Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add YuDefine/nuxt-supabase-starter --skill security-evidencegit clone --depth 1 https://github.com/YuDefine/nuxt-supabase-starterWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/yudefine/nuxt-supabase-starter/security-evidence)<a href="https://agentmods.dev/skills/yudefine/nuxt-supabase-starter/security-evidence"><img src="https://agentmods.dev/badge/skills/yudefine/nuxt-supabase-starter/security-evidence/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/yudefine/nuxt-supabase-starter/security-evidence"><img src="https://agentmods.dev/badge/skills/yudefine/nuxt-supabase-starter/security-evidence.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00064 | $0.00682 |
| Opus 5 | $0.00032 | $0.00341 |
| Sonnet 5 | $0.00013 | $0.00136 |
| Haiku 4.5 | $0.00006 | $0.00068 |
Grade A, and why
security-evidence scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
security-evidence
兩個 mode，各對應一份逐字 prompt（references/）。MUST 先讀 modes.md 判 mode，再讀對應 reference 全文照它的 context-gathering 逐步問——它們刻意分小步等答案，不要一次把全部問題丟出去。
| mode | 什麼時候 | reference | 產物 |
|---|---|---|---|
finding |
一次一則 finding；報告出現 High / Medium、看不懂、有爭議、修之前 | references/finding-evidence-explainer.md |
Finding Evidence Review：Source / Control / Sink、反證、Severity 與 Confidence 分開、Coverage、Proof Gaps、verdict（accept / needs more validation / unsupported） |
map |
上線前、重大改版、修完重要 finding、掃描回 No findings | references/production-blind-spot-mapper.md |
Production Security Evidence Map：五層 Coverage、P0 / P1 / P2 清單（pass condition、evidence、owner）、scope-limited verdict |
讀取順序（唯讀）
- target 的
SECURITY.md（安全憲法）——每一條INV-n都是判 counterevidence 的依據；沒有這份就先說明 Confidence 會被壓低 - finding 原文（
<output_dir>/findings.json該條 +report.md對應段）與coverage.json的 Coverage - 被點名的檔案及其直接 caller / callee；NEVER 無方向爬 codebase
出口
- verdict
accept/needs more validation→ 登 TD（consumer 自家docs/tech-debt.md），### 自驗寫 Proof Gap 的驗證動作；修完跑scripts/security-scan.ts verify --finding <id> - verdict
unsupported→ 寫進本次 review 報告，不開 TD、不改 code map的 P0 / P1 每一項各登一條 TD，owner 缺就寫Owner Missing，NEVER 自己指派
NEVER
- NEVER 把 scanner 的 High 標籤當成 Severity 與 Confidence 都是 High——兩者分開判
- NEVER 因為
No findings就給 READY 或「安全」 - NEVER 要 secret 值或真實客戶資料；要 key 名與遮蔽片段
- NEVER 對 production 發測試流量或改設定；本 skill 只產出判讀與驗證計畫
What ships with it
3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- today Changed · -4 lines ba34b3684ad2
- 4d ago Changed · +4 lines 509acb1e135f
- 8d ago First seen · 42 lines · 64 tokens per session scan A 4f8df08d0c3f
security-evidence is a skill published in the GitHub repository YuDefine/nuxt-supabase-starter (45 stars, last pushed today), licensed MIT. It adds 64 tokens to every session and 682 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
prd-v07-implementation-loop
Execute implementation within EPICs following test-first development, continuous SoT updates, and code traceability during PRD v0.7 Build Execution. Triggers on requests to start building, implement an epic, begin coding, or when user asks "start building", "implement epic", "coding", "development", "build execution"…
prd-v07-test-planning
Define test cases BEFORE implementation, ensuring every API, business rule, and user journey has verifiable acceptance criteria during PRD v0.7 Build Execution. Triggers on requests to define tests, plan test coverage, create test cases, or when user asks "define tests", "test planning", "what to test?", "test cases"…
strict-tdd
Strict RED->GREEN->REFACTOR test-driven development with enforcement. Never write production code before a failing test. Atomic commits per TDD cycle.
prd-v04-user-journey-mapping
Map user missions from trigger to value moment, organizing features into coherent paths during PRD v0.4 User Journeys. Triggers on requests to map user journeys, define user flows, describe how users accomplish goals, or when user asks "map user journeys", "define user flows", "user missions", "how do users accomplish…
atomic-tdd
Test-first discipline. Auto-triggers on "let's implement X", "add feature Y", "fix bug Z", "write a test for", "implement", "build out", and similar pre-code-change phrases. Iron rule: failing test exists before production code. Skip only for pure docs/config changes with an explicit "skipped because:" note. Explicit…
use-tdd
Implement a requested increment with red-green-refactor. Use when the user types /use-tdd.