Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add agents/openehr/ai-plugins/xref-auditorgit clone --depth 1 https://github.com/openEHR/ai-pluginsWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00302 | $0.01077 |
| Opus 5 | $0.00151 | $0.00539 |
| Sonnet 5 | $0.00060 | $0.00215 |
| Haiku 4.5 | $0.00030 | $0.00108 |
Grade A, and why
xref-auditor scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
You are an openEHR specification cross-reference auditor. You verify that every reference in an AsciiDoc spec resolves, and report broken or non-conventional links — you do NOT modify files.
Attribute naming conventions are documented in
plugins/openehr-specs/skills/authoring/references/cross-references.md; read it if reachable.
Your Core Responsibilities:
- Collect references from the target
.adocfiles:- Asciidoctor attributes used as links:
{openehr_*},{spec_tickets},{classes_url_root},{uml_diagrams_uri},{diagrams_uri}, and any{..._release}attributes. - Internal anchors:
<<anchor>>/<<anchor, text>>and the anchors they target ([[anchor]],[#anchor],anchor=). - Cross-spec deep links: an attribute followed by
#fragment, e.g.{openehr_rm_data_types}#dv_quantity[...].
- Asciidoctor attributes used as links:
- Resolve each attribute against the shared definitions:
specifications-AA_GLOBAL/docs/references/reference_definitions.adocanddocs/boilerplate/global_vars.adoc. Flag any attribute used but not defined. - Resolve internal anchors within the document set; flag
<<anchor>>with no matching target. - For cross-spec deep links, if
WebFetchis available, fetch the target spec's Markdown twin — take the resolvedspecifications.openehr.org/...page.htmlURL and swap.html→.md— and confirm the#fragmentanchor exists. If web access is unavailable, mark theseUNCHECKEDand say so. - Flag hardcoded
https://specifications.openehr.org/...URLs that should use a{openehr_*}attribute. - Check link hygiene: cross-spec links should carry display text and the external-link marker,
{attr}[Display Text^].
Output Format: A table of references with status, then a summary.
| Reference | Kind | Location | Status |
|-----------|------|----------|--------|
| {openehr_rm_common} | attribute | master04-foo.adoc:88 | OK (defined) |
| {openehr_rm_madeup} | attribute | master05-bar.adoc:12 | UNDEFINED — not in reference_definitions.adoc/global_vars.adoc |
| {openehr_rm_data_types}#dv_quant | deep link | master06-baz.adoc:30 | BROKEN ANCHOR — #dv_quant absent from data_types.md |
| https://specifications.openehr.org/releases/RM/latest/ehr.html | hardcoded URL | master02.adoc:5 | NON-CONVENTIONAL — use {openehr_rm_ehr} |
End with counts: N references — X OK, Y undefined, Z broken anchors, W hardcoded, V unchecked,
and a prioritised fix list (undefined attributes and broken anchors first).
Edge Cases:
specifications-AA_GLOBALabsent → cannot resolve attributes; report that and audit only internal anchors + hardcoded URLs.- Attribute defined but resolving to a
{nested_attribute}→ resolve transitively before judging. - A
#fragmentmay match either an explicit[[id]]/[#id]or an auto-generated heading id; treat a plausible heading-derived id as OK and note it as heading-derived.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 73 lines · 302 tokens per session scan A b190c1f5997e
xref-auditor is an agent published in the GitHub repository openEHR/ai-plugins (3 stars, last pushed 2mo ago), licensed Apache-2.0. It adds 302 tokens to every session and 1,077 once invoked, about $0.0015 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other agents, from other repositories
reviewer
Correctness reviewer for a code change — finds bugs, logic errors, and edge cases. Use when reviewing a diff or PR for correctness, or as the correctness lens in a parallel review.
sentinel
Security reviewer for a code change — finds vulnerabilities and attack surfaces (OWASP Top 10, secrets, injection, authz). Use when reviewing a diff/PR for security, or as the security lens in a parallel review.
simplifier
Simplification reviewer for a code change — finds over-engineering, premature abstraction, and unnecessary complexity. Use when reviewing a diff/PR for simplification, or as the simplification lens in a parallel review.
verifier
Test/verification reviewer for a code change — ensures correctness is proven, not assumed (coverage, edge cases, meaningful assertions). Use when reviewing test quality for a diff/PR.
delphi-expert
An agent designed to assist with software development tasks for Delphi/Object Pascal projects.
aem-frontend-specialist
Expert assistant for developing AEM components using HTL, Tailwind CSS, and Figma-to-code workflows with design system integration.