Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add commands/aaronsb/claude-code-config/project-auditgit clone --depth 1 https://github.com/aaronsb/claude-code-configWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00040 | $0.03225 |
| Opus 5 | $0.00020 | $0.01613 |
| Sonnet 5 | $0.00008 | $0.00645 |
| Haiku 4.5 | $0.00004 | $0.00323 |
Grade A, and why
project-audit scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Reads agent configuration directorieslowAgent snooping
.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.
find .claude/ways -name "*.md" ! -name "*.check.md" 2>/dev/null Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.
How it starts
The opening of the file, as written. The whole thing — 387 lines — stays where its author put it; the contents beside it link to each section on GitHub.
/project-audit: Software Engineering Health Check
You are a project auditor. The human has invoked /project-audit to verify that software engineering practices in this repository are still to spec. Run all checks, report findings honestly, and optionally create tasks for remediation.
First thing you do: create a task list. Before running any checks — create tasks with TaskCreate for each audit category:
- Verify prerequisites (git repo, GitHub remote)
- Check ADR health
- Check GitHub repo health
- Check CODEOWNERS coherence
- Check ways alignment
- Check documentation & artifacts
- Check scaffold ADR drift
- Compile report and present findings
Mark each task in_progress as you start it, completed when done. Update task descriptions with findings as you go — this ensures nothing is lost if context gets long. The task list is your checklist and your state.
Before You Start
Confirm you're in a git repository with a GitHub remote:
git rev-parse --is-inside-work-tree 2>/dev/null
gh repo view --json name,owner 2>/dev/null
If either fails, note it and proceed with what's available.
Run All Checks
Execute all check categories in parallel where possible. Each category produces a pass/warn/fail status with details.
1. ADR Health
Check: Is the ADR tool installed?
# Tool exists and is executable
test -x docs/scripts/adr && docs/scripts/adr --help >/dev/null 2>&1
- Pass: tool exists and runs
- Fail: missing or broken
Check: Does adr.yaml exist with valid domains?
docs/scripts/adr domains 2>/dev/null
docs/scripts/adr config 2>/dev/null
- Pass: yaml exists, domains configured, ranges don't overlap
- Warn: yaml exists but no domains configured
- Fail: no yaml
Check: Do ADRs pass lint?
docs/scripts/adr lint --check 2>/dev/null
- Pass: exit code 0
- Warn: warnings only (missing optional fields)
- Fail: errors (missing frontmatter, invalid status, etc.)
Check: Are there orphaned ADRs?
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 387 lines · 40 tokens per session scan A a39f59de1a5c
project-audit is a command published in the GitHub repository aaronsb/claude-code-config (18 stars, last pushed 4mo ago), licensed MIT. It adds 40 tokens to every session and 3,225 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 1 finding (reads agent configuration directories). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other commands, from other repositories
agt-status
Show the active AGT governance status for this Claude Code session.
riskreview
The user invoked the /riskreview facade command from the risk-review-pipeline pack.
nyann:diff-profile
Compare two nyann profiles side-by-side and show what changes between them: hooks, branching, CI, documentation, extras, governance. Useful before switching profiles to understand the impact.
nyann:apply
Apply an Infrastructure-as-Code change — the highest-stakes mutator in nyann; it can change real cloud infrastructure. Re-runs the plan, shows it, confirms, then applies. Unmistakably opt-in: apply is never the default and destructive applies require a second explicit confirm. For IaC apply intent only (not "apply a…
nyann:release
Cut a release: generate a CHANGELOG section from Conventional Commits, make a release commit, and create an annotated tag. Defaults to conventional-changelog strategy.
nyann:settings
Interactive settings menu for nyann preferences. Pick one setting, change its value, see the updated table, then pick another or done.