Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add WrongStack/WrongStack --skill security-scannergit clone --depth 1 https://github.com/WrongStack/WrongStackWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/wrongstack/wrongstack/security-scanner)<a href="https://agentmods.dev/skills/wrongstack/wrongstack/security-scanner"><img src="https://agentmods.dev/badge/skills/wrongstack/wrongstack/security-scanner/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/wrongstack/wrongstack/security-scanner"><img src="https://agentmods.dev/badge/skills/wrongstack/wrongstack/security-scanner.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00053 | $0.00852 |
| Opus 5.5 | $0.00021 | $0.00341 |
| Sonnet 5.5 | $0.00011 | $0.00170 |
| Haiku 4.5 | $0.00005 | $0.00085 |
Grade A, and why
security-scanner scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 89 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Security Scanner
Selection card
- Task: Review source trust boundaries and defensive security.
- Start: Identify the scope and obtain an executable before-proof or review evidence.
- Finish: apply the acceptance checks below; report observed results and unresolved constraints.
Overview
Provide a defensive, evidence-led review of the requested source and configuration. Separate confirmed findings, supported static concerns and validation gaps. Use local, non-destructive tests of defensive behavior where appropriate.
Rules
- Identify scope, assets, entrypoints and trust boundaries. Read surrounding validators, authorization and cleanup before interpreting a scanner hit.
- Give every finding a real location, reachable condition, violated contract, impact, evidence level and concrete remediation.
- Severity follows impact, exposure and prerequisites. TLS, CORS or HTTP patterns are not automatically Critical without their deployed context.
- Redact credentials completely where possible. A test directory can contain real leaked credentials; distinguish known dummy fixtures from genuine values.
- Use the ecosystem's dependency audit and exact lockfile affected ranges when in scope. Audit output alone does not prove exploitable runtime usage.
- Do not contact suspected credentials/services or build attack workflows. Prefer source evidence and bounded tests that verify protective contracts.
Workflow
- Map the requested surface and preserve current dirty work.
- Collect candidates from available scanners and focused source searches. Exclude dependency/build trees from generic source scanning; inspect vendored or generated code only when it forms the actual requested boundary.
- Trace untrusted inputs to privileged operations and protective checks. Check object-level authorization, logging/redaction, resource limits and lifecycle ownership where applicable.
- For dependencies, verify official advisories and affected/resolved versions. Distinguish direct, transitive, build-only and production use.
- Review each candidate independently for reachability and existing protection. Use non-destructive local negative tests; label untested deployment assumptions.
- Report prioritized findings and precise defensive fixes. For review-only requests, leave production files unchanged; apply authorized remediation within scope and run the affected checks.
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago Changed 48f0986dd99b
- 6d ago Changed · -115 lines · -1 tokens per session b815b47edec8
- 29d ago Changed · +4 lines · -5 tokens per session a55efb6fa26c
- 1mo ago First seen · 200 lines · 59 tokens per session scan A 9ebfdb67ffe3
security-scanner is a skill published in the GitHub repository WrongStack/WrongStack (376 stars, last pushed today), licensed MIT. It adds 53 tokens to every session and 852 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
managing-mcp-servers
Use when the user asks to add, change, remove, enable or disable an MCP server, or when an MCP tool is missing, needs sign-in, fails, or was blocked. ThinkRail runs pi in-process, so there is no pi command to call.
todos
Use when the user asks for a shared plan, a task needs at least three substantive execution steps, or a loose TODO is pending. Without an explicit plan request, not for one-shot answers or checks, or one- to two-step work that is not already in the list.
research-repository
Build a repository that makes findings findable, reusable, and cumulative across teams. Use when the same research keeps getting redone. For synthesising one study, use affinity-diagram.
form-design
Design a form end to end — field order, grouping, validation, and completion. Use when the artifact is a form. For product-wide error strategy use error-handling-ux; for first-run signup use onboarding-design.
peak-end-rule
Apply the Peak-End Rule — a flow is remembered by its most intense moment and its last. Use when designing completion, celebration, or cancellation moments. For sustaining engagement mid-flow, use zeigarnik-effect.
goal-writer
Help the user craft one or more well-specified /goal objectives for goal mode. Use when the user asks for help writing, refining, or improving goals, goal-mode objectives, completion contracts, autonomous run objectives, proof, boundaries, or stop rules.