Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/marcusgoll/Spec-Flownpx agentmods add commands/marcusgoll/spec-flow/audit-claude-mdWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/commands/marcusgoll/spec-flow/audit-claude-md)<a href="https://agentmods.dev/commands/marcusgoll/spec-flow/audit-claude-md"><img src="https://agentmods.dev/badge/commands/marcusgoll/spec-flow/audit-claude-md.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00027 | $0.00515 |
| Opus 5 | $0.00014 | $0.00258 |
| Sonnet 5 | $0.00005 | $0.00103 |
| Haiku 4.5 | $0.00003 | $0.00052 |
Grade A, and why
audit-claude-md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
/audit-claude-md Command
Audit CLAUDE.md files for quality issues including bloat, vague language, missing sections, and poor progressive disclosure.
Input
- path (optional): Path to specific CLAUDE.md file or directory to audit
- If omitted, audits all CLAUDE.md files in repository
Process
Step 1: Invoke Skill
Load the audit-claude-md skill for comprehensive guidance:
skill: audit-claude-md
Step 2: Run Audit Script
Execute the deterministic audit script:
bash .spec-flow/scripts/bash/audit-claude-md.sh --verbose $path
Step 3: Analyze Results
For each CLAUDE.md file, report:
- Grade (A/B/C/F based on score)
- Line count vs. threshold
- Vague language instances
- Strong modal usage
- Missing required sections
Step 4: Generate Recommendations
For files with grade B or lower, provide specific recommendations:
-
If line count exceeds threshold:
- Identify sections to extract to
docs/references/ - Suggest progressive disclosure refactoring
- Identify sections to extract to
-
If vague language detected:
- List each instance with file:line reference
- Suggest replacement with strong modals
-
If missing WHAT/WHY/HOW sections:
- Provide template to add
Step 5: Offer Actions
Present options to the user:
- Auto-fix: Apply safe automated fixes (vague language replacement)
- Refactor plan: Generate detailed refactoring plan for manual review
- Create folder CLAUDE.md: Split domain-specific content into folder-level files
Output
Summary report with:
- Files analyzed
- Average quality score
- Overall grade
- Action items prioritized by impact
Example Usage
# Audit all CLAUDE.md files
/audit-claude-md
# Audit specific file
/audit-claude-md ./CLAUDE.md
# Audit feature directory
/audit-claude-md specs/001-auth/
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 7d ago First seen · 87 lines · 27 tokens per session scan A 037cbcd1647b
audit-claude-md is a command published in the GitHub repository marcusgoll/Spec-Flow (92 stars, last pushed 4mo ago), licensed MIT. It adds 27 tokens to every session and 515 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other commands, from other repositories
OPSX: Verify
Verify implementation matches change artifacts before archiving.
opsx-propose
Propose a new change - create it and generate all artifacts in one step.
OPSX: Apply
Implement tasks from an OpenSpec change (Experimental).
opsx-new
Start a new change using the experimental artifact workflow (OPSX).
opsx-sync
Sync delta specs from a change to main specs.
OPSX: Archive
Archive a completed change in the experimental workflow.