Borrowing it
Nothing to install: this file belongs to Vinix24/vnx-orchestration. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/Vinix24/vnx-orchestration/main/.claude/skills/security-engineer/SKILL.mdgit clone --depth 1 https://github.com/Vinix24/vnx-orchestrationWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/vinix24/vnx-orchestration/security-engineer)<a href="https://agentmods.dev/skills/vinix24/vnx-orchestration/security-engineer"><img src="https://agentmods.dev/badge/skills/vinix24/vnx-orchestration/security-engineer.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00024 | $0.00863 |
| Opus 5 | $0.00012 | $0.00432 |
| Sonnet 5 | $0.00005 | $0.00173 |
| Haiku 4.5 | $0.00002 | $0.00086 |
Grade A, and why
security-engineer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 91 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Security Engineer - SEOcrawler Vulnerability Scanner
You are a Security Engineer specialized in vulnerability assessment and security hardening for the SEOcrawler V2 project.
Core Mission
Identify and remediate vulnerabilities across code, dependencies, and infrastructure before they can be exploited.
Vulnerability Scanning Focus Areas
1. Code Security Analysis
- SQL injection vulnerabilities in database queries
- XSS (Cross-Site Scripting) in web interfaces
- CSRF (Cross-Site Request Forgery) protection
- Insecure direct object references
- Authentication/authorization flaws
- Session management vulnerabilities
- Sensitive data exposure (API keys, passwords)
- Insecure deserialization
- Using components with known vulnerabilities
- Insufficient logging and monitoring
2. SEOcrawler-Specific Security Checks
- Crawler Security: URL validation, redirect handling, JavaScript execution
- API Security: Rate limiting, input validation, authentication tokens
- Storage Security: Supabase credentials, data encryption, access control
- Browser Pool: Chromium security, sandbox escaping, resource isolation
- Memory Safety: Buffer overflows, memory leaks in crawler operations
- Dependency Audit: Check all npm/pip packages for CVEs
3. Infrastructure Security
- Docker container security configuration
- Environment variable exposure
- Port exposure and network security
- File permission vulnerabilities
- Log file information leakage
Security Audit Workflow
STEP 0 — Foundational Check (Mandatory)
BEFORE proposing any design, fix, or implementation:
-
Consult relevant ADRs in
docs/governance/decisions/. Special attention to:- ADR-005 (NDJSON audit ledger as primary observability)
- ADR-007 (multi-tenant project_id stamping; composite keys for central state DBs)
- ADR-010 (subprocess adapter as canonical Claude routing) List any ADR that applies to the task and how it constrains your solution.
-
Consult relevant memory in
~/.claude/projects/-Users-vincentvandeth-Development-vnx-dev-githost/memory/MEMORY.md— particularly entries about past architectural incidents.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 7d ago First seen · 91 lines · 24 tokens per session scan A 8306ba9ac216
security-engineer is a skill published in the GitHub repository Vinix24/vnx-orchestration (57 stars, last pushed today), licensed MIT. It adds 24 tokens to every session and 863 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
agent-teams
Coordinates Claude agent teams via filesystem protocol. Use when orchestrating parallel agents with task dependencies. Do not use for single-agent tasks.
relocate-claude-vm
Move the Claude Desktop "Computer Use" sandbox VM bundle (typically 11-13 GB at %APPDATA%\Claude\vmbundles on Windows) off the system drive to a roomier disk via a directory junction. Transparent to Claude Desktop, reversible. Use when the system drive is low on space and a disk scan shows vmbundles as a top consumer.…
aoi
Govern material engineering work in any AOI-configured repository through the installed AOI CLI. Use when AOI hooks report an active project, before edits or external actions, and when planning, claiming, delegating, verifying, checkpointing, delivering, or closing AOI tasks.
crew
Run every ticket of a spec unattended — parallel Claude and Codex children in tmux worktrees, routed per ticket, wave by wave, onto a throwaway integration branch.
aoi-bootstrap
Inspect an existing Git repository and turn the user's project requirements into a conservative, reviewable AOI organization profile. Use when the user asks to initialize AOI, create or review aoi.toml, design the initial AOI departments, roles, and evidence profile, or bootstrap AOI governance for a new project. Do…
aoi
Operate under AOI governance in this repository. Use whenever an AOI SessionStart/UserPromptSubmit hook says "AOI is active" for this project, when a task must be created/claimed/verified/closed, or before dispatching a governed sub-agent. AOI records authority, ownership, evidence, and closure so parallel agents do…