A command that creates a structured plan for auditing a codebase. It asks about the audit's goals, has several read-only reviewers inspect the code in parallel, and proposes phases and tasks for approval.

Use it to start an audit of an unfamiliar or complex repository. It helps define the scope, collect findings, and prepare an approved manifest—a file listing the audit phases and tasks.

A large code review can otherwise become an unstructured list of findings with no agreed order of work. This command turns the review into an actionable plan without writing changes before approval.

init — Command for Claude Code by AleksandarBisevac/claude-plugins

Install

Getting it into your agent

This one installs as part of its plugin. Adding the marketplace and installing the plugin brings it with everything else the plugin ships.

Claude Code

/plugin marketplace add AleksandarBisevac/claude-plugins

Claude Code

/plugin install audit

Made for: Claude Code.

Or install audit, the plugin that ships this one along with the rest of its 2 skills, 21 commands, 4 agents, 5 hooks.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/commands/aleksandarbisevac/claude-plugins/init/github.svg)](https://agentmods.dev/commands/aleksandarbisevac/claude-plugins/init)

Your own site

<a href="https://agentmods.dev/commands/aleksandarbisevac/claude-plugins/init"><img src="https://agentmods.dev/badge/commands/aleksandarbisevac/claude-plugins/init/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/commands/aleksandarbisevac/claude-plugins/init"><img src="https://agentmods.dev/badge/commands/aleksandarbisevac/claude-plugins/init.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 92 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.

When invoked 12,425 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00092	$0.12425
Opus 5.5	$0.00037	$0.04970
Sonnet 5.5	$0.00018	$0.02485
Haiku 4.5	$0.00009	$0.01243

Measured 2d ago against content hash a53dc12ce25c, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

init scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

plugins/audit/commands/init.md · 737 lines

How it starts

The opening of the file, as written. The whole thing — 737 lines — stays where its author put it; the contents beside it link to each section on GitHub.

/audit:init — generate the audit manifest

Produces the manifest that the /audit:* execution commands run. Generation is multi-agent: parallel read-only explorers audit the codebase, the orchestrator (you) synthesizes their findings into phases/tasks. $ARGUMENTS (free text) seeds the interview answers.

0. Conventions

Read ${CLAUDE_PLUGIN_ROOT}/reference/manifest-conventions.md FIRST. Resolve manifestPath from .claude/audit.config.json (default docs/audit/audit-plan.json).

1. Preflight

If NO file exists at manifestPath yet, offer the cheap door before the interview below spends anything (AskUserQuestion):

Full audit (default) — continue below: an interview, a multi-agent read of the codebase, and a synthesized set of phases to approve before anything is written.
Just the smallest plan — run python3 "${CLAUDE_PLUGIN_ROOT}/scripts/manifest/audit-task.py" seed [manifestPath] and stop (--no-task leaves the placeholder task out). It writes one phase and one task, with a gate that is either an honestly empty one or whatever --gate "<command>" names — never a guessed one — and turns the plan gate from observing (nothing to check against) to advisory in the one call. The phases the interview below produces are for when there is real work to describe (to plan a first phase, /audit:phase add creates the missing plan itself); a plan that looks complete and describes work nobody agreed to teaches its reader that the manifest is decoration.

If a file already exists at manifestPath, first print any parked proposals it carries (proposals[] entries with status: "proposed"): N parked proposal(s) — /audit:propose materialize <id>|--all — the user may be re-running init when what they actually want is to materialize what the last run parked. Then ask (AskUserQuestion):

Abort (default) — keep the existing manifest; suggest /audit:status.
Regenerate — back it up to .claude/audit-backups/<manifest file name>.bak-<UTC timestamp> first (an ignored directory, never beside the plan; the backup includes any proposals).
Append phases — keep existing phases; new phases continue the id sequence, counting BOTH live phases and any proposals[].payload reserved phase ids (see manifest-conventions.md → ID allocation). New proposal ids come from python3 "${CLAUDE_PLUGIN_ROOT}/scripts/manifest/audit-task.py" next-id prop <manifestPath>, never by hand. Phases are minted on the development branch: if that command prints a suffixed id, this checkout is on a phase branch - say so and ask before appending, and offer to park the synthesized phases as proposals instead (/audit:phase add ... --park, materialized after the branch merges).

Read the full file on GitHub · 737 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

2d ago Changed · +26 lines a53dc12ce25c
5d ago Changed · +31 lines 39c968c355dc
21d ago Changed · +66 lines da7b37585c6e
1mo ago Changed · +86 lines 5b28b7070706
1mo ago Changed · +122 lines 37a6d0a3359c
1mo ago First seen · 406 lines · 92 tokens per session scan A 8a428ecea6c1

Subscribe to this mod's changes

init is a command published in the GitHub repository AleksandarBisevac/claude-plugins (4 stars, last pushed 3d ago), licensed MIT. It adds 92 tokens to every session and 12,425 once invoked, about $0.0004 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Claude Code Debugging Planning agentic-ai audit azure-devops claude-code-plugin claude-code-plugins-marketplace

doctor

Check OCR installation and verify all dependencies are available.

spencermarx/open-code-review · 10 tokens

sdlc-verify

Phase 3 — Verify. Runs security-engineer always + performance-engineer when needsperformanceaudit is true. Reads build-handoff.md for clean context.

saitarrun/Devforge-ai · 33 tokens

sdlc-diagnose

Automated Root-Cause Analysis (RCA) and surgical fix engine for massive enterprise codebases (up to 1.5M+ files).

saitarrun/Devforge-ai · 30 tokens

debug

A debugging command that sends an error, log, or screenshot to a debugger agent for analysis. The debugger reports confirmed facts separately from possible explanations and does not modify files.

SatoruoGojoo/octopus · 38 tokens

fix-risks

Use to fix risk findings via the fix verb (improve → oop-orchestrator fix mode) — the gated FIX action the /audit report's Recommended Actions hands off to. Resolves an entity selection against the glossary and applies the smallest corrective refactor per in-scope entity, OOP first, verified with the project's own…

odere-pro/claude-oop-excellence · 90 tokens

deps

(Architect) Analyze module dependencies, detect circular dependencies.

ruslan-korneev/claude-plugins · 12 tokens