Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/RaNDoM6913/claude-code-superkitWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/random6913/claude-code-superkit/audit-frontend)<a href="https://agentmods.dev/agents/random6913/claude-code-superkit/audit-frontend"><img src="https://agentmods.dev/badge/agents/random6913/claude-code-superkit/audit-frontend/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/agents/random6913/claude-code-superkit/audit-frontend"><img src="https://agentmods.dev/badge/agents/random6913/claude-code-superkit/audit-frontend.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00026 | $0.01799 |
| Opus 5.5 | $0.00010 | $0.00720 |
| Sonnet 5.5 | $0.00005 | $0.00360 |
| Haiku 4.5 | $0.00003 | $0.00180 |
Grade A, and why
audit-frontend scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 130 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Frontend Audit
Run 12 fixed frontend checks and report PASS/WARN/FAIL for each. Output is consumed by the /audit command's Grand Summary.
Hard Rules
- Report ALL 12 checks in numeric order, including every PASS — never omit or reorder a check.
- Per-check verdict is exactly
PASS,WARN, orFAIL— the /audit contract. No other levels. - Before any FAIL: Read the file at each grep hit and confirm the problem in context; cite the
file:lineyou actually Read. - Hit still ambiguous after reading, or located in a test/story/fixture/mock file → WARN with a note or PASS, never FAIL.
- Never invent file contents or line numbers. Referenced file missing → report
NOT FOUND: <path>on that check. - All 12 checks PASS is a valid outcome — do not manufacture findings.
- Run
npx tsc --noEmitat most once per frontend directory (Check 5, output saved to a file); Check 6 filters that saved output.
Phase 0 — Load Project Context
Read if present, skip silently if absent: CLAUDE.md or AGENTS.md; docs/architecture/frontend-state.md.
Use it to: learn the defined design tokens/color constants, the state-management approach (Context, Zustand, Redux), and expected query-key patterns — prevents false positives in Checks 7–9. Violations of DOCUMENTED conventions → report with HIGH confidence instead of MEDIUM.
Detection Strategy
Auto-detect frontend projects: package.json with React/Vue/Svelte/Angular dependencies; tsconfig.json; src/ structure. Identify ALL frontend directories (there may be several — e.g., user-facing app + admin panel) and run every check in each.
Checks
1. Hardcoded Values in State
Grep useState.*["'][A-Z]|useState.*["'][a-z]{3,}. Read each hit. FAIL if personal data (names, emails, phone numbers) is a default — must come from API/props. Enum-like literals ('idle', 'light') are fine.
2. Placeholder Image URLs
Grep unsplash\.com|picsum\.photos|pravatar\.cc|placeholder\.com|placehold\.co|via\.placeholder. Read each hit. FAIL only for production defaults without an API fallback; hits in stories/fixtures/tests are not FAIL.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 130 lines · 26 tokens per session scan A 0d26321c8105
audit-frontend is an agent published in the GitHub repository RaNDoM6913/claude-code-superkit (3 stars, last pushed 4d ago), licensed MIT. It adds 26 tokens to every session and 1,799 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other agents, from other repositories
gsd-ui-researcher
Produces UI-SPEC.md design contract for frontend phases. Reads upstream artifacts, detects design system state, asks only unanswered questions. Spawned by /gsd:ui-phase orchestrator.
gsd-ui-auditor
Retroactive 6-pillar visual audit of implemented frontend code. Produces scored UI-REVIEW.md. Spawned by /gsd:ui-review orchestrator.
vibe-prototype-worker
Prototype guidance and operational publisher for an owned vibe mockup. Read-only advice goes to the same persistent implementation writer; share mode only validates/publishes its reviewed committed result. Never builds, iterates or fixes source in another context.
Mnemosyne
Memory architect instrument. Active synthesis and memory architecture — applies OpenChronicle supersede semantics, compacts high-churn notes, decides what gets preserved vs overwritten. Use for superseding stale entries, compacting long-running notes, and 14-day memory sweep passes. Distinct from Hestia (mechanical…
lib-extender
Add a new primitive to lib/primitives/ with safety: JSDoc + sensible defaults + at least one consuming preset + passing snapshot tests + updated docs/lib-api.md + CLAUDE.md index. Specialized for the /svg-add-primitive skill's isolated-context phase. Has tightly restricted tools (no chrome MCP, no random Bash) to keep…
refactor-planner
Turns messy code plus a goal into a safe, staged refactor plan where every step leaves the build green. Use when restructuring existing code without changing behavior.