A command-based audit and repair system that uses a manifest, a planned sequence of work, tests, and review steps to manage code changes. It also includes commands for tasks, bugs, reports, usage tracking, setup diagnosis, and parallel worktrees.

Use it to inspect audit status, create or run tasks and bug fixes, review or resume phases, generate reports, check setup, sync work items, choose manifest layout, and run phases in separate Git worktrees.

It organizes large or multi-step code maintenance so work can be planned, checked, resumed, reviewed, and tracked. The manifest records what phases and tasks belong to the audit.

audit — Plugin for Claude Code by AleksandarBisevac/claude-plugins

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Clone the repo

git clone --depth 1 https://github.com/AleksandarBisevac/claude-plugins

Made for: Claude Code.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/plugins/aleksandarbisevac/claude-plugins/audit/github.svg)](https://agentmods.dev/plugins/aleksandarbisevac/claude-plugins/audit)

Your own site

<a href="https://agentmods.dev/plugins/aleksandarbisevac/claude-plugins/audit"><img src="https://agentmods.dev/badge/plugins/aleksandarbisevac/claude-plugins/audit/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/plugins/aleksandarbisevac/claude-plugins/audit"><img src="https://agentmods.dev/badge/plugins/aleksandarbisevac/claude-plugins/audit.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session not measured What this adds to a session before it is invoked.

When invoked not measured The manifest loads nothing itself; its 2 skills, 21 commands, 4 agents, 5 hooks cost 2,106 tokens a session between them.

Security scan A 1 finding. A grade says what 26 rules found in the file — not that it is safe.

Origin original No closer match found in the catalogue.

Security

Grade A, and why

audit scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Reads agent configuration directorieslowAgent snooping

.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.

"description": "Manifest-driven, model-aware, test-driven audit/fix pipeline. Ships /audit:status|next|run|phase|review|resume|report (execution), /audit:init (multi-agent manifest generation with an approval gate — decl

Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.

plugins/audit/.claude-plugin/plugin.json · 28 lines

How it starts

The opening of the file, as written. The whole thing — 28 lines — stays where its author put it; the contents beside it link to each section on GitHub.

{
  "name": "audit",
  "version": "3.4.0",
  "description": "Manifest-driven, model-aware, test-driven audit/fix pipeline. Ships /audit:status|next|run|phase|review|resume|report (execution), /audit:init (multi-agent manifest generation with an approval gate — decline parks phases as proposals), /audit:propose (list/materialize/drop parked phase proposals), /audit:task (task creation), /audit:bug (bug tracking with red-first TDD fixes), /audit:sync (Azure DevOps work-item sync), /audit:usage (token spend attributed by phase/task/model/author/area, with cache economics, a monthly overview and trend), /audit:panel (local config + composition + usage control panel with skill/agent discovery), /audit:layout (choose the manifest layout in either direction: sharded for fewer tokens per phase + parallel-safe phases, single-file for one file and one diff; /audit:migrate stays as the legacy spelling of `layout sharded`), /audit:worktree (list/add/remove/sweep the git worktrees a plan owns — sweep is read-only until --apply and reaps only what this plugin created, for a phase that has signed off, on a branch contained in its parent, in a clean tree), /audit:doctor (diagnose the setup: interpreter, git root, config, manifest, plan-gate tier, capability policy, build runners, hooks), plus plan-first + secret-safety + token-logging + capability-policy + TDD-reminder guard hooks, and two auto-triggering skills so \"audit this codebase\" and \"what did that cost\" find it without knowing a command name. Reports render to standalone HTML + Markdown or publish to a shareable link. Parameterized per-repo via .claude/audit.config.json — no company/project coupling.",
  "author": {
    "name": "Aleksandar Bisevac",
    "email": "[email protected]"
  },
  "homepage": "https://github.com/AleksandarBisevac/claude-plugins",
  "repository": "https://github.com/AleksandarBisevac/claude-plugins",
  "license": "MIT",
  "keywords": [
    "audit",
    "orchestrator",
    "plan-first",
    "

Read the full file on GitHub · 28 lines

Contents

What it installs

The manifest is a name and a version. 2 skills, 21 commands, 4 agents, 5 hooks travel with it, and installing the plugin installs all of them — 2,106 tokens a session between them. Each is measured on its own page, and each can be installed alone.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

2d ago Changed 064753ae3f61
5d ago Changed d6adf046a820
9d ago Changed 3eefcaca1635
14d ago Changed 5adf23ec6fba
1mo ago Changed 67f969650431
1mo ago Changed a6dd0deae414
1mo ago Changed c70c895a38e5
1mo ago Changed 8302a13d0c7b
1mo ago Changed 65dc9765fc4e
1mo ago First seen · 28 lines scan A d83f8c17c5d0

Subscribe to this mod's changes

audit is a plugin published in the GitHub repository AleksandarBisevac/claude-plugins (4 stars, last pushed 3d ago), licensed MIT. Its token cost is not measured: this kind of file is read by the harness, not the model. A static security scan graded it A with 1 finding (reads agent configuration directories). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Claude Code Debugging Testing agentic-ai audit azure-devops claude-code-plugin claude-code-plugins-marketplace

rust-intel

Defense against LLM Rust failure modes: 59 categories of bugs that survive rustc, clippy, and cargo test — async cancellation, unsafe/FFI, concurrency, crypto, supply-chain, tests-that-pass-by-luck, semantic conformance, and systemic performance cost. Ships the rust-intel skill plus /rust-intel:audit, /rust-intel:fix.

PHPCraftdream/rust-intel · not measured

vibe-engineering

33 engineering discipline skills for Claude Code, OpenAI Codex & Gemini CLI — research, quality gates, reward-hacking checks, testing patterns, deployment, gap analysis, spec sync, and more. Extracted from real-world development.

ash1794/vibe-engineering · not measured

polygraph

A polygraph for your state machine. The agent does the hard part for you: it instruments your code, builds any test doubles needed to run it, and captures real execution traces — then has an LLM derive a transition-function spec from the source (default: a SAM v2 strict-profile module with named…

cognitive-fab/polygraph · not measured

karellen-lsp-mcp

LSP-backed code intelligence for Claude Code via MCP and native LSP - navigate definitions, references, call hierarchies, type hierarchies, and diagnostics across codebases.

karellen/karellen-lsp-mcp · not measured

devflow

Full-lifecycle AI development workflow — fuses grill-with-docs (Matt Pocock) + OpenSpec (Fission-AI) + superpowers (obra) into one disciplined pipeline. Three modes: Design (quick-grill → spec-lite), Build (grill → spec → plan → isolate → enhanced-apply → review → archive), Fix (diagnose → apply → verify → archive).

AppleCG/devflow · not measured

python

Python code quality: ruff linting (ZERO noqa), type checking (ZERO type:ignore), clean code (SOLID), TDD with pytest.

ruslan-korneev/claude-plugins · not measured

audit