Getting it into your agent
This one installs as part of its plugin. Adding the marketplace and installing the plugin brings it with everything else the plugin ships.
/plugin marketplace add Lee-W/maigo/plugin install maigoWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/commands/lee-w/maigo/repo-audit)<a href="https://agentmods.dev/commands/lee-w/maigo/repo-audit"><img src="https://agentmods.dev/badge/commands/lee-w/maigo/repo-audit/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/commands/lee-w/maigo/repo-audit"><img src="https://agentmods.dev/badge/commands/lee-w/maigo/repo-audit.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00110 | $0.02237 |
| Opus 5 | $0.00055 | $0.01118 |
| Sonnet 5 | $0.00022 | $0.00447 |
| Haiku 4.5 | $0.00011 | $0.00224 |
Grade A, and why
repo-audit scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 156 lines — stays where its author put it; the contents beside it link to each section on GitHub.
/maigo:repo-audit
🌙 Doloris：讓我們看清楚，這個 repo 裡還留著什麼。
read-only 內部健診——不刪 branch、不關 PR、不改 code。 只掃描、彙整，把可執行的處置選項交回給你。
使用
/maigo:repo-audit
無參數。對當前所在的 git repo 執行。
五個資料源（全 read-only）
A. 已合併可刪的 branch
git branch --merged main
過濾掉 main 與當前 branch 自身，列出其餘已合入 main 的本地 branch。
→ 列出，不刪除。
限制：假設 main-based 工作流（
main為基準 branch）。detached HEAD 或其他分支策略的邊界情況暫不處理。
B. 未關 PR（需要 gh CLI）
gh pr list --state open
列出 open 狀態的 PR。 → 列出，不關閉。
若 gh 未安裝或未登入：跳過本段，🌑 Mortis 一句告知，A / C / D 照跑，整輪不中斷。
C. 程式碼積壓（TODO / FIXME）
grep -rn -E "TODO|FIXME" agents/ commands/ skills/ scripts/ docs/ hooks/
限定 repo 自有目錄，排除 .venv/、node_modules/ 等第三方目錄，避免第三方套件 TODO 噪音。
→ 列出，不修改。
D. Skill 健診
orchestrator 讀 skills/*/SKILL.md（不開新 agent），三類檢查：
- 孤兒 skill：對每個
skills/<name>/，grepcommands/、agents/、skills/（排除自身）、hooks/找 inbound 引用；零引用 → 孤兒候選。但部分 skill 純靠 frontmatterdescription被 model 觸發（repo-detect 型，如airflow-aware、commitizen-aware），不靠文字引用—— 這類即使零 grep 命中也標註「model-triggered，非引用型」，不當真孤兒。 - 重疊候選：讀所有 SKILL.md 的 description + Consumers，用判斷力標出兩個 description 幾乎互相涵蓋、consumer 集合高度重疊的配對 → 列為「考慮合併」候選，附一句理由。 注意：co-load（同一命令常同時載入兩個 skill）不等於重疊——先確認兩者是刻意分工 （如各自負責不同關注點）還是內容真的重複，分工型不列為候選。
- 指向失效：grep 各 SKILL.md 內文的 inline code 路徑（
skills/...、scripts/...、${CLAUDE_PLUGIN_ROOT}/...），確認目標存在——markdown link 已由validate_plugin.py的check_relative_links擋，這裡只補它不查的 inline code 指向類。
→ 三類都只列出，不合併、不刪除、不改指向——advisory，判斷與執行留給使用者或後續
/maigo:crystallize。
E. 已合併可清的 sibling worktree
git worktree list --porcelain
列出所有 linked worktree（不能用「目錄名長得像 <repo>-*」去猜——ring /
ring-codex 是兩個各自獨立的 clone，不是彼此的 worktree，必須用 git worktree list --porcelain 這種權威來源）。對每個 worktree 的 branch 名，比照 A 段既有的
「已合併」判斷方法（squash-merge 場景用 gh search prs 而非 git branch --merged，見
skills/git-workflow/references/worktree-hygiene.md）
判斷是否已合併，命中就把 git worktree remove <path> + git branch -D <branch> 加進處置 checklist。
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- today Changed · +22 lines · +11 tokens per session 2a6a86b74d60
- 9d ago First seen · 134 lines · 99 tokens per session scan A 3d91640c78b4
repo-audit is a command published in the GitHub repository Lee-W/maigo (14 stars, last pushed today), licensed MIT. It adds 110 tokens to every session and 2,237 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other commands, from other repositories
commit
A command that examines staged Git changes and proposes a commit message using the Conventional Commits format, such as feat, fix, or docs. Git is a tool for tracking changes to code.
release-notes
Generate consistent, well-structured release notes from git history. Triggered on release tags following semver patterns (v..) to produce categorized changelog with breaking changes, features, fixes, and contributor attribution.
doctor
Diagnosticar y reparar problemas del framework Don Cheli, git y entorno. Usa cuando el usuario dice "doctor", "problemas del framework", "don cheli no funciona", "repair Don Cheli", "debug setup", "setup broken", "framework broken", "reparar entorno". Detecta y repara issues de configuración, git y dependencias…
repo-audit
Audit a codebase (local or remote GitHub/GitLab) against architecture principles and requirements, surfacing drift, risk, and missing decisions.
handoff
Export a Waybill Bundle by default, or import one when requested.
pr
Handle the full workflow from current branch state to an open, CI-monitored pull request.