AI Agent Skills — what each costs to run

Estimated input cost per 1,000 loads of SKILL.md only (characters ÷ 4). Bundled files, output tokens and execution are excluded.

244 curated skills · Verified 2026-10-28

20 skills

  • audit-context-building
    security

    trailofbits/skills

    Understand a codebase before looking for bugs in it - what each function assumes, what it guarantees, and what it depends on elsewhere. Use when starting an audit, threat model, or architecture review on unfamiliar code, and before any vuln

    SKILL.md tokens
    995
    Sonnet 5 / 1k loads
    $1.99
    No flags detected
  • security-threat-model
    security

    openai/skills

    Repository-grounded threat modeling that enumerates trust boundaries, assets, attacker capabilities, abuse paths, and mitigations, and writes a concise Markdown threat model. Trigger only when the user explicitly asks to threat model a code

    SKILL.md tokens
    1,389
    Sonnet 5 / 1k loads
    $2.78
    No flags detected
  • threat-model-analyst
    security

    github/awesome-copilot

    Full STRIDE-A threat model analysis and incremental update skill for repositories and systems. Supports two modes: (1) Single analysis — full STRIDE-A threat model of a repository, producing architecture overviews, DFD diagrams, STRIDE-A an

    SKILL.md tokens
    1,462
    Sonnet 5 / 1k loads
    $2.92
    No flags detected
  • firebase-apk-scanner
    security

    trailofbits/skills

    Scans Android APKs for Firebase security misconfigurations including open databases, storage buckets, authentication issues, and exposed cloud functions. Use when analyzing APK files for Firebase vulnerabilities, performing mobile app secur

    SKILL.md tokens
    1,687
    Sonnet 5 / 1k loads
    $3.37
    Runs scripts
    Network access
    Shell commands
  • semgrep-rule-creator
    security

    trailofbits/skills

    Creates custom Semgrep rules for detecting security vulnerabilities, bug patterns, and code patterns. Use when writing Semgrep rules or building custom static analysis detections.

    SKILL.md tokens
    1,823
    Sonnet 5 / 1k loads
    $3.65
    Network access
  • differential-review
    security

    trailofbits/skills

    Performs security-focused differential review of code changes. Adapts analysis depth to codebase size, uses git blame for context, calculates blast radius by counting callers, checks test coverage of modified code, and generates a markdown

    SKILL.md tokens
    1,834
    Sonnet 5 / 1k loads
    $3.67
    Shell commands
  • security-best-practices
    security

    openai/skills

    Perform language and framework specific security best-practice reviews and suggest improvements. Trigger only when the user explicitly requests security best practices guidance, a security review/report, or secure-by-default coding help. Tr

    SKILL.md tokens
    2,153
    Sonnet 5 / 1k loads
    $4.31
    Shell commands
  • secret-scanning
    security

    github/awesome-copilot

    Guide for configuring and managing GitHub secret scanning, push protection, custom patterns, and secret alert remediation. For pre-commit secret scanning in AI coding agents via the GitHub MCP Server, this skill references the Advanced Secu

    SKILL.md tokens
    2,386
    Sonnet 5 / 1k loads
    $4.77
    Network access
    Shell commands
  • github-actions-hardening
    security

    github/awesome-copilot

    Security hardening reviewer for GitHub Actions workflow files (.github/workflows/*.yml). Reasons about the Actions threat model that pattern matchers and general code linters miss — untrusted-input script injection, privileged triggers runn

    SKILL.md tokens
    2,447
    Sonnet 5 / 1k loads
    $4.89
    Shell commands
  • entry-point-analyzer
    security

    trailofbits/skills

    Analyzes smart contract codebases to identify state-changing entry points for security auditing. Detects externally callable functions that modify state, categorizes them by access level (public, admin, role-restricted, contract-only), and

    SKILL.md tokens
    2,646
    Sonnet 5 / 1k loads
    $5.29
    Shell commands
  • sharp-edges
    security

    trailofbits/skills

    Identifies error-prone APIs, dangerous configurations, and footgun designs that enable security mistakes. Use when reviewing API designs, configuration schemas, cryptographic library ergonomics, or evaluating whether code follows 'secure by

    SKILL.md tokens
    2,953
    Sonnet 5 / 1k loads
    $5.91
    No flags detected
  • agent-owasp-compliance
    security

    github/awesome-copilot

    Check any AI agent codebase against the OWASP Agentic Security Initiative (ASI) Top 10 risks. Use this skill when: - Evaluating an agent system's security posture before production deployment - Running a compliance check against OWASP ASI 2

    SKILL.md tokens
    2,969
    Sonnet 5 / 1k loads
    $5.94
    Network access
    Shell commands
  • mcp-security-audit
    security

    github/awesome-copilot

    Audit MCP (Model Context Protocol) server configurations for security issues. Use this skill when: - Reviewing .mcp.json files for security risks - Checking MCP server args for hardcoded secrets or shell injection patterns - Validating that

    SKILL.md tokens
    3,108
    Sonnet 5 / 1k loads
    $6.22
    Network access
    Shell commands
  • token-integration-analyzer
    security

    trailofbits/skills

    Token integration and implementation analyzer based on Trail of Bits' token integration checklist. Analyzes token implementations for ERC20/ERC721 conformity, checks for 20+ weird token patterns, assesses contract composition and owner priv

    SKILL.md tokens
    3,156
    Sonnet 5 / 1k loads
    $6.31
    No flags detected
  • constant-time-analysis
    security

    trailofbits/skills

    Detects timing side-channel vulnerabilities in cryptographic code. Use when implementing or reviewing crypto code, encountering division on secrets, secret-dependent branches, or constant-time programming questions in C, C++, Go, Rust, Swif

    SKILL.md tokens
    3,285
    Sonnet 5 / 1k loads
    $6.57
    Network access
    Shell commands
  • dependabot
    security

    github/awesome-copilot

    Comprehensive guide for configuring and managing GitHub Dependabot. Use this skill when users ask about creating or optimizing dependabot.yml files, managing Dependabot pull requests, configuring dependency update strategies, setting up gro

    SKILL.md tokens
    3,393
    Sonnet 5 / 1k loads
    $6.79
    Network access
    Shell commands
  • security-and-hardening
    security

    addyosmani/agent-skills

    Hardens code against vulnerabilities. Use when auditing an input handler for vulnerabilities, when handling user input, authentication, data storage, or external integrations, or when checking a login flow is safe against the OWASP Top Ten.

    SKILL.md tokens
    4,382
    Sonnet 5 / 1k loads
    $8.76
    Network access
    Shell commands
  • codeql
    security

    trailofbits/skills

    Scans a codebase for security vulnerabilities using CodeQL's interprocedural data flow and taint tracking analysis. Triggers on "run codeql", "codeql scan", "build codeql database", "SAST scan", "taint analysis", "dataflow analysis", or "fi

    SKILL.md tokens
    4,617
    Sonnet 5 / 1k loads
    $9.23
    Runs scripts
    Network access
    Shell commands
  • agentic-actions-auditor
    security

    trailofbits/skills

    Audits GitHub Actions workflows for security vulnerabilities in AI agent integrations including Claude Code Action, Gemini CLI, OpenAI Codex, and GitHub AI Inference. Detects attack vectors where attacker-controlled input reaches AI agents

    SKILL.md tokens
    5,435
    Sonnet 5 / 1k loads
    $10.87
    Network access
  • turnstile-spin
    security

    cloudflare/skills

    Set up, repair, or migrate to Cloudflare Turnstile bot verification in an existing frontend and backend, including server-side Siteverify.

    SKILL.md tokens
    7,167
    Sonnet 5 / 1k loads
    $14.33
    Runs scripts
    Network access
    Shell commands