agentmods.dev

markupr: Command for Claude Code

.claude/commands/audit.md

audit is a command for Claude Code from eddiesanjuan/markupr. It costs 0 tokens per session (380 once invoked), scanned A, original, MIT.

A targeted review command for Markupr, an Electron application with a command-line tool and MCP server. It checks code quality, security settings, error handling, and resource cleanup.

In plain words
What is it for?
Running lint and type checks, reviewing Electron communication and security, checking API-key storage, inspecting error handling, and looking for memory leaks.
Why use it?
It helps find bugs and unsafe patterns that ordinary feature testing may miss, such as exposed secrets, unsafe browser settings, or unhandled failures.

Command for Claude Code

Written for Claude Code: installed under .claude/.

This is eddiesanjuan/markupr's own configuration. It tells Claude Code how to work on markupr itself, so it is not a mod to install elsewhere. Copy it as a starting point and replace the rules that are about this project. Everything markupr configures →

not rated 18repo 4mo ago A scan 0 tokens original MIT
View source ↗ eddiesanjuan/markupr markupr.com
Reuse

Borrowing it

Nothing to install: this file belongs to eddiesanjuan/markupr. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file
curl -O https://raw.githubusercontent.com/eddiesanjuan/markupr/main/.claude/commands/audit.md
Clone the repo
git clone --depth 1 https://github.com/eddiesanjuan/markupr

Made for: Claude Code.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for audit

README.md
[![agentmods](https://agentmods.dev/badge/commands/eddiesanjuan/markupr/audit.svg)](https://agentmods.dev/commands/eddiesanjuan/markupr/audit)
Your own site
<a href="https://agentmods.dev/commands/eddiesanjuan/markupr/audit"><img src="https://agentmods.dev/badge/commands/eddiesanjuan/markupr/audit.svg" alt="Measured on agentmods" height="20"></a>
Per session 0 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.
When invoked 380 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00000 $0.00380
Opus 5 $0.00000 $0.00190
Sonnet 5 $0.00000 $0.00076
Haiku 4.5 $0.00000 $0.00038

Measured 7d ago against content hash e83b7f0dd24f, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-06, from the pricing page.

Security

Grade A, and why

audit scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.claude/commands/audit.md · 43 lines

What it actually says

Code Quality Audit

Perform a targeted code quality audit of the markupr codebase.

Instructions

  1. Run all static analysis:

    npm run lint
npm run typecheck

    Report any errors or warnings.

  2. Check for common issues in Electron apps:

    • IPC channels defined in src/shared/types.ts that are unused or missing handlers
    • nodeIntegration or contextIsolation misconfigurations in window creation
    • Missing error boundaries in React components
    • Unhandled promise rejections in main process code
    • Memory leaks from event listeners not being cleaned up

  3. Review security considerations:

    • API keys should only be stored via keytar (never in plaintext config files)
    • No eval(), innerHTML, or dangerouslySetInnerHTML with user-supplied data
    • Preload script should not expose unnecessary APIs to the renderer
    • Check webPreferences in BrowserWindow creation for safe defaults

  4. Examine error handling patterns:

    • Verify try/catch around ffmpeg operations (FrameExtractor)
    • Verify try/catch around Whisper operations (WhisperService)
    • Verify try/catch around Claude API calls (ClaudeAnalyzer)
    • Check that errors surface user-friendly messages, not raw stack traces

  5. Check for stale code:

    • Unused imports or exports
    • Dead code paths (unreachable conditions)
    • TODO/FIXME/HACK comments that should be addressed

  6. Provide a prioritized report:

    • Critical -- security or data loss risks
    • High -- bugs or broken functionality
    • Medium -- code quality and maintainability
    • Low -- style and cleanup opportunities
Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 7d ago First seen · 43 lines · 0 tokens per session scan A e83b7f0dd24f

Subscribe to this mod's changes

audit is a command published in the GitHub repository eddiesanjuan/markupr (18 stars, last pushed 4mo ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 380 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Code reviewSecurityai-agentsdeveloper-toolselectrontranscriptionvoice-recordingwhisper
Related

Other commands, from other repositories

sdd-apply

Implement SDD tasks — writes code following specs and design.

Gentleman-Programming/gentle-ai · 11 tokens

gentle-sdd-ff

Fast-forward all SDD planning phases — proposal through tasks.

Gentleman-Programming/gentle-ai · 11 tokens

sdd-explore

Explore and investigate an idea or feature — reads codebase and compares approaches.

Gentleman-Programming/gentle-ai · 14 tokens

sdd-init

Initialize SDD context — detects project stack and bootstraps persistence backend.

Gentleman-Programming/gentle-ai · 14 tokens

review-branch

Review the current branch's diff against base by dispatching atomic-reviewer. No orchestration loop, no spec required — pre-flight before /commit pr or /commit merge.

damusix/atomic-claude · 35 tokens

simplify

The over-engineering review: five tags (delete, stdlib, native, yagni, shrink), a mandatory replacement per finding, and a real null result when there is nothing to cut.

azrtydxb/procoder · 39 tokens