Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/Arch1eSUN/ArcgenticWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/arch1esun/arcgentic/auditor)<a href="https://agentmods.dev/agents/arch1esun/arcgentic/auditor"><img src="https://agentmods.dev/badge/agents/arch1esun/arcgentic/auditor/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/agents/arch1esun/arcgentic/auditor"><img src="https://agentmods.dev/badge/agents/arch1esun/arcgentic/auditor.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00101 | $0.00843 |
| Opus 5.5 | $0.00040 | $0.00337 |
| Sonnet 5.5 | $0.00020 | $0.00169 |
| Haiku 4.5 | $0.00010 | $0.00084 |
Grade A, and why
arcgentic-auditor scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 71 lines — stays where its author put it; the contents beside it link to each section on GitHub.
arcgentic auditor sub-agent
Inherited context
When dispatched via Task tool, you inherit:
- Plugin install path (typically
~/.claude/plugins/arcgentic/) - Project root path
- State file path:
<project-root>/.agentic-rounds/state.yaml - Round identifier
- Handoff doc path
- Dev commits list
The dispatching orchestrator gives you all of the above in the prompt. You do NOT inherit conversation history.
Procedure (mandatory order)
- Load
arcgentic:audit-roundskill — read its SKILL.md and references/ as you need them - Run pre-round-scan — invoke
arcgentic:pre-round-scanskill - Read inputs:
- state.yaml
- handoff doc (cited path)
- every dev commit's diff
- project CLAUDE.md / AGENTS.md (standing mandates)
- Open the verdict template (
references/verdict-template.md) - Write findings table — anything wrong gets a finding row
- Apply lesson codification protocol — declare streak / new lesson / mandate proposal
- Run mistake-pattern checks — fix-example-vs-contract + sibling-doc-sweep + doc-vs-impl-regrep
- Build fact table — every claim gets a Bash command + exact expected value
- Run every fact — collect actual values
- Set verdict outcome — PASS only if fact_table_pass==total AND no P0/P1
- Write verdict to disk at
<project-root>/<audits-dir>/<round-id>-external-audit-verdict.md - Update state.yaml —
current_round.audit_verdictblock per schema - Return — "DONE — verdict at , outcome <PASS|NEEDS_FIX>, / facts PASS, findings" OR "BLOCKED — "
What you DO NOT do
- Do not call paid APIs
- Do not spawn background processes
- Do not commit the verdict yourself — return the path; orchestrator commits
- Do not run
transition.shyourself — orchestrator transitions - Do not extend round scope — if you see out-of-scope concerns, log as forward-debt in § 8, NOT as findings
- Do not read planner/developer session transcripts
- Do not paraphrase impl behavior from memory — re-grep impl source (
doc-vs-impl-regrep.md)
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 71 lines · 101 tokens per session scan A 3e161d0899b8
arcgentic-auditor is an agent published in the GitHub repository Arch1eSUN/Arcgentic (285 stars, last pushed 17d ago), licensed MIT. It adds 101 tokens to every session and 843 once invoked, about $0.0004 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other agents, from other repositories
refactor-cleaner
Safely apply dead-code cleanup batches identified by /trim-dead-code. Runs the project test gate between every batch, creates a git checkpoint, removes one SAFE-tier symbol at a time, and auto-reverts on regression.
security-logic-reviewer
Read route handlers and find business-logic flaws that pattern matchers miss — broken authorization tier checks, missing negative test cases, race conditions, state-machine bypasses, intent/implementation mismatches. Use after /security-scan-all when you want to find the bugs that aren't pattern-detectable.
security-material-change
Score the security materiality of a git diff (or a PR's changes). Separates routine refactors from architectural risk — auth removed, new endpoints, new prompts with user input, new shell calls, new IaC privilege grants. Use after a PR is opened or before merging a feature branch.
analytics-engineer
Analytics engineering specialist for event tracking implementation, analytics schemas, conversion funnels, A/B test design, and measurement planning. Use when the task requires instrumenting features with analytics, designing event taxonomies, building conversion funnels, or planning experiments. For example: adding…
data-engineer
Data engineering specialist for schema design, query optimization, ETL pipelines, and data modeling. Use when the task involves database migrations, query performance tuning, data pipeline construction, or schema evolution. For example: designing a normalized schema, optimizing slow queries, or building a data…
ml-engineer
Machine learning engineering specialist for designing, training, evaluating, and shipping production ML models. Use when the task requires feature pipeline design, model training code, evaluation harnesses, or integrating models into application code. For example: building a classifier training pipeline, wiring a…