audit-verbs

audit-verbs is a command for Claude Code from UiPath/skills. It costs 0 tokens per session (1,453 once invoked), scanned A, original, MIT.

A command that checks whether user-interface verbs mentioned in task files and skill documentation exist in the installed uip command-line tool. It creates Markdown audit reports in tests/reports/.

In plain words
What is it for?
Use it to audit test tasks, skill files, or both, with an optional catalog refresh before checking.
Why use it?
It catches documentation or task instructions that refer to commands the installed tool does not provide.

Command for Claude Code

Part of the uipath plugin — 25 skills, 7 commands, 5 agents, 5 hooks, 1 plugin shipped together

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add commands/uipath/skills/audit-verbs
Clone the repo
git clone --depth 1 https://github.com/UiPath/skills

Made for: Claude Code.

Or install uipath, the plugin that ships this one along with the rest of its 25 skills, 7 commands, 5 agents, 5 hooks, 1 plugin.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for audit-verbs

README.md
[![agentmods](https://agentmods.dev/badge/commands/uipath/skills/audit-verbs.svg)](https://agentmods.dev/commands/uipath/skills/audit-verbs)
Your own site
<a href="https://agentmods.dev/commands/uipath/skills/audit-verbs"><img src="https://agentmods.dev/badge/commands/uipath/skills/audit-verbs.svg" alt="Measured on agentmods" height="20"></a>
Per session 0 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.
When invoked 1,453 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00000 $0.01453
Opus 5 $0.00000 $0.00727
Sonnet 5 $0.00000 $0.00291
Haiku 4.5 $0.00000 $0.00145

Measured 5d ago against content hash 0b396f72c881, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-05, from the pricing page.

Security

Grade A, and why

audit-verbs scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.claude/commands/audit-verbs.md · 92 lines

How it starts

The opening of the file, as written. The whole thing — 92 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Audit uip Verb References

Verify that every uip <verb> mentioned in task YAMLs and skill docs corresponds to a real verb in the installed uip CLI. Produces two markdown audit reports under tests/reports/.

Input: $ARGUMENTS

  • Empty (default) — audit both tests and skills.
  • tests — only tests/tasks/. Writes tests/reports/cli-verb-audit.md.
  • skills — only skills/. Writes tests/reports/skill-verb-audit.md.
  • --refresh — force a catalog rebuild before running, even if a snapshot already exists.

Output: One or both of:

  • tests/reports/cli-verb-audit.md — task-YAML reachability (High/Medium/Info severities, sourced from command_executed patterns).
  • tests/reports/skill-verb-audit.md — skill-doc verb references (Stale/Uncertain severities, sourced from prose, code blocks, and tables).

Plus a chat summary with the top counts and the worst-offender files.


Phase 1 — Ensure Catalog

The catalog at assets/uip-catalog-snapshot.json is the source of truth for "which verbs exist". Without it the checkers cannot run.

  1. If --refresh was passed, or assets/uip-catalog-snapshot.json does not exist, run:

    python3 scripts/build-uip-catalog.py
    

    The builder requires uip on PATH. If the user is missing plugin tools (admin, platform, etc.), warn that coverage will be incomplete — the report will surface those as Stale findings even when the verbs are valid in a fully-installed environment. Suggest python3 scripts/build-uip-catalog.py --install-tools; if local npm resolves @uipath/* from the internal GH Packages feed (alpha prereleases), pin the scope first with npm config set @uipath:registry https://registry.npmjs.org/.

  2. If the snapshot exists and --refresh was NOT passed, read its generated_at field. If older than 24 hours, print a one-line note suggesting /audit-verbs --refresh and continue with the stale snapshot.

  3. Read the snapshot to know:

    • cli_version, verbs count, unwalkable_groups — surface all three in the chat summary.

Read the full file on GitHub · 92 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 5d ago First seen · 92 lines · 0 tokens per session scan A 0b396f72c881

Subscribe to this mod's changes

audit-verbs is a command published in the GitHub repository UiPath/skills (154 stars, last pushed today), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 1,453 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.