audit

A command for checking the assumptions behind a document by investigating each claim separately and looking for counter-evidence.

In plain words
What is it for?
Use it to audit a named document, or the newest plan file by default, then report claims that are supported or refuted with checkable evidence.
Why use it?
It reduces the risk that a plan is built on an incorrect understanding of the code or problem.

Command

Part of the nullius plugin — 1 skill, 3 commands, 6 hooks shipped together

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add commands/armanfatemi/nullius/audit
Clone the repo
git clone --depth 1 https://github.com/armanfatemi/nullius

Or install nullius, the plugin that ships this one along with the rest of its 1 skill, 3 commands, 6 hooks.

Per session 23 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.
When invoked 728 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00023 $0.00728
Opus 5 $0.00012 $0.00364
Sonnet 5 $0.00005 $0.00146
Haiku 4.5 $0.00002 $0.00073

Measured 3d ago against content hash 5792e65133b5, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

audit scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

plugin/commands/audit.md · 69 lines

How it starts

The opening of the file, as written. The whole thing — 69 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Audit the document named by $ARGUMENTS (if no argument was given, use the most recently modified .md file in the plans directory — .claude/plans or ~/.claude/plans, newest first).

The protocols live in the CLI so they cannot drift from the checker. Emit them and follow them exactly.

If the document already carries anchors

List the claims, then audit each one in its own subagent:

npx -y @nullius-inverba/claims audit <doc>
npx -y @nullius-inverba/claims audit <doc> --emit-brief <claim-id>

Dispatch each brief to a separate agent, and give that agent the brief and nothing else — no document, no title, no other claims, no summary of what you are doing. The starve is the mechanism: claims presented together imply a narrative, and a model handed a narrative argues for it. Do not "helpfully" add context.

Collect the verdicts:

  • REFUTED — the counter-evidence comes back as anchors. Verify them with npx -y @nullius-inverba/claims check <doc> like anyone else's, then report the claim, the counter-evidence, and the note that the decision it supported needs re-examining.
  • SUPPORTED — report where the agent went looking for the counter-example.
  • UNVERIFIABLE-BY-SEARCH — a real answer, not a failure. Report what is out of reach (dynamic dispatch, runtime string keys, DI, other repositories) and propose moving the claim to ## Open questions.

Never overrule a subagent's verdict from your own reading of the document — that is the correlation the split exists to break.

If the document carries no anchors at all

Retrofit it first, with the confirmation-shaped mode:

npx -y @nullius-inverba/claims audit <doc> --propose

Follow the emitted brief to the letter — in particular:

  • Refute-first. Your default hypothesis for every load-bearing claim is that it is wrong. Every conclusion must trace to a file you opened or a search you ran; never assess plausibility from memory.
  • Your anchors are proposals — present them as an edit for the author's review, never as verified truth. The author adopting them is the entailment review.
  • Stamp the commit you read (git rev-parse --short HEAD) into each anchor: path/to/file.ts:12@a1b2c3d. That is what keeps the claim checkable after the code moves on.
  • Finish by running npx -y @nullius-inverba/claims check on the document and confirm every proposed anchor verifies. A FABRICATED or COUNT-MISMATCH on your own anchor means you fabricated — redo that claim from the code.

Read the full file on GitHub · 69 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 3d ago First seen · 69 lines · 23 tokens per session scan A 5792e65133b5

Subscribe to this mod's changes

audit is a command published in the GitHub repository armanfatemi/nullius (4 stars, last pushed 3d ago), licensed MIT. It adds 23 tokens to every session and 728 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.