Borrowing it
Nothing to install: this file belongs to patrickdeanfox/zuar-portal-mcp. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/patrickdeanfox/zuar-portal-mcp/main/.claude/commands/portal-audit.mdgit clone --depth 1 https://github.com/patrickdeanfox/zuar-portal-mcpWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/commands/patrickdeanfox/zuar-portal-mcp/portal-audit)<a href="https://agentmods.dev/commands/patrickdeanfox/zuar-portal-mcp/portal-audit"><img src="https://agentmods.dev/badge/commands/patrickdeanfox/zuar-portal-mcp/portal-audit/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/commands/patrickdeanfox/zuar-portal-mcp/portal-audit"><img src="https://agentmods.dev/badge/commands/patrickdeanfox/zuar-portal-mcp/portal-audit.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00016 | $0.00442 |
| Opus 5 | $0.00008 | $0.00221 |
| Sonnet 5 | $0.00003 | $0.00088 |
| Haiku 4.5 | $0.00002 | $0.00044 |
Grade A, and why
portal-audit scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
Copies of this mod
1 near-identical copy found in the catalogue:
- portal-audit — 100% identical, 0 lines differ
What it actually says
Audit existing portal blocks. Read-only — do not fix anything.
Confirm a portal is connected: check_connection (one call — portal, version, identity, write posture, browser assist). If it reports connected:false, relay its reason + fix and send the user to /portal-setup.
Scope the set. If $ARGUMENTS is given, audit only blocks matching that filter (a page, a name prefix, etc.); otherwise audit all blocks. State the scope before starting.
Run it one of two ways:
- Automated: run the
.claude/workflows/portal-audit.jsWorkflow — it fans the auditors across the scoped blocks and returns a ranked report. Prefer this for a large set. Passargs:{ filter, limit, tier }—tierdials reviewer depth:'fast'(sonnet, cheap sweep),'standard'(default, opus reviewers),'max'(opus/xhigh, deepest audit). Usefastfor a large set you just want triaged;maxfor a high-stakes pre-release pass. - Manual: fan portal-block-adversary (bugs, silent-data traps, edge cases, a11y, responsiveness) and portal-block-advisor (design fit, does it serve the question) across the scoped blocks via the Task tool, then synthesize. (Manual mode uses each auditor's default opus model.)
Synthesize a single ranked report: blocking issues first (broken bindings, $-trap blanking, empty-block column mismatches, silent-data truncation), then a11y/responsive problems, then design-fit notes — each tied to a block_id.
This command does not modify anything. Close by offering to send the flagged blocks through /portal-build's debugger stage to fix them.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 11d ago First seen · 21 lines · 16 tokens per session scan A e7d55d118449
portal-audit is a command published in the GitHub repository patrickdeanfox/zuar-portal-mcp (1 stars, last pushed 1mo ago), licensed MIT. It adds 16 tokens to every session and 442 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other commands, from other repositories
audit
A project review command that checks both the user interface and the code. It can inspect design rules, accessibility, performance, security, and code quality at different levels of depth.
critique
Design lens critique covering visual hierarchy, clarity, and anti-slop patterns — produces a findings table, no code edits unless asked. Use when the user wants a design review, says "what's wrong with this UI", or needs a second opinion before a handoff or presentation.
hld-review
Review High-Level Design (HLD) against architecture principles and requirements.
pi-ui-review
UI/UX review via Gemini — accessibility, responsive design, component structure.
ui-flow-review
Review menus, HUD, navigation, and player flow from a UX perspective.
design-system-review
Analyze design token usage and component consistency.