Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add 3xachris/3xa-harness --skill claim-auditgit clone --depth 1 https://github.com/3xachris/3xa-harnessWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/3xachris/3xa-harness/claim-audit)<a href="https://agentmods.dev/skills/3xachris/3xa-harness/claim-audit"><img src="https://agentmods.dev/badge/skills/3xachris/3xa-harness/claim-audit/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/3xachris/3xa-harness/claim-audit"><img src="https://agentmods.dev/badge/skills/3xachris/3xa-harness/claim-audit.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00101 | $0.02564 |
| Opus 5 | $0.00051 | $0.01282 |
| Sonnet 5 | $0.00020 | $0.00513 |
| Haiku 4.5 | $0.00010 | $0.00256 |
Grade A, and why
claim-audit scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 101 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Claim Audit
A record is read by someone deciding whether to act without re-deriving it. A number they can trace — to a path, a date, a measurement, a run — costs them one look. A number that arrives bare costs them the whole derivation, which is the work the record existed to save. So the checkable form is:
Every number written into a record either carries a source, or is marked as unverified.
The script claim_audit.py finds the lines that satisfy neither. It is a candidate detector, not a judge: it reads shape, not meaning, so some of what it returns will be fine as written.
How noisy that is, measured rather than asserted — one run over this repository, reproducible with python addons/audit/skills/claim-audit/claim_audit.py --root . --full: 21 Markdown records scanned in about a tenth of a second, 2 lines left for a human, 3 more auto-classified as restatements (§3, The fifth disposition), and both human-judged lines were false positives on review — budget lines declaring a fuse rather than reporting a measurement. So the per-run reading cost here was five lines, and the finding count was zero. That is one small documentation-heavy repo that had already been cleaned against this tool, not a precision figure for yours; run it on your own records before deciding how much attention it deserves, and before binding it to anything (§5). The first run on an older project is the expensive one — that is what the baseline (§4) exists for.
1. What counts as a source
A line passes when it carries any of these, on the same line as the number:
| Signal | Example | Checked how |
|---|---|---|
| A path with a line number | verify_closeout.py:16 |
the file must exist |
| A filename in backticks | the limit lives in `config.json` |
the file must exist |
| A link, or a WikiLink | [[docs/decisions.md#2026-08-01 Picked the cache]] |
the file must exist |
| A date | 2026-08-07 |
shape only |
| A field naming its origin | evidence: artifacts/run.log, source: docs/spec.md |
shape only |
| A measurement verb | measured, benchmarked, reproduced, profiled, counted, timed | shape only |
| A reference id | AC-3, #412, PROJ-88, §4 |
shape only |
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 10d ago First seen · 101 lines · 101 tokens per session scan A 20d7bf5290ac
claim-audit is a skill published in the GitHub repository 3xachris/3xa-harness (17 stars, last pushed 10d ago), licensed MIT. It adds 101 tokens to every session and 2,564 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
at-review
Review code changes for bugs, regressions, convention violations, and high-value cleanup opportunities. Use for diffs, commit ranges, hosted PR/MR URLs, branches, paths, staged changes, or working-tree changes.
at-vision
Inspect screenshots, photos, diagrams, image paths, and image URLs when the task depends on visible content. Use when the prompt lacks actual image content, native inspection fails, or the user requests inspectimage; prefer the MCP tool, then the installed CLI.
at-usage
Query and display the current API provider balance and recent usage.
mermaid
Create, validate, and repair Mermaid.js diagrams. Use when generating flowcharts, sequence, class, ER, state, or Gantt diagrams, or any visualization.
bootstrap
Bootstrap a greenfield project with parent-owned interviews and bounded plan, revision, and apply actions.
pr-stack
Plan and execute splitting a large PR or branch into a reviewable stacked PR sequence.