Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add adamlinscott/claude-skills --skill context-auditgit clone --depth 1 https://github.com/adamlinscott/claude-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/adamlinscott/claude-skills/context-audit)<a href="https://agentmods.dev/skills/adamlinscott/claude-skills/context-audit"><img src="https://agentmods.dev/badge/skills/adamlinscott/claude-skills/context-audit/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/adamlinscott/claude-skills/context-audit"><img src="https://agentmods.dev/badge/skills/adamlinscott/claude-skills/context-audit.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00115 | $0.02178 |
| Opus 5 | $0.00057 | $0.01089 |
| Sonnet 5 | $0.00023 | $0.00436 |
| Haiku 4.5 | $0.00012 | $0.00218 |
Grade A, and why
context-audit scanned grade A with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Unrestricted tool accesslowExcessive agency
A wildcard tool grant or "run any command" leaves no least-privilege boundary at all.
- Overly broad tool access in agent frontmatter (`tools: *`, `tools: All tools`) when the agent's role doesn't justify it. Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
- In `.claude/settings.json` / `.claude/settings.local.json`: a repo-wide `defaultMode` of `bypassPermissions` (or broad `acceptEdits`), an over-broad permission allowlist (e.g. `Bash(*)`, `Bash(rm *)`, `Bash(curl *)`), How it starts
The opening of the file, as written. The whole thing — 113 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Context audit
Audit the context that gets injected into every Claude session in the current repository. The goal: identify everything that could be working against the agent — security risks, conflicts, bloat, orphaned docs, broken links, and rules that exist in memory but never reach subagents.
Read-only. Print one markdown report. Do not modify any files. (The skill is granted no edit tools, so this is enforced, not just asked.)
Scope note. This is a whole-setup audit. For a deep, classification-based review of the memory directory on its own (Keep / Move / Refresh / Merge / Drop), defer to /memory-audit. Here, assess memory only where it interacts with the rest of the context: conflicts, subagent gaps, and stale references.
What to read
CLAUDE.mdat the repo root, plus any nestedCLAUDE.mdfiles (Glob "**/CLAUDE.md").CONTEXT.mdat the repo root and anywhere it appears.- Everything under
docs/(Glob "docs/**/*.md"). - Every agent file under
.claude/agents/(Glob ".claude/agents/*.md") — note each agent'sdescription,toolsfrontmatter, and body. - The repo's
.claude/settings.jsonand.claude/settings.local.jsonif present. - The repo's per-project memory directory (Claude's per-user memory, scoped to this repo). To locate it reliably, list
~/.claude/projects/and pick the directory whose name is the current repo path with every:,/, and\replaced by-(e.g.C:\Users\me\proj→C--Users-me-proj— note the double dash where:meets\). Match against the actual listing rather than hand-building the path from a guessed rule.- The index is
MEMORY.md; sibling.mdfiles are individual memories. Read all of them, including any not listed inMEMORY.md. - Note each memory's declared
type(user / feedback / project / reference) from its frontmatter. - If the directory does not exist, note that no per-project memory has been set up and continue.
- The index is
What to check
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 113 lines · 115 tokens per session scan A 5e8b059df089
context-audit is a skill published in the GitHub repository adamlinscott/claude-skills (3 stars, last pushed 8d ago), licensed MIT. It adds 115 tokens to every session and 2,178 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it A with 2 findings (unrestricted tool access, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
review
Use in the Review phase before claiming any Java/Spring task is complete, fixed, or passing. Spawns the auditor subagents that check the implementation against every applicable skill, rule, and memory item, runs the test suite for fresh evidence, and re-spawns for at most two fix rounds before reporting what survives.…
claudehut-workflow
Use at the start of every session and whenever beginning a coding task in a Java/Spring backend - establishes the ClaudeHut 7-phase agentic workflow, the complexity-tier routing that lets small tasks skip deliberation phases, and the laws that govern which skills and rules must fire. Injected at session start; also…
implement
Use in the Implement phase whenever writing or editing production Java code, or fixing a bug, in a Spring/Spring Boot project. Enforces test-first (red-green-refactor), executes the approved plan step by step, and honors the project's path-scoped tech-stack rules and the task's enforcement set. Preloaded into…
discover
Use as the FIRST phase of EVERY coding task, before brainstorming - grounds the work in the existing codebase (entry points, key types, structure) and proves whether something reusable already exists. Produces the reuse-scan artifact the write gate requires and the reuse DECISION (adopt / extend / new). Runs inline on…
write-plan
Use in the Plan phase after the spec is approved - dispatches the planner agent to draft the executable plan from the standard template (decision summary, T-xxx task breakdown with test-first + verify per task), gets the user's approval, records the plan (opening the write gate), and mirrors the breakdown into Claude…
brainstorm
Use to generate and weigh solution approaches for a problem, after discovery has grounded the context. Produces two or more genuinely distinct options scored on trade-offs, recommends one, and (for code tasks) assembles the enforcement set the rest of the workflow audits against. General-purpose ideation — works for…