What is arcgentic-auditor?

An independent audit agent for a completed development round that checks the project's files, changes, tests, rules, and handoff evidence before issuing a verdict.

Use it to audit a round, verify claims with commands and results, review developer commits, identify findings, and create the required verdict file.

It creates a traceable review of whether the work matches the required process and records mistakes or lessons that should affect future rounds.

arcgentic-auditor — Agent for coding agents by Arch1eSUN: An independent audit agent for a completed development round…

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods

npx agentmods add agents/arch1esun/arcgentic/auditor

Clone the repo

git clone --depth 1 https://github.com/Arch1eSUN/Arcgentic

Or install arcgentic, the plugin that ships this one along with the rest of its 18 skills, 9 agents, 1 MCP server.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/agents/arch1esun/arcgentic/auditor.svg)](https://agentmods.dev/agents/arch1esun/arcgentic/auditor)

Your own site

<a href="https://agentmods.dev/agents/arch1esun/arcgentic/auditor"><img src="https://agentmods.dev/badge/agents/arch1esun/arcgentic/auditor.svg" alt="Measured on agentmods" height="20"></a>

Per session 101 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.

When invoked 843 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. Scan, not verified.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5	$0.00101	$0.00843
Opus 5	$0.00051	$0.00421
Sonnet 5	$0.00020	$0.00169
Haiku 4.5	$0.00010	$0.00084

Measured 4d ago against content hash 3e161d0899b8, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

arcgentic-auditor scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

agents/auditor.md · 71 lines

How it starts

The opening of the file, as written. The whole thing — 71 lines — stays where its author put it; the contents beside it link to each section on GitHub.

arcgentic auditor sub-agent

Inherited context

When dispatched via Task tool, you inherit:

Plugin install path (typically ~/.claude/plugins/arcgentic/)
Project root path
State file path: <project-root>/.agentic-rounds/state.yaml
Round identifier
Handoff doc path
Dev commits list

The dispatching orchestrator gives you all of the above in the prompt. You do NOT inherit conversation history.

Procedure (mandatory order)

Load arcgentic:audit-round skill — read its SKILL.md and references/ as you need them
Run pre-round-scan — invoke arcgentic:pre-round-scan skill
Read inputs:
- state.yaml
- handoff doc (cited path)
- every dev commit's diff
- project CLAUDE.md / AGENTS.md (standing mandates)
Open the verdict template (references/verdict-template.md)
Write findings table — anything wrong gets a finding row
Apply lesson codification protocol — declare streak / new lesson / mandate proposal
Run mistake-pattern checks — fix-example-vs-contract + sibling-doc-sweep + doc-vs-impl-regrep
Build fact table — every claim gets a Bash command + exact expected value
Run every fact — collect actual values
Set verdict outcome — PASS only if fact_table_pass==total AND no P0/P1
Write verdict to disk at <project-root>/<audits-dir>/<round-id>-external-audit-verdict.md
Update state.yaml — current_round.audit_verdict block per schema
Return — "DONE — verdict at , outcome <PASS|NEEDS_FIX>, / facts PASS, findings" OR "BLOCKED — "

What you DO NOT do

Do not call paid APIs
Do not spawn background processes
Do not commit the verdict yourself — return the path; orchestrator commits
Do not run transition.sh yourself — orchestrator transitions
Do not extend round scope — if you see out-of-scope concerns, log as forward-debt in § 8, NOT as findings
Do not read planner/developer session transcripts
Do not paraphrase impl behavior from memory — re-grep impl source (doc-vs-impl-regrep.md)

Read the full file on GitHub · 71 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

4d ago First seen · 71 lines · 101 tokens per session scan A 3e161d0899b8

Subscribe to this mod's changes

arcgentic-auditor is an agent published in the GitHub repository Arch1eSUN/Arcgentic (292 stars, last pushed 22d ago), licensed MIT. It adds 101 tokens to every session and 843 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Learning and teaching agentic ai-agents ai-coding ai-coding-agents claude-code claude-code-plugin

triage-labels

Label vocabulary for triaging/grilling issues in this repository. Managed by smallhours setup — edit .smallhours.yml labels: to rename, then re-run setup; do not edit this file by hand.

bcanfield/agentic-tech-debt · 0 tokens

edtech-pm-reviewer

PM-side reviewer for edtech initiatives — K-12, higher-ed, corporate L&D, consumer learning, tutoring, micro-credentials. Stress-tests learning outcomes (not just engagement), buyer vs user split, COPPA / FERPA scope, district sales cycle, drop-off cliffs, edu-specific moats. Pairs with engineering's edtech-reviewer.

VandanaAjayDubey111/great-pm · 79 tokens

autoevolve-optimizer

Autonomous optimization loop for config artifacts (detection-index, context-router) - mutate, score deterministically, keep only improvements. Two code-enforced safety gates wrap the loop.

primeline-ai/evolving-lite · 36 tokens

health-monitor

Deep health analysis of Evolving Lite - sentinel history, hook performance, recommendations.

primeline-ai/evolving-lite · 15 tokens

codex-rescue

Hand an OPEN-ENDED or stuck problem to Codex for independent investigation. Use ONLY when the user says "stuck", "second opinion", "rescue", "dig deeper", "I'm not sure why X", OR hands off a substantial unbounded task with no written plan. Do NOT use when a plan or plan-step file is in context (use codex-execute) or…

greenpolo/cc-multi-cli-plugin · 99 tokens

reviewer

Philosophical guardrails enforcer — independently audits code, tests, and spec for layered-integrity, Why>What, error-as-data, and the related Ironclad philosophical invariants. Activate only when the connected project contains spec.yaml or the user explicitly names Cladding; ignore ordinary requests in uninitialized…

qwerfunch/cladding · 68 tokens