xalgorix/xalgorix is a self-hosted AI penetration-testing tool in which an LLM agent performs reconnaissance, looks for vulnerabilities, and coordinates exploitation, while a separate verifier re-tests findings before reporting them. It is for security teams, ethical hackers, and bug bounty work using a private, bring-your-own-LLM setup. The catalogue skills extend the agent's pentesting workflow.
Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add xalgorix/xalgorix --skill implementing-api-key-security-controlsgit clone --depth 1 https://github.com/xalgorix/xalgorixWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/xalgorix/xalgorix/implementing-api-key-security-controls)<a href="https://agentmods.dev/skills/xalgorix/xalgorix/implementing-api-key-security-controls"><img src="https://agentmods.dev/badge/skills/xalgorix/xalgorix/implementing-api-key-security-controls/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/xalgorix/xalgorix/implementing-api-key-security-controls"><img src="https://agentmods.dev/badge/skills/xalgorix/xalgorix/implementing-api-key-security-controls.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Privilege Escalation · line 253 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00098 | $0.03833 |
| Opus 5.5 | $0.00039 | $0.01533 |
| Sonnet 5.5 | $0.00020 | $0.00767 |
| Haiku 4.5 | $0.00010 | $0.00383 |
Grade B, and why
implementing-api-key-security-controls scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Harvests environment variablesmediumData exfiltration
Enumerating or grepping the environment for keys collects credentials unrelated to what the mod says it does.
# Extract API key from header Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.
How it starts
The opening of the file, as written. The whole thing — 421 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Implementing API Key Security Controls
When to Use
- Designing secure API key generation with sufficient entropy and identifiable prefixes for leak detection
- Implementing server-side API key hashing (never storing keys in plaintext) with SHA-256 or bcrypt
- Building key rotation workflows that allow zero-downtime key replacement for API consumers
- Configuring per-key scoping to limit each API key to specific endpoints, IP ranges, and rate limits
- Setting up automated monitoring for API key leakage in GitHub repos, logs, and client-side code
Do not use API keys as the sole authentication mechanism for user-facing applications. API keys are best suited for server-to-server communication and developer access.
Common Misconfigurations & Verification
- Plaintext/at-rest storage: keys stored unhashed (or reversibly) leak wholesale on DB compromise - store SHA-256 hashes only.
- No identifiable prefix: without a
sk_live_-style prefix, secret scanners and gitleaks cannot catch leaked keys. - Keys in URLs: accepting keys in query params leaks them to logs, browser history, and Referer headers - require a header instead.
- No scoping/expiry: unscoped, non-expiring keys give a single leak full, permanent blast radius; enforce per-key scopes, IP allowlists, and TTL.
- No per-key rate limit: one compromised key can abuse the entire API.
- Rotation without grace period: hard-cutover rotation breaks consumers, which discourages rotation entirely.
How to verify it works: confirm the DB column holds only hashes (no recoverable key); submit a revoked key and confirm immediate rejection (cache invalidated); plant a prefixed test key in a repo and confirm the scanner/auto-revoke fires; call an out-of-scope endpoint or non-allowlisted IP with a scoped key and confirm 403; exceed the per-key limit and confirm throttling.
Prerequisites
- Secure random number generator (os.urandom, secrets module) for key generation
- Database with proper encryption at rest for storing hashed API keys
- Redis or similar store for key-to-metadata caching and rate limiting
- Secret scanning tools (GitHub secret scanning, truffleHog, gitleaks)
- Monitoring and alerting infrastructure for key usage anomalies
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 421 lines · 98 tokens per session scan B 143817b6adc6
implementing-api-key-security-controls is a skill published in the GitHub repository xalgorix/xalgorix (1,269 stars, last pushed today), licensed Apache-2.0. It adds 98 tokens to every session and 3,833 once invoked, about $0.0004 per session on Opus 5.5. A static security scan graded it B with 1 finding (harvests environment variables). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
implementing-api-key-security-controls
Implements secure API key generation, storage, rotation, and revocation controls to protect API authentication credentials from leakage, brute force, and abuse. The engineer designs API key formats with sufficient entropy, implements secure hashing for storage, enforces per-key scoping and rate limiting, monitors for…
implementing-api-key-security-controls
Implements secure API key generation, storage, rotation, and revocation controls to protect API authentication credentials from leakage, brute force, and abuse. The engineer designs API key formats with sufficient entropy, implements secure hashing for storage, enforces per-key scoping and rate limiting, monitors for…
conducting-api-security-testing
Conducts security testing of REST, GraphQL, and gRPC APIs to identify vulnerabilities in authentication, authorization, rate limiting, input validation, and business logic. The tester uses the OWASP API Security Top 10 as the testing framework, combining Burp Suite interception with Postman collections and custom…
bypassing-authentication-with-forced-browsing
Discovering and accessing unprotected pages, APIs, and administrative interfaces by enumerating URLs and bypassing authentication controls during authorized security assessments.
collecting-volatile-evidence-from-compromised-host
Collect volatile forensic evidence from a compromised system following order of volatility, preserving memory, network connections, processes, and system state before they are lost.
analyzing-ios-app-security-with-objection
Performs runtime mobile security exploration of iOS applications using Objection, a Frida-powered toolkit that enables security testers to interact with app internals without jailbreaking. Use when assessing iOS app security posture, bypassing client-side protections, dumping keychain items, inspecting filesystem…