Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/aaronsb/claude-code-configWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/commands/aaronsb/claude-code-config/project-audit)<a href="https://agentmods.dev/commands/aaronsb/claude-code-config/project-audit"><img src="https://agentmods.dev/badge/commands/aaronsb/claude-code-config/project-audit/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/commands/aaronsb/claude-code-config/project-audit"><img src="https://agentmods.dev/badge/commands/aaronsb/claude-code-config/project-audit.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00040 | $0.03225 |
| Opus 5.5 | $0.00016 | $0.01290 |
| Sonnet 5.5 | $0.00008 | $0.00645 |
| Haiku 4.5 | $0.00004 | $0.00323 |
Grade A, and why
project-audit scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Reads agent configuration directorieslowAgent snooping
.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.
find .claude/ways -name "*.md" ! -name "*.check.md" 2>/dev/null Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.
How it starts
The opening of the file, as written. The whole thing — 387 lines — stays where its author put it; the contents beside it link to each section on GitHub.
/project-audit: Software Engineering Health Check
You are a project auditor. The human has invoked /project-audit to verify that software engineering practices in this repository are still to spec. Run all checks, report findings honestly, and optionally create tasks for remediation.
First thing you do: create a task list. Before running any checks — create tasks with TaskCreate for each audit category:
- Verify prerequisites (git repo, GitHub remote)
- Check ADR health
- Check GitHub repo health
- Check CODEOWNERS coherence
- Check ways alignment
- Check documentation & artifacts
- Check scaffold ADR drift
- Compile report and present findings
Mark each task in_progress as you start it, completed when done. Update task descriptions with findings as you go — this ensures nothing is lost if context gets long. The task list is your checklist and your state.
Before You Start
Confirm you're in a git repository with a GitHub remote:
git rev-parse --is-inside-work-tree 2>/dev/null
gh repo view --json name,owner 2>/dev/null
If either fails, note it and proceed with what's available.
Run All Checks
Execute all check categories in parallel where possible. Each category produces a pass/warn/fail status with details.
1. ADR Health
Check: Is the ADR tool installed?
# Tool exists and is executable
test -x docs/scripts/adr && docs/scripts/adr --help >/dev/null 2>&1
- Pass: tool exists and runs
- Fail: missing or broken
Check: Does adr.yaml exist with valid domains?
docs/scripts/adr domains 2>/dev/null
docs/scripts/adr config 2>/dev/null
- Pass: yaml exists, domains configured, ranges don't overlap
- Warn: yaml exists but no domains configured
- Fail: no yaml
Check: Do ADRs pass lint?
docs/scripts/adr lint --check 2>/dev/null
- Pass: exit code 0
- Warn: warnings only (missing optional fields)
- Fail: errors (missing frontmatter, invalid status, etc.)
Check: Are there orphaned ADRs?
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 387 lines · 40 tokens per session scan A a39f59de1a5c
project-audit is a command published in the GitHub repository aaronsb/claude-code-config (18 stars, last pushed 6mo ago), licensed MIT. It adds 40 tokens to every session and 3,225 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 1 finding (reads agent configuration directories). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other commands, from other repositories
close-issue
Close a GitHub or GitLab issue with a summary comment.
navigator
Project-level GPS — show coverage against the essential ArcKit baseline, surface DRAFT/stale/orphan artifacts, and recommend the next slash command to run.
handoff
Hand a task you hold to a teammate with its state written down first.
thread
Open a private conversation with specific teammates' windows.
catchup
Catch up on what happened on the crew bus since you last looked.
claim
Claim a shared task (or the next unblocked one) with a lease and show the brief.