Borrowing it
Nothing to install: this file belongs to swarm-ai-research/swarm. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/swarm-ai-research/swarm/main/.claude/commands/audit_fix.mdgit clone --depth 1 https://github.com/swarm-ai-research/swarmWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/commands/swarm-ai-research/swarm/audit_fix)<a href="https://agentmods.dev/commands/swarm-ai-research/swarm/audit_fix"><img src="https://agentmods.dev/badge/commands/swarm-ai-research/swarm/audit_fix.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00000 | $0.01005 |
| Opus 5 | $0.00000 | $0.00502 |
| Sonnet 5 | $0.00000 | $0.00201 |
| Haiku 4.5 | $0.00000 | $0.00101 |
Grade A, and why
audit_fix scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 86 lines — stays where its author put it; the contents beside it link to each section on GitHub.
/audit_fix
Deep codebase audit: spawn category-specific agents, triage findings by severity, fix critical issues.
Usage
/audit_fix [--scan-only] [--categories=security,invariants,...] [path]
/audit_fix— full scan + triage + fix cycle on the whole codebase/audit_fix --scan-only— scan and triage only, do not apply fixes/audit_fix --categories=security,threading— limit to specific categories/audit_fix swarm/agents/— scope scan to a specific directory
Phase 1: Scan
Spawn up to 10 parallel Explore agents, one per category. Each agent searches the codebase (or specified path) for issues in its domain:
| # | Category | What to look for |
|---|---|---|
| 1 | Deprecated APIs | Removed stdlib modules, deprecated function calls, legacy patterns |
| 2 | Error handling | Bare except:, except Exception: pass, swallowed errors, missing logging |
| 3 | Type safety | Missing type annotations on public APIs, Any overuse, unchecked casts |
| 4 | Security | SQL injection (f-string interpolation in queries), hardcoded secrets, command injection, path traversal |
| 5 | Dead code | Unused imports, unreachable branches, commented-out code blocks, unused functions |
| 6 | Test quality | Missing assertions, tests that can't fail, no edge-case coverage for critical paths |
| 7 | Concurrency | Shared mutable state without locks, race conditions, missing thread safety |
| 8 | Invariant violations | p outside [0,1], unseeded random.*() calls, destructive operations on append-only data |
| 9 | Config/schema | Missing validation, undocumented required fields, schema drift between YAML and code |
| 10 | Documentation drift | CLAUDE.md, docstrings, or READMEs that contradict current code behavior |
| 11 | Dependency health | file: deps in package.json (recursive copy loops), deeply nested node_modules/, git+https:// pins in requirements.txt, file:/path: dev deps in pyproject.toml that won't resolve in CI |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 86 lines · 0 tokens per session scan A 413e3650067a
audit_fix is a command published in the GitHub repository swarm-ai-research/swarm (41 stars, last pushed yesterday), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 1,005 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other commands, from other repositories
qa-changes
This skill should be used when the user asks to "QA a pull request", "test PR changes", "verify a PR works", "functionally test changes", or when an automated workflow triggers QA validation of code changes. Provides a structured methodology for setting up the environment, exercising changed behavior, and reporting…
http-service
Build, review or debug a Bun HTTP service. Loads the http-service skill, then works the task through its workflow.
auditar-cascading
Invoca cascading-failures-auditor — audita serviço para 5 triggers de cascade (sem timeout, retry sem jitter, sem circuit breaker, sem deadline, queue unbounded) e gera CASCADING-AUDIT.md.
debug
Systematic 9-step debugging framework. Generate 20+ hypotheses, rank by likelihood, implement most probable fix.
css-debug
Debug CSS issues including specificity conflicts, cascade problems, and layout bugs.
performance-optimization
Optimize application performance end-to-end using specialized performance and optimization agents.