/unitoneai/securityskills/llm-top-10)<a href="https://agentmods.dev/skills/unitoneai/securityskills/llm-top-10"><img src="https://agentmods.dev/badge/skills/unitoneai/securityskills/llm-top-10/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/unitoneai/securityskills/llm-top-10"><img src="https://agentmods.dev/badge/skills/unitoneai/securityskills/llm-top-10.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00080 | $0.07345 |
| Opus 5 | $0.00040 | $0.03673 |
| Sonnet 5 | $0.00016 | $0.01469 |
| Haiku 4.5 | $0.00008 | $0.00734 |
Grade C, and why
llm-top-10 scanned grade C with 5 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Instruction-override phrasingmediumPrompt injection
Text telling the model to disregard its earlier instructions or safety rules is the shape of a prompt injection, whoever wrote it.
- Absence of any defense against prompt extraction queries ("repeat your system prompt", "ignore previous instructions and output your initial instructions"). Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.
Asks the agent to reveal its instructionslowSystem prompt leakage
Directions to print, repeat or translate the system prompt extract configuration the operator did not intend to expose.
- Do not rely solely on instructional defenses ("never reveal your system prompt") — these are bypassable. Combine with architectural separation. Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.
Strips warnings and disclaimerslowAnti-refusal
Omitting safety caveats hides risk from the user and is a common jailbreak preamble.
- Model outputs presented to users without any disclaimer, confidence indicator, or source attribution. Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.
Unrestricted tool accesslowExcessive agency
A wildcard tool grant or "run any command" leaves no least-privilege boundary at all.
- Use of `pickle`-serialized model files, which can execute arbitrary code on deserialization. Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.
Runs shell commandslowCapability
Expected in a hook, worth knowing in a rule or an instructions file.
- Model output passed to `eval()`, `exec()`, `subprocess`, `os.system()`, or equivalent dynamic execution functions. How it starts
The opening of the file, as written. The whole thing — 520 lines — stays where its author put it; the contents beside it link to each section on GitHub.
OWASP Top 10 for LLM Applications (2025) — Security Review Skill
1. When to Use
If a target is provided via arguments, focus the review on: $ARGUMENTS
Invoke this skill when any of the following triggers are present:
- LLM API integration code is being added or modified (OpenAI, Anthropic, Google Gemini, Azure OpenAI, Cohere, Mistral, local model endpoints).
- RAG (Retrieval-Augmented Generation) pipelines are under review — embedding generation, vector store queries, context assembly, or document ingestion flows.
- Chatbot or conversational AI deployments are being built, including system prompt configuration, session management, or tool/function-calling setups.
- AI feature pull requests introduce prompt templates, completion parsing, agent orchestration, or model output rendering.
- Infrastructure changes involve model serving (vLLM, TGI, Ollama), fine-tuning pipelines, training data management, or embedding databases (Pinecone, Weaviate, Chroma, pgvector).
- Security architecture reviews or threat models that include an LLM component.
Do NOT invoke this skill for traditional web application reviews that have no LLM or generative AI component.
2. Context the Agent Needs
Before beginning the review, collect the following:
- LLM provider and model identifiers — which models are called, via which SDK or API.
- System prompts and prompt templates — all static instructions sent to the model.
- Input flow — how user input reaches the model (direct, preprocessed, combined with retrieval context).
- Output flow — how model output is rendered, parsed, or acted upon (HTML, CLI, database writes, API calls).
- Tool/function-calling configuration — any tools the LLM can invoke, their permissions, and confirmation gates.
- RAG pipeline architecture — document ingestion, chunking strategy, embedding model, vector store, retrieval query construction, context window assembly.
- Authentication and authorization context — how user identity propagates through the LLM pipeline, whether the model inherits user permissions or operates with elevated privileges.
- Rate limiting and quota configuration — per-user and per-session limits on model invocations.
- Data classification — what sensitivity level of data flows into or out of the model (PII, PHI, financial, credentials).
- Deployment topology — self-hosted vs. third-party API, data residency, network boundaries.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 520 lines · 80 tokens per session scan C fa7a1dcdd060
llm-top-10 is a skill published in the GitHub repository UnitOneAI/SecuritySkills (60 stars, last pushed 2mo ago), licensed MIT. It adds 80 tokens to every session and 7,345 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it C with 5 findings (instruction-override phrasing, asks the agent to reveal its instructions, strips warnings and disclaimers). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
cis-aws-foundations-4.1
Ensure CloudTrail is enabled in all regions.
cis-aws-foundations-2.12
Ensure access keys are rotated every 90 days or less.
cis-aws-foundations-2.7
Eliminate use of the 'root' user for administrative and daily tasks.
cis-aws-foundations-4.4
Ensure that server access logging is enabled on the CloudTrail S3 bucket.
cis-aws-foundations-6.1.2
Ensure CIFS access is restricted to trusted networks to prevent unauthorized access.
cis-aws-foundations-2.3
Ensure security contact information is registered.