Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add commands/omermaksutii/rugproof/diff-auditgit clone --depth 1 https://github.com/omermaksutii/RugProofWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00028 | $0.00760 |
| Opus 5 | $0.00014 | $0.00380 |
| Sonnet 5 | $0.00006 | $0.00152 |
| Haiku 4.5 | $0.00003 | $0.00076 |
Grade A, and why
diff-audit scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 82 lines — stays where its author put it; the contents beside it link to each section on GitHub.
/diff-audit — compare against canonical reference
Many contracts are forks-with-tweaks of OZ/Uniswap/Compound. Audit the deltas, not the whole thing.
Procedure
Step 1 — Identify reference
--reference options (extensible):
openzeppelin/erc20→@openzeppelin/contracts/token/ERC20/ERC20.solopenzeppelin/erc721→@openzeppelin/contracts/token/ERC721/ERC721.solopenzeppelin/erc4626→@openzeppelin/contracts/token/ERC20/extensions/ERC4626.solopenzeppelin/governor→@openzeppelin/contracts/governance/Governor.solopenzeppelin/accesscontrol→@openzeppelin/contracts/access/AccessControl.solsolady/erc20,solady/erc721,solady/erc4626,solady/ownableuniswap-v2/pair,uniswap-v3/pool,uniswap-v4/hook-templateaave-v3/pool,compound-v3/cometsafe/proxy,safe/factory
If user passes a path, use that file as the reference.
Step 2 — Pull both files
Load the user's contract and the reference. Be specific about reference version (pin to a release commit).
Step 3 — Compute structural diff
Not just diff — semantic compare:
- New functions added (vs reference)
- Existing functions modified (signature or body)
- New state variables (vs reference layout)
- Removed checks (
require,if, modifier) - Changed modifiers (e.g.
nonReentrantremoved) - Changed constants (fee rate, decimals)
- Different access-control wiring
Step 4 — Audit each delta
For each delta, ask:
- Why was this changed?
- Does the change introduce a vuln class? Auto-invoke relevant skills.
- Does it weaken a security check?
- Does it modify an invariant the reference relied on?
Step 5 — Output
Diff audit: src/MyToken.sol vs openzeppelin/[email protected]
Deltas:
+ Added function: blacklist(address) ← centralization (no timelock)
~ Modified _transfer:
- Removed: if (from == address(0)) revert ZeroFrom();
- Added: if (blacklisted[from]) revert Blacklisted();
+ Added storage: mapping(address => bool) blacklisted at slot 4
~ Modified mint: now also takes (bool fromTreasury) param
Risk assessment:
HIGH: blacklist() has no timelock + no escape hatch for legitimately blacklisted user funds
HIGH: Removed zero-from check → minting bypass possible
MED: New storage slot — verify upgrade safety
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 82 lines · 28 tokens per session scan A eb9fb6e019c8
diff-audit is a command published in the GitHub repository omermaksutii/RugProof (9 stars, last pushed 1mo ago), licensed MIT. It adds 28 tokens to every session and 760 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other commands, from other repositories
phase6-start
Command "phase6-start" from kota1026/quantum-shield, covering phase 6 $arguments 開始, step 1: 進捗状況を確認, step 2: 未完了画面を特定, step 3: 必須ファイルを読み込む and step 4: インフラ確認.
codespace-verify
Command "codespace-verify" from kota1026/quantum-shield, covering codespaces ui確認コマンド, 1. codespaces起動確認, サービス起動状態確認, postgresql, redis, rabbitmqが起動していない場合 and フロントエンド起動.
pr-merge
Command "pr-merge" from kota1026/quantum-shield, covering pr作成・マージコマンド, 1. 変更確認, 2. コミット（未コミットがある場合）, 3. pr作成 and 4. マージ.
krait-fuzz
Run an invariant-based fuzzing campaign: Understand → Extract Invariants → Generate Foundry Tests → Run & Fix Iteratively → Report.
krait-poc
Write and run a valid Foundry proof-of-concept that proves (or disproves) a Solidity exploit by asserting the actual harm on a forked chain or against local source.
worktree-check
Audit every git worktree for uncommitted, unpushed, or stashed work at risk before any reset/merge/cleanup. Usage: /worktree-check.