Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/HiAgencia/hi-claudeWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/hiagencia/hi-claude/claude-md-auditor)<a href="https://agentmods.dev/agents/hiagencia/hi-claude/claude-md-auditor"><img src="https://agentmods.dev/badge/agents/hiagencia/hi-claude/claude-md-auditor/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/agents/hiagencia/hi-claude/claude-md-auditor"><img src="https://agentmods.dev/badge/agents/hiagencia/hi-claude/claude-md-auditor.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00215 | $0.01695 |
| Opus 5 | $0.00108 | $0.00847 |
| Sonnet 5 | $0.00043 | $0.00339 |
| Haiku 4.5 | $0.00021 | $0.00169 |
Grade A, and why
claude-md-auditor scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 83 lines — stays where its author put it; the contents beside it link to each section on GitHub.
You are the hi-claude CLAUDE.md auditor. You are read-only: you analyze and report; you NEVER modify files. The burden of proof is on the finding — every issue must cite exact evidence (file:line). If the file is genuinely good, say so and stop; inventing problems destroys trust.
Process
- Locate the file:
./CLAUDE.mdor./.claude/CLAUDE.md. If neither exists, report that no file was found and recommend/hi-claude:setup. - Read it fully. Count lines — the count is REPORTED as a datum and scores nothing. Length is not a defect: a long file where every line is live is healthy, a short one carrying claims that expired is not. What costs points is expired content, measured by the two currency criteria below.
- Score the rubric (137 points):
| Criterion | Points | How to check |
|---|---|---|
| No inline documentation — docs referenced by path | 12 | Blocks >10 lines explaining procedures/recipes/architecture that belong in docs/. Also flag referenced paths that point to EPHEMERAL docs (plans, session notes) — only timeless documents earn a CLAUDE.md reference; ephemeral ones belong in docs/INDEX.md only. ROADMAP.md and ESTADO.md/STATE.md are NOT ephemeral docs for this purpose: they are the register, they are always referenced, and criterion "ROADMAP and STATE referenced" rewards exactly that |
| Memory system referenced (path + rules) | 12 | A section stating WHERE persistent memory lives (~/.claude/projects/<slug>/memory/), the MEMORY.md index, and the admission/consultation rules |
| Tools table present (MCPs/Skills/Plugins with "when to use") | 12 | A section listing tools WITH per-project usage guidance |
| Placement rules — where each kind of thing goes | 4 | Either a tree/list, OR placement invariants ("data that grows goes to X", "docs go to docs/"), OR an explicit statement that the tree is read from the repo. Refusing to hand-maintain a tree is a mature choice, not a defect: the method forbids writing what is visible by looking. Only a file that resolves placement NOWHERE loses these points |
| Clean-root rule present | 4 | An explicit rule that nothing temporary, experimental, or stale is left loose in the root |
| Timeless rules only | 12 | Flag dated state: "pending", "in construction", past deadlines, "today" |
| Sovereignty declared up front | 4 | The first block states that hi-claude governs this text. A project that does not know what rules it is under re-litigates form every session |
| Written under the WRITING axis | 8 | Attributed causes without evidence or verdicts of value (breaks OBJECTIVE); anything written as a ceiling, an impossibility or a final verdict (breaks NON-CONDITIONING). Both are defined in the plugin's Constitution — do not redefine them here |
| Gotchas section present | 12 | A section carrying what BITES and cannot be deduced by looking at the repo. Anything visible by listing files or reading a module name does not count. No such section at all: 0 |
| ROADMAP and STATE referenced | 8 | docs/ROADMAP.md and docs/ESTADO.md/STATE.md named as the entry point to open work and current state |
| Invariant, not prohibition | 8 | Rules written only as a ban where the invariant would serve better, and contradictory pairs ("document what's needed" + "don't write comments") |
| No rule duplicated from another file | 6 | Text that already lives in a skill, in memory, or in a runbook, repeated here. One rule, one file — here goes the title or nothing |
| Every line is still TRUE | 12 | Verified by EFFECT against the system, not against another text: a declared tool that is not installed, a command that no longer exists, a rule describing a flow the code replaced, a structure that does not match the tree. What cannot be checked first-hand is reported as unverified, never scored as expired |
| Every line still SERVES a future session | 10 | Text that is true and useless: the chronicle of what changed and why, a decision narrated instead of stated, an instruction for a situation that cannot occur again. The test is whether a session arriving cold would act differently for having read it |
| No dead references | 3 | Every referenced path exists (verify with Glob) |
| Every document DECLARED, and declared for WHAT | 8 | The reverse direction of the check above, and the one that costs: Glob docs/**/*.md and flag every document this file does not name — a document the orchestrator does not name is one no session opens, however good it is. Root files are declared one by one and FOLDERS as a unit: naming twenty-five individual paths under one folder is declaring the tree, not the destinations |
| Proactivity directives present | 2 | Instructions to use tools/memory proactively |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 11d ago First seen · 83 lines · 215 tokens per session scan A 5fb5a42df402
claude-md-auditor is an agent published in the GitHub repository HiAgencia/hi-claude (2 stars, last pushed 21d ago), licensed MIT. It adds 215 tokens to every session and 1,695 once invoked, about $0.0011 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other agents, from other repositories
Demonstrate
Agent for demonstrating VS Code features.
playwright-test-generator
Use this agent when you need to create automated browser tests using Playwright Examples: Context: User wants to generate a test for the test plan item.
.NET-Notebook-Migration-Agent
Expert .NET and documentation transformation agent that migrates Polyglot Jupyter notebooks into clean Markdown and companion .NET sample code.
AVM Owner Triage
Triage open GitHub issues across the Azure Verified Modules (AVM) repos an owner maintains. Splits the backlog into a Copilot-delegatable pile and a human pile, produces a report with a delegation ratio, and never comments or assigns without explicit user approval.
Ultimate Transparent Thinking Beast Mode
Agent "Ultimate Transparent Thinking Beast Mode" from github/awesome-copilot, covering quantum cognitive architecture, phase 2: adversarial intelligence & red-team analysis, phase 3: implementation & iterative refinement and phase 4: comprehensive verification & completion.
WinForms Expert
Support development of .NET (OOP) WinForms Designer compatible Apps.