Borrowing it
Nothing to install: this file belongs to HemmaBo-se/hemmabo-mcp-server. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/HemmaBo-se/hemmabo-mcp-server/main/.github/prompts/audit-hemmabo-smart-stays.prompt.mdgit clone --depth 1 https://github.com/HemmaBo-se/hemmabo-mcp-serverWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/commands/hemmabo-se/hemmabo-mcp-server/audit-hemmabo-smart-stays)<a href="https://agentmods.dev/commands/hemmabo-se/hemmabo-mcp-server/audit-hemmabo-smart-stays"><img src="https://agentmods.dev/badge/commands/hemmabo-se/hemmabo-mcp-server/audit-hemmabo-smart-stays/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/commands/hemmabo-se/hemmabo-mcp-server/audit-hemmabo-smart-stays"><img src="https://agentmods.dev/badge/commands/hemmabo-se/hemmabo-mcp-server/audit-hemmabo-smart-stays.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00065 | $0.02572 |
| Opus 5.5 | $0.00026 | $0.01029 |
| Sonnet 5.5 | $0.00013 | $0.00514 |
| Haiku 4.5 | $0.00006 | $0.00257 |
Grade B, and why
audit-hemmabo-smart-stays scanned grade B with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 18d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Recursive force deletemediumDestructive command
rm -rf with a variable or a broad path is one typo away from removing the wrong tree.
- [ ] **H1. Destructive command in a non-interactive path.** `rm -rf`, `DROP TABLE`, `supabase db reset` invoked by a script without an explicit confirmation flag. Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
5. **Production verification.** After deploying to Vercel / Supabase, curl the affected endpoint to confirm behaviour changed. How it starts
The opening of the file, as written. The whole thing — 126 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Audit prompt — hemmabo-smart-stays / sibling node sweep
You are auditing a HemmaBo TypeScript service. Treat every finding as a zero-tolerance bug — file a GitHub issue per finding, ship a fix per issue, one PR per fix, stacked branches when the fixes are dependent. Do not batch unrelated changes into a single PR.
Ground rules
- Read first, edit second. Identify the live code path before touching anything.
- One bug → one issue → one branch → one PR. Stack branches when fixes depend on each other.
- Tests must stay green at every commit. If a PR needs a temporary
skip, document it in the PR body and open a follow-up issue. - No
--no-verify, nogit push --forceonmain, no rebase across merged commits. - If a finding requires a product decision (hosted vs. self-hosted, pricing model, contractual scope), park it in the tracking issue and continue with the next finding.
Required reading before starting
Read these files in the target repo (skip silently if absent):
README.md,llms.txt,LAUNCHGUIDE.md,glama.json,server.jsonpackage.json(entry points, scripts, dependencies)lib/**/*.ts(single source of truth helpers — pricing, availability, validation)api/**/*.ts(Vercel serverless or sibling transport)src/**/*.ts(contract tests;src/stdio.tsis the Glama Docker build entry, not a published bin)supabase/**(SQL schemas, RLS, edge functions).github/workflows/*.yml(CI scope)
Audit checklist — anti-patterns to hunt
For each finding: report the file + line range, why it's a bug, the proposed fix, and the test that would prevent regression.
A. Money handling
- A1. Float×100 cents. Any expression of the form
Math.round(amount * 100)orMath.floor(price * 100)whereamountis a float in major units. Float arithmetic loses precision at scale (e.g.1.005 * 100 === 100.49999). Required: integer cents end-to-end OR a single dedicatedtoCents()helper usingMath.round((x * 100) + Number.EPSILON)with unit tests across edge floats. Reference:hemmabo-mcp-server#69. - A2. Cross-currency comparisons. Comparing or summing two
amountvalues that don't share acurrencyfield. - A3. Stripe amount mismatch. Any code path that POSTs to Stripe with a computed amount that wasn't last seen as an integer.
- A4. Refund silently swallowed.
try { stripe.refunds.create(...) } catch { /* ignore */ }.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 18d ago Changed 7dc5513848b3
- 25d ago Changed e51a4c11a75e
- 1mo ago First seen · 126 lines · 65 tokens per session scan B e374dbd968c1
audit-hemmabo-smart-stays is a command published in the GitHub repository HemmaBo-se/hemmabo-mcp-server (4 stars, last pushed yesterday), licensed Apache-2.0. It adds 65 tokens to every session and 2,572 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it B with 2 findings (recursive force delete, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-07.
Other commands, from other repositories
inconsistences
TODOs, errors, incosistencies, potential code and typesafety violations in.
ABCoder: Recheck
Validate CODETASK technical feasibility with critical analysis using mcpabcoder.
inventory
Codebase inventory skill — scans the repo for a named pattern (inline SQL, fetch calls, feature flags, debug leftovers, deprecated APIs, etc.) and emits a structured Markdown inventory cross-referenced with framework metadata (routes, handlers). Language-agnostic and pack-driven — the engine matches whatever a YAML…
ultra-agents
Autonomous multi-round review + fix loop — no per-round approval.
debug
Read-only bug investigation. Dispatches code-explorer + debugger to emit N ranked hypotheses (1/3/5 on --quick/--normal/--deep) with file:line evidence, verification steps, and confidence labels. Never writes code, never commits. Triggers: "investigate this bug", "what could cause X", "help me debug", "why is X…
refactor-clean
Refactor provided code for cleanliness, maintainability, and alignment with SOLID principles and modern best practices — no over-engineering.