Borrowing it
Nothing to install: this file belongs to zexion7873/copilot-setting. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/zexion7873/copilot-setting/main/.github/skills/security-audit/SKILL.mdgit clone --depth 1 https://github.com/zexion7873/copilot-settingWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/zexion7873/copilot-setting/security-audit)<a href="https://agentmods.dev/skills/zexion7873/copilot-setting/security-audit"><img src="https://agentmods.dev/badge/skills/zexion7873/copilot-setting/security-audit/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/zexion7873/copilot-setting/security-audit"><img src="https://agentmods.dev/badge/skills/zexion7873/copilot-setting/security-audit.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00083 | $0.01351 |
| Opus 5.5 | $0.00033 | $0.00540 |
| Sonnet 5.5 | $0.00017 | $0.00270 |
| Haiku 4.5 | $0.00008 | $0.00135 |
Grade A, and why
security-audit scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 96 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Security Audit — Workflow
OWASP Top 10 focused audit. Security rules: instructions/security.instructions.md.
Phase 0 — Load canonical rules
MANDATORY pre-load gate — do NOT report findings (Phase 4) until you have opened the instruction files for the code under audit. Your training data defaults to modern Java/Spring; these files are the version lock for Java 8 / Spring 3.2 / Hibernate 4.2. Open them first, every time — the negative lists in the agent body are a floor, not the full rules. Read-back receipt: NAME each file you opened and QUOTE its single most load-bearing rule for this change — a generic restatement you could have written from memory means you skipped the file.
Code under audit — open each one: instructions/security.instructions.md, instructions/sql.instructions.md, instructions/jsp.instructions.md.
Phase 1 — Map Attack Surface
- Identify entry points: servlets, controllers, API endpoints, file uploads
- Identify data flows: user input → processing → storage → output
- Identify trust boundaries: authenticated vs public, admin vs user
Phase 2 — Check by OWASP Category
For each entry point, trace data flow from input → processing → storage → output and check:
A01 Broken Access Control (check each):
- Every endpoint enforces role/permission — not just login check
- Object references (ID in URL/param) validated against current user's ownership (IDOR)
- No path traversal: file paths from user input sanitized
- HTTP method restrictions enforced (mutations via POST/PUT/DELETE only — never GET;
@RequestMappingdeclaresmethod) - CSRF: all state-changing POST forms carry a CSRF token (Spring Security 3.2
<csrf>config or manual token+session check)
A02 Cryptographic Failures (check each):
- Passwords hashed with bcrypt or Argon2 per
instructions/security.instructions.mdA02 — never plaintext, MD5, or SHA1 - Sensitive data encrypted at rest and in transit
- No secrets in logs, error messages, or client responses
- No hardcoded credentials in source or config — search for password/secret/apikey/token literals
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago Changed · -4 lines 36424179faf0
- 2mo ago First seen · 100 lines · 83 tokens per session scan A 669b10b89ad6
security-audit is a skill published in the GitHub repository zexion7873/copilot-setting (1 stars, last pushed 1mo ago), licensed MIT. It adds 83 tokens to every session and 1,351 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
security-audit compared with skills from other repositories
| Mod | Type | Stars | Last push | Licence | Scan | Tokens | Works with |
|---|---|---|---|---|---|---|---|
| security-auditzexion7873/copilot-setting | Skill | 1 | 1mo ago | MIT | A | 83 | Claude Code, Codex |
| jira-cliCode-and-Sorts/awesome-copilot-agents | Skill | 593 | 6mo ago | CC0-1.0 | A | 60 | Claude Code, Codex |
| azure-pricesCode-and-Sorts/awesome-copilot-agents | Skill | 593 | 6mo ago | CC0-1.0 | A | 90 | Claude Code, Codex |
| calculatorCode-and-Sorts/awesome-copilot-agents | Skill | 593 | 6mo ago | CC0-1.0 | A | 50 | Claude Code, Codex |
| az-cliCode-and-Sorts/awesome-copilot-agents | Skill | 593 | 6mo ago | CC0-1.0 | A | 79 | Claude Code, Codex |
| plan-tasksavedpixel/ai-agent-rules-generator | Skill | 8 | 6mo ago | MIT | A | 45 | Claude Code, Codex |
| commitsavedpixel/ai-agent-rules-generator | Skill | 8 | 6mo ago | MIT | A | 40 | Claude Code, Codex |