Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add vietanhdev/bulwark --skill agent_skillgit clone --depth 1 https://github.com/vietanhdev/bulwarkWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/vietanhdev/bulwark/agent_skill)<a href="https://agentmods.dev/skills/vietanhdev/bulwark/agent_skill"><img src="https://agentmods.dev/badge/skills/vietanhdev/bulwark/agent_skill/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/vietanhdev/bulwark/agent_skill"><img src="https://agentmods.dev/badge/skills/vietanhdev/bulwark/agent_skill.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00078 | $0.00895 |
| Opus 5.5 | $0.00031 | $0.00358 |
| Sonnet 5.5 | $0.00016 | $0.00179 |
| Haiku 4.5 | $0.00008 | $0.00089 |
Grade B, and why
bulwark scanned grade B with 3 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks for rootlowPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
- Checks that need administrator rights: give the user `sudo {bin} scan --privileged` to run Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.
Downloads and executes remote codemediumSupply chain
curl | sh runs whatever the server returns today, which is not necessarily what it returned when this was reviewed.
never with a `curl … | sh` command. Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
never with a `curl … | sh` command. How it starts
The opening of the file, as written. The whole thing — 73 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Bulwark security checks
Bulwark is a local security scanner. Nothing it does leaves this machine. Its command here is
{bin}.
Which check to run
| The user wants to know about | Run |
|---|---|
| This repository's agent files (hooks, auto-approve, MCP servers, hidden instructions, keys) | {bin} ai scan --target . |
| Every agent configuration and chat history on this machine | {bin} ai scan |
| The computer itself (SSH, firewall, exposed services, persistence, malware signs) | {bin} scan |
| A server they reach over SSH | {bin} scan --ssh user@host |
Run the scan straight away: don't check first whether {bin} is installed, and don't read the
agent files yourself instead — the scan reads them without exposing any secret they hold. Run
the command on its own — no ;, && or pipes — so it matches the commands this skill
pre-approves. Add --all to see low-priority items and every file a problem was found in. Add --json only
when you need a field the report doesn't show.
Exit codes: 0 nothing medium or worse, 1 medium or high, 2 critical. A non-zero exit is a
result, not a failure of the command.
How to report
- Lead with the worst problem. For each: what it is, where (the
in:path), why it matters in one sentence, and the fix from the→line. Give themore:link for the details. - Keep the report's own words for the problem; don't make it sound worse or better.
- Mention what the scan says it could not check (the "Not covered" lines). A clean result is "nothing found by the checks that ran", never "the machine is secure".
- Checks that need administrator rights: give the user
sudo {bin} scan --privilegedto run themselves. Never runsudoyourself.
Fixing: always ask first
- Change nothing until the user says yes to that specific change. Show the preview first:
{bin} ai redact(leaked keys in agent files) or{bin} fix list(system settings). Both only preview; they change nothing without--apply. - After a yes, run the same command with
--apply, then scan again to confirm. - A leaked key stays leaked after it is removed from a file. Tell the user to revoke it with its provider and create a new one.
- Never print, copy, or repeat a secret, and don't open a file to look at one. The report shows only a masked preview, which is enough.
- Don't silence a finding to make the report clean. Ignoring a check (
{bin} rules suppress) is the user's decision, and it needs their reason.
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 73 lines · 78 tokens per session scan B 9760135d40f2
bulwark is a skill published in the GitHub repository vietanhdev/bulwark (14 stars, last pushed 2d ago), licensed Apache-2.0. It adds 78 tokens to every session and 895 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it B with 3 findings (asks for root, downloads and executes remote code, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-11-02.
Other skills, from other repositories
tauri-pilot
Inspect, interact with, and test a running Tauri v2 app via CLI. Communicates over Unix socket using JSON-RPC 2.0. Use when testing UI, automating interactions, or debugging a Tauri app.
rmux
Guide for using RMUX with Claude Code, including the tmux-compatible CLI, agent automation waits, the typed SDK, browser web-share, and the rmux claude launcher.
npm-safe-scan
Automatically scan any npm package for supply-chain security risks BEFORE the user installs it. Trigger this skill whenever the user asks to install, add, or upgrade an npm package or dependency (e.g. "npm install X", "install X", "add X as a dependency", "yarn add X", "pnpm add X", "upgrade X"), or wants to…
readmd-style-custom
Generate custom CSS rules and HTML head tags for ReadMD document styling.
portpilot
Start, stop and check local dev servers through PortPilot instead of bare shell commands. Use whenever you are about to run a dev server (npm run dev, next dev, vite, uvicorn, flask run, python -m http.server), free a port, or find out what is listening on a port.
agent-computer-use
REQUIRED for any task that involves operating a desktop application — opening apps, clicking buttons, typing into fields, pressing keys, scrolling, dragging, reading what's on screen, moving or resizing windows, or verifying state after an action. Always use the agent-cu CLI commands (open, snapshot, click, type, key…