Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add Yashvendra/claude-security-skills --skill vuln-assessmentgit clone --depth 1 https://github.com/Yashvendra/claude-security-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/yashvendra/claude-security-skills/vuln-assessment)<a href="https://agentmods.dev/skills/yashvendra/claude-security-skills/vuln-assessment"><img src="https://agentmods.dev/badge/skills/yashvendra/claude-security-skills/vuln-assessment/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/yashvendra/claude-security-skills/vuln-assessment"><img src="https://agentmods.dev/badge/skills/yashvendra/claude-security-skills/vuln-assessment.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00203 | $0.07568 |
| Opus 5 | $0.00102 | $0.03784 |
| Sonnet 5 | $0.00041 | $0.01514 |
| Haiku 4.5 | $0.00020 | $0.00757 |
Grade B, and why
vuln-assessment scanned grade B with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Enumerates other installed skillslowAgent snooping
Other skills' SKILL.md files reveal prompts, capabilities and secrets that should be invisible to peers.
find ~/.claude/skills -name "generate_report_html.py" 2>/dev/null | head -1 Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.
Cloud metadata endpointmediumServer-side request forgery
One request to 169.254.169.254 can return temporary IAM credentials.
- **SSRF → Cloud metadata → credential exfil**: An SSRF that can reach `169.254.169.254` gives Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.
How it starts
The opening of the file, as written. The whole thing — 677 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Vulnerability Assessment Report Skill
What This Produces
A professional PDF vulnerability assessment report (dark navy theme, severity-coded finding cards, CVSS scores, code evidence, remediation guidance, prioritized roadmap) — the same quality as a manual pentest report, generated from a 6-phase pipeline.
Output: <ProjectName>_Vulnerability_Report.pdf saved in the target directory.
Step 0 — Gather Inputs (ask the user)
Before starting, collect the minimum required information:
1. Target path
If not already specified, ask:
"Which directory should I audit? (default: current working directory)"
2. Git branch selection (if it's a git repo)
Check if the target is a git repository:
git -C <target_path> rev-parse --is-inside-work-tree 2>/dev/null
If yes, list available branches and ask:
git -C <target_path> branch -a --format='%(refname:short)'
Then ask the user:
"This is a git repository. Which branch(es) would you like to audit?
Available branches:
main(current)developfeature/auth-refactor- ...
Options:
- Single branch: Enter a branch name (or press Enter to use current)
- Multiple branches: Comma-separate names to get one report per branch
- Comparison: Two branches to highlight new vulnerabilities introduced
If the user picks multiple branches or comparison mode, run the full 6-phase pipeline
independently for each branch (using git worktrees — see Branch Checkout below)
and generate a separate PDF per branch. Name them:
<ProjectName>_<BranchName>_Vulnerability_Report.pdf
3. Additional export formats (optional)
After asking about the watermark, ask:
"Beyond the PDF, would you also like any of these machine-readable exports?
- CSV — flat spreadsheet with all findings; import directly into Excel, Jira, or any SIEM
- OCSF JSON — Open Cybersecurity Schema Framework v1.2.0 (class 2002 — Vulnerability Finding); native ingestion format for AWS Security Lake, Splunk, Chronicle, Elastic Security, and Microsoft Sentinel
Reply with one or more:
CSV,OCSF,both, or press Enter to skip."
What ships with it
22 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- assets/fonts/manifest.json 4.8 KB
- assets/fonts/space_grotesk_300_normal.woff2 22 KB
- assets/fonts/space_grotesk_400_normal.woff2 22 KB
- assets/fonts/space_grotesk_500_normal.woff2 22 KB
- assets/fonts/space_grotesk_600_normal.woff2 22 KB
- assets/fonts/space_grotesk_700_normal.woff2 22 KB
- assets/fonts/space_mono_400_italic.woff2 18 KB
- assets/fonts/space_mono_400_normal.woff2 16 KB
- assets/fonts/space_mono_700_normal.ttf 78 KB
- assets/fonts/space_mono_700_normal.woff2 16 KB
- assets/fonts/syne_400_normal.woff2 34 KB
- assets/fonts/syne_600_normal.woff2 34 KB
- assets/fonts/syne_700_normal.woff2 34 KB
- assets/fonts/syne_800_normal.woff2 34 KB
- evals/evals.json 9.6 KB
- evals/fixtures/layout_test/_vuln_findings.json 25 KB
- evals/run_layout_test.sh 8.6 KB runs code
- references/cvss_guide.md 4.0 KB
- references/vuln_checklist.md 35 KB
- scripts/__pycache__/generate_report_html.cpython-312.pyc 100 KB
- scripts/generate_guide_html.py 31 KB runs code
- scripts/generate_report_html.py 93 KB runs code
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago First seen · 677 lines · 203 tokens per session scan B 7527690ba063
vuln-assessment is a skill published in the GitHub repository Yashvendra/claude-security-skills (2 stars, last pushed 5mo ago), licensed MIT. It adds 203 tokens to every session and 7,568 once invoked, about $0.0010 per session on Opus 5. A static security scan graded it B with 2 findings (enumerates other installed skills, cloud metadata endpoint). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
document-skills
Professional document creation, editing, and analysis for Office formats (docx, pdf, pptx, xlsx). Use when working with Word documents, PDFs, PowerPoint presentations, or Excel spreadsheets.
dev-document
Document generation (PDF, DOCX, XLSX, PPTX). Trigger when the user wants to create a document, generate a report, export to PDF/Word/Excel/PowerPoint, or produce an office file.
Comprehensive PDF manipulation toolkit for extracting text and tables, creating new PDFs, merging/splitting documents, and handling forms. When Claude needs to fill in a PDF form or programmatically process, generate, or analyze PDF documents at scale.
pdf-handling
Extract PDFs to text and images before reading.
PDF files: create, read, merge, fill, OCR, edit text.
wowerpoint
Turn one document into a kawaii NotebookLM slide-deck PDF. Use for "wowerpoint this", "make a deck about ", "turn this report into slides", or any request to render a single document as shareable narrative slides.