Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/xcodethink/open-claude-code-skills/04npx skills add xcodethink/open-claude-code-skills --skill 04git clone --depth 1 https://github.com/xcodethink/open-claude-code-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/xcodethink/open-claude-code-skills/04)<a href="https://agentmods.dev/skills/xcodethink/open-claude-code-skills/04"><img src="https://agentmods.dev/badge/skills/xcodethink/open-claude-code-skills/04.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00219 | $0.00722 |
| Opus 5 | $0.00110 | $0.00361 |
| Sonnet 5 | $0.00044 | $0.00144 |
| Haiku 4.5 | $0.00022 | $0.00072 |
Grade A, and why
04-安全规范 scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
安全规范
文档索引
SECURITY.md— 安全架构规范（传输层安全、认证授权、防重放、限流、设备指纹、数据加密、审计日志、异常检测、环境变量）后台面板安全规范.md— 后台面板安全（路径随机化、Server Layout + Client Shell 双层架构、noindex 防爬、登录按角色跳转、公开入口清除、部署文档模板、避坑指南）合规审计规范.md— 合规与隐私（GDPR/CCPA/PIPL/Apple 审核、健康数据保护、同意框架、数据保留、DPIA、事件响应）安全测试与安全运维规范.md— 安全测试与运维（OWASP Top 10 防御、安全扫描工具链 SAST/DAST/SCA/Secret Scan、渗透测试清单、漏洞管理生命周期、供应链安全、运行时安全监控 WAF/Bot/DDoS、平台安全加固 Cloudflare、定期审计制度、安全事件响应剧本）
使用指南
| 场景 | 读取文档 |
|---|---|
| 设计安全架构（认证/加密/限流） | SECURITY.md |
| 创建或改造管理后台/运营后台 | 后台面板安全规范.md |
| 处理用户隐私/数据合规 | 合规审计规范.md |
| 执行安全测试/审计 | 安全测试与安全运维规范.md |
| 上线前安全检查 | 安全测试与安全运维规范.md → 九、定期安全审计制度 |
| 安全事件响应 | 安全测试与安全运维规范.md → 十、安全事件响应剧本 |
与其他规范的关系
- 基础安全编码规则 →
01-通用要求/安全规范.md - 部署安全检查 →
06-部署和运维/运维检查/安全检查清单.md - CI 安全扫描流水线 →
07-测试规范/CI测试和安全流水线.md - 代码审查安全清单 →
05-开发协作/代码审查规范.md
What ships with it
6 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 32 lines · 219 tokens per session scan A a13be3e20058
04-安全规范 is a skill published in the GitHub repository xcodethink/open-claude-code-skills (2 stars, last pushed 29d ago), licensed MIT. It adds 219 tokens to every session and 722 once invoked, about $0.0011 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
om-ds-guardian
Design System Guardian for Open Mercato. Use for frontend UI work, design-system compliance reviews, semantic token migration, hardcoded color or typography cleanup, DS-compliant page scaffolding, and common DS violations such as arbitrary text sizes, raw color classes, or missing shared states. Prefer this skill…
om-implement-spec
Implement a specification (or specific phases) using coordinated subagents with unit tests, integration tests, docs, and code-review compliance. Tracks progress by updating the spec. Triggers on "implement spec", "implement phases", "build from spec", "code the spec".
personal-data-protection
Personal-data-protection compliance reference for engineers building applications subject to Singapore PDPA, Indonesia UU PDP 27/2022, Thailand PDPA B.E. 2562 (2019), Malaysia PDPA 2010 (with the 2024 Amendments), or Philippines DPA (RA 10173). Use when reviewing or modifying code that touches personal data …
memstack-business-gdpr
Use this skill when the user says 'GDPR', 'data protection', 'privacy compliance', 'DPA', 'DSAR', 'data subject request', 'cookie consent', 'privacy audit', 'CCPA', or asks 'do I need GDPR for this repo'. Scans the repository to detect what personal data is collected, classifies sensitivity, determines whether GDPR…
ss-review
Review UI code for design system compliance, accessibility, and best practices.
code-reviewer
Review completed implementation batches for spec compliance and code quality. Invoke after execution batches complete, before merging, or when a review gate is reached in the workflow.