Getting it into your agent
This one installs as part of its plugin. Adding the marketplace and installing the plugin brings it with everything else the plugin ships.
/plugin marketplace add sdsrss/claudemd/plugin install claudemdWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/commands/sdsrss/claudemd/claudemd-audit)<a href="https://agentmods.dev/commands/sdsrss/claudemd/claudemd-audit"><img src="https://agentmods.dev/badge/commands/sdsrss/claudemd/claudemd-audit.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00042 | $0.01671 |
| Opus 5 | $0.00021 | $0.00835 |
| Sonnet 5 | $0.00008 | $0.00334 |
| Haiku 4.5 | $0.00004 | $0.00167 |
Grade B, and why
claudemd-audit scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Recursive force deletemediumDestructive command
rm -rf with a variable or a broad path is one typo away from removing the wrong tree.
Format per-hook sections, the bySection heatmap (sorted by total desc), and call out any `byBypass` token with ≥3 occurrences as "review candidate" per §0.1 demotion principle, and for each such token print its top `bySu Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.
How it starts
The opening of the file, as written. The whole thing — 33 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Default window is 30 days. If the user passes a number (e.g. /claudemd-audit 90), set CLAUDEMD_AUDIT_DAYS=$ARGS before invocation.
Run: CLAUDEMD_AUDIT_DAYS=${ARGS:-30} node ${CLAUDE_PLUGIN_ROOT}/scripts/audit.js
The JSON contains:
| Field | Meaning |
|---|---|
byHook |
per-hook total + event breakdown — answers "which hook is firing" |
bySection |
per-spec-section total + event/hook breakdown — answers "which spec rule is firing" (drives §0.1/§13.1/§13.2 promotion/demotion accounting). Null-section rows split by cutoverTs (v0.9.37): (unset-historical) = pre-v0.7.0 legacy (will age out), (unset-current) = post-cutover null-section (mix of intentional housekeeping events + instrumentation gaps). |
byBypass |
per-token bypass-escape-hatch usage — high counts signal a rule that's too strict and is being routinely overridden. Each token also carries bySubject: WHAT the hatch was used against (vars:<NAME> / a runner / a rule slug / a shape:source->sink). A token count alone cannot separate 12 overrides of one badly-worded rule from 12 unrelated one-offs, and those imply opposite actions — read bySubject before proposing a demote. Rows from before v0.64.0 group under (no subject); a series spanning that boundary is split, not averaged. |
uniqueInvocations |
per-hook dedup view (v0.9.34, dupe-split v0.21.7): rows = raw row count; unique_invocations = distinct (ts, hook, session_id, tool_use_id, event, extra) tuples (v0.23.21 — was a 4-field key; multi-emit hooks like pre-bash-safety log one row per matched pattern in a compound command, so event+extra are needed to separate legit multi-emit from a real double-fire); duplicate_rows = rows−unique (back-compat sum); duplicate_rows_real = dupes where colliding row has non-null tool_use_id AND is byte-identical (same event+extra) to an earlier row in the same invocation (= true single-invocation double-fire signal — registration/lib bug candidate when on PreToolUse/PostToolUse, but see the multi-emit caveat below); duplicate_rows_legacy = dupes where colliding row has null tool_use_id (= seconds-precision collision noise from pre-v0.9.34 legacy rows OR expected Stop/SessionStart-class same-second-same-session hits); legacy_rows = rows with both session_id+tool_use_id null (pre-v0.9.33 noise floor). |
dataIntegrity.cutoverTs |
ISO-8601 UTC of the earliest row carrying a non-null spec_section; null when log is entirely pre-v0.7.0. Drives the bySection cutover-split. |
dataIntegrity.testSessionsFiltered |
v0.17.7 — count of test-sentinel rows stripped from every view: session_id='t'/'test' (hook unit-test sentinels) plus, since v0.23.20, any non-null session_id ≤7 chars (ad-hoc manual-debug sentinels like 's'/'probe'; real CC ids are 36-char UUIDs). Lets the operator confirm filter ran + quantify test traffic; raw byHook/bySection numbers in the same payload are post-filter, real-session-only. |
topPatterns |
banned-vocab matched-word ranking |
denyByProjectClass |
v0.23.8 — per-hook blocking-deny (deny/deny-repeat/deny-prose; excludes deny-prose-dry-run) split into self (the plugin dogfooding itself — project path ends in -claudemd) / external (real downstream repos) / unknown (no project field). Raw deny counts overstate enforcement value when claudemd's own repo dominates traffic (banned-vocab ~498/516 historically self). |
selfCompliance |
v0.28.0 — self-enforced-rule compliance from the retrospective transcript scan of the CURRENT project (same window; wraps scripts/sampling-audit.js, 8 detectors). Per rule: opportunities / violations / rate / precision / status. rate is null until the rule's detector is hand-labeled to precision ≥ 0.8 (pre-registered A4 gate) — status says collecting until then. |
For denyByProjectClass: report each hook's deny split as <external> external / <self> self / <unknown> unknown and lead with the external count as the real downstream-interception signal — do NOT present the raw deny total as the enforcement value (most of it is the plugin's own dogfood; see the 498/516 banned-vocab finding).
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 6d ago First seen · 33 lines · 42 tokens per session scan B 263243c40b37
claudemd-audit is a command published in the GitHub repository sdsrss/claudemd (2 stars, last pushed yesterday), licensed MIT. It adds 42 tokens to every session and 1,671 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it B with 1 finding (recursive force delete). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other commands, from other repositories
plan
Turn an approved spec into an implementation plan an engineer with zero context could execute — with a quality controller that blocks placeholders and hollow tasks.
simplify
The over-engineering review: five tags (delete, stdlib, native, yagni, shrink), a mandatory replacement per finding, and a real null result when there is nothing to cut.
audit
Onboard an existing codebase: every domain's checks over the whole tree, then a triaged plan to bring it in line.
test
Run the repository's actual test suite: every ecosystem's canonical runner — NOT run is never green.
git
The pre-finish status: branch, hygiene findings, message checks, workflow lint, template state.
edit
인터뷰 방식으로 기존 페르소나(기본 15관점 + 도메인 4종 + create로 만든 것 전부)의 트리거 단어를 추가·수정·제거.