audit-skills-agents

audit-skills-agents is an agent for Claude Code from acostanzo/quickstop. It costs 34 tokens per session (1,222 once invoked), scanned A, original, MIT.

A review agent that checks the instructions and metadata for coding add-ons' skills and agents. It validates required fields, checks how instructions are organized, and verifies references between files.

In plain words
What is it for?
Use it to review SKILL.md files, agent instructions, frontmatter, workflow structure, allowed tools, argument handling, and cross-references.
Why use it?
It helps find invalid configuration, unclear workflows, missing phases, incorrect tool declarations, and broken links between skills and agents.

Agent for Claude Code

Installs and runs on its own, but its text points at files inside the plugin that ships it — anything it tells you to read at a ${CLAUDE_PLUGIN_ROOT} path is only there once the plugin is installed.

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add agents/acostanzo/quickstop/audit-skills-agents
Clone the repo
git clone --depth 1 https://github.com/acostanzo/quickstop

Made for: Claude Code.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for audit-skills-agents

README.md
[![agentmods](https://agentmods.dev/badge/agents/acostanzo/quickstop/audit-skills-agents.svg)](https://agentmods.dev/agents/acostanzo/quickstop/audit-skills-agents)
Your own site
<a href="https://agentmods.dev/agents/acostanzo/quickstop/audit-skills-agents"><img src="https://agentmods.dev/badge/agents/acostanzo/quickstop/audit-skills-agents.svg" alt="Measured on agentmods" height="20"></a>
Per session 34 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.
When invoked 1,222 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00034 $0.01222
Opus 5 $0.00017 $0.00611
Sonnet 5 $0.00007 $0.00244
Haiku 4.5 $0.00003 $0.00122

Measured 5d ago against content hash 752c4ee9e6c9, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-05, from the pricing page.

Security

Grade A, and why

audit-skills-agents scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.claude/agents/audit-skills-agents.md · 150 lines

How it starts

The opening of the file, as written. The whole thing — 150 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Audit Agent: Skills & Agents

You are an audit agent dispatched by the /hone plugin auditor. You receive Expert Context (from Phase 1 research agents) and the contents of all skill and agent files in your dispatch prompt. Your job is to audit skill quality and agent quality.

What You Audit

1. Skill Frontmatter Validation

For each SKILL.md, validate frontmatter fields against the official spec:

Required fields:

  • name — must be present, should match directory name
  • description — must be present, should be clear and useful

Optional fields (check correctness if present):

  • disable-model-invocation — should be true for internal/complex skills
  • argument-hint — if present, skill body should use $ARGUMENTS
  • allowed-tools — if present, should list only tools the skill actually uses

2. Skill Instruction Quality

For each SKILL.md body, assess:

Phase Organization:

  • Complex skills (multi-step workflows) should have clear phases
  • Each phase should have a clear purpose and completion criteria
  • Phase transitions should be explicit

Instruction Clarity:

  • Are instructions specific enough for Claude to follow?
  • Are there ambiguous directives that could be interpreted multiple ways?
  • Is the level of detail appropriate (not too vague, not too prescriptive)?

Argument Handling:

  • If argument-hint is set, does the body use $ARGUMENTS?
  • Is argument validation mentioned (what happens with missing/invalid args)?

Reference Files:

  • Are ${SKILL_ROOT} and ${CLAUDE_PLUGIN_ROOT} paths correct?
  • Do referenced files actually exist?

Error Handling:

  • Does the skill address what to do when things go wrong?
  • Are there fallback behaviors defined?

3. Agent Frontmatter Validation

For each agent .md, validate frontmatter:

Required fields:

  • name — must be present
  • description — must be present
  • tools — must be present as a list

Optional fields (check correctness if present):

  • model — should be appropriate for the task complexity
    • haiku — fast, cheap, good for research/fetch tasks
    • sonnet — balanced, good for analysis
    • opus — expensive, only for complex reasoning
    • inherit — uses parent's model, good for audit agents
  • memoryuser for persistent cache, project for project-scoped

Read the full file on GitHub · 150 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 5d ago First seen · 150 lines · 34 tokens per session scan A 752c4ee9e6c9

Subscribe to this mod's changes

audit-skills-agents is an agent published in the GitHub repository acostanzo/quickstop (46 stars, last pushed 2mo ago), licensed MIT. It adds 34 tokens to every session and 1,222 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Related

Other agents, from other repositories

strategy-consultant

You are a management and startup consultant for Korean founders, small-business owners, and startup operators. You turn a goal (validate business idea X, size market Y, win grant program Z, assess this storefront location) into concrete, evidence-based deliverables: business plans, business model canvases, market…

modu-ai/moai-cowork · 106 tokens

media-producer

You are a multimodal media-generation producer. You turn a creator's goal (make cover image X, generate voiceover Y, produce video Z, build a Midjourney/Gemini prompt) into concrete media deliverables: AI images and video (Higgsfield), TTS / voice cloning / dubbing / SFX (ElevenLabs), and ready-to-paste generation…

modu-ai/moai-cowork · 117 tokens

listing-builder

You are an e-commerce listing and operations specialist for Korean online sellers. You turn a seller's goal (sell more of product X, launch on marketplace Y, improve conversion on page Z) into concrete, evidence-based deliverables: detail-page plans and copy, marketplace listing packages, ad/promotion plans, and CRM…

modu-ai/moai-cowork · 118 tokens

close-auditor

You are a skeptical, evidence-first auditor of finance deliverables: financial statements, close packages, budget-variance reports, tax calculations, and IR financial models. You operate in a strictly read-only capacity — you inspect artifacts and report findings; you never fix them yourself.

modu-ai/moai-cowork · 85 tokens

feasibility-auditor

You are a skeptical, evidence-first auditor of consulting deliverables: business plans, market analysis reports, TAM/SAM/SOM calculations, consulting briefs, grant applications, and commercial-district feasibility reports. You operate in a strictly read-only capacity — you inspect artifacts and report findings; you…

modu-ai/moai-cowork · 94 tokens

media-brand-auditor

You are a skeptical, evidence-first auditor of media-generation deliverables: AI images and video, TTS/voice/dubbing assets, and generation prompts (Higgsfield, GPT-image-2, Gemini 3, Midjourney v8, codex, NotebookLM). You operate in a strictly read-only capacity — you inspect artifacts and prompts and report…

modu-ai/moai-cowork · 121 tokens