audit

audit is a command for Claude Code from dork-labs/dorkos. It costs 30 tokens per session (1,430 once invoked), scanned A, original, MIT.

A command that checks accepted Architecture Decision Records (ADRs)—short documents recording important technical choices—against the current codebase.

In plain words
What is it for?
Use it after major code changes, when old ADRs have not been checked for a long time, or as regular maintenance.
Why use it?
It finds decisions that no longer match the software, so accepted records do not quietly become outdated.

Command for Claude Code

Part of the flow plugin — 17 skills, 37 commands, 5 agents shipped together

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add commands/dork-labs/dorkos/audit
Clone the repo
git clone --depth 1 https://github.com/dork-labs/dorkos

Made for: Claude Code.

Or install flow, the plugin that ships this one along with the rest of its 17 skills, 37 commands, 5 agents.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for audit

README.md
[![agentmods](https://agentmods.dev/badge/commands/dork-labs/dorkos/audit.svg)](https://agentmods.dev/commands/dork-labs/dorkos/audit)
Your own site
<a href="https://agentmods.dev/commands/dork-labs/dorkos/audit"><img src="https://agentmods.dev/badge/commands/dork-labs/dorkos/audit.svg" alt="Measured on agentmods" height="20"></a>
Per session 30 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.
When invoked 1,430 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00030 $0.01430
Opus 5 $0.00015 $0.00715
Sonnet 5 $0.00006 $0.00286
Haiku 4.5 $0.00003 $0.00143

Measured 4d ago against content hash 6d4fa9c763c8, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

audit scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.claude/commands/adr/audit.md · 121 lines

How it starts

The opening of the file, as written. The whole thing — 121 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Audit Accepted ADRs Against Reality

Argument: $ARGUMENTS


Purpose

/adr:review moves proposed ADRs to a terminal state; nothing else ever re-examines an accepted one, so accepted silently rots as the codebase moves on (the 2026-08 corpus audit measured ~39% of accepted ADRs as drifted or obsolete — research/20260806_adr-corpus-health-and-lifecycle.md). This command closes that loop: it verifies accepted ADRs against the current code and makes their status true again. ADR bodies stay immutable — only statuses, links, Status-section notes, and manifest metadata change.

Division of labor (deliberate): scripts compute the worklist and every mechanical signal; cheap parallel subagents do the per-ADR code verification; the orchestrating model only adjudicates contested verdicts and reviews the final diff. Do not read 300 ADRs serially in the main context.

When to run:

  • The SessionStart hook reports accepted ADRs unverified in 120+ days
  • After a large program lands (renames, architecture shifts)
  • Quarterly, as general maintenance

Steps

Step 1: Build the worklist

node .claude/scripts/adr-staleness-scan.mjs --json

The worklist array is every accepted ADR needing verification, load-bearing first (citation count descending). Scope by $ARGUMENTS:

Argument Scope
empty Top 12 of the worklist (one comfortable batch)
a number N Top N
an ADR id Just that ADR
--all The whole worklist

Also note the scanner's staleCitations output — report it at the end (fixing source comments that cite superseded ADRs is follow-up work, not part of the audit itself).

Step 2: Fan out verifier subagents

Batch the scoped worklist ~12 ADRs per subagent and launch the batches in parallel (model: sonnet — this is verification work, not judgment work). Each verifier is read-only and returns, per ADR:

Read the full file on GitHub · 121 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 4d ago First seen · 121 lines · 30 tokens per session scan A 6d4fa9c763c8

Subscribe to this mod's changes

audit is a command published in the GitHub repository dork-labs/dorkos (9 stars, last pushed today), licensed MIT. It adds 30 tokens to every session and 1,430 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.