Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add AlexZio00/sovereign-skills --skill doc-driftgit clone --depth 1 https://github.com/AlexZio00/sovereign-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/alexzio00/sovereign-skills/doc-drift)<a href="https://agentmods.dev/skills/alexzio00/sovereign-skills/doc-drift"><img src="https://agentmods.dev/badge/skills/alexzio00/sovereign-skills/doc-drift/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/alexzio00/sovereign-skills/doc-drift"><img src="https://agentmods.dev/badge/skills/alexzio00/sovereign-skills/doc-drift.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Rogue Agent · line 100 Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.Fix: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00240 | $0.04734 |
| Opus 5 | $0.00120 | $0.02367 |
| Sonnet 5 | $0.00048 | $0.00947 |
| Haiku 4.5 | $0.00024 | $0.00473 |
Grade A, and why
doc-drift scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 406 lines — stays where its author put it; the contents beside it link to each section on GitHub.
doc-drift — Claude memory audit
Purpose
Scan the memory and documents Claude loads for this project, and surface what's stale, what contradicts something else, what's risky or ambiguous, and what leaks session-only context into skills/agents/commands docs — sorted by priority.
Memory verification: the CLAUDE.md / MEMORY.md / rules files this skill reads are past-point-in-time snapshots. Verify current state with Glob/Read before acting — never assume "it's in memory, so it must still be true" (per memory-discipline principles).
Dominant Variable
False-positive rate — if a finding turns out to be wrong, the person stops trusting the report and the tool itself gets abandoned. One false positive outweighs one missed real issue.
Trigger
/doc-drift- "문서 정합성"
- "docs 체크"
Discard If
- The project has neither CLAUDE.md nor MEMORY.md (nothing to audit) — hard discard, no override (there is nothing to read).
- Default: skip an immediate re-audit within 24h of the last one (drift
needs time to accumulate — an immediate re-audit mostly reproduces the same
result). Override: this is a recommendation, not a block — if the user
just changed something and wants to confirm the fix landed (regression
check), or invokes
/doc-drift --force-after-change, run anyway and noteRe-audit before 24h elapsed: forcedin the report header. - Default: skip projects with fewer than 10 files (audit cost exceeds the
benefit for a large low-risk repo). Override: a small repo that is
high-risk (handles secrets, is a shared/published skill, or the user
explicitly asks for it despite the size) is worth auditing regardless —
run it and note
Small-repo override applied (N files)in the report header.
Key Assumptions
This skill runs on the following assumptions (per reasoning-standard principles):
- Filesystem access is available — Read/Glob/Grep must work. If broken: fail-fast (report the missing tool).
- The CLAUDE.md
@importtoken convention is honored —@pathsyntax resolves per the standard spec. If broken: graceful degrade (warn + flag any import it couldn't resolve). .drift-reports/is writable — create it if missing. If broken: fall back to/tmpor stdout.
What ships with it
4 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago Changed · +67 lines · +17 tokens per session 2a709eaf4de5
- 12d ago First seen · 339 lines · 223 tokens per session scan A ee951f9215c2
doc-drift is a skill published in the GitHub repository AlexZio00/sovereign-skills (129 stars, last pushed 5d ago), licensed MIT. It adds 240 tokens to every session and 4,734 once invoked, about $0.0012 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
cargo-content
Manage the knowledge a Cargo workspace holds — upload files (PDF, CSV, text), rename and organize them, and build native or connector-backed libraries that sync from an external source, so agents can retrieve them (RAG). Triggers: "upload this PDF", "add these docs as knowledge", "build a knowledge base", "sync our…
transcribe
A spreadsheet-reading workflow for converting XLSX, ODS, or CSV files into Markdown, including documents that use merged cells for layout. It checks that every spreadsheet cell survives the conversion.
retro
Mine review artifacts for recurring patterns and write project learnings.
nobrainer-review
Use when the owner says nb-review, deep-audit, deep-code-review, or deep-autoreview; explicitly requests an evidence-gated CLOSEOUT, adversarial BUGHUNT or RELEASEGATE; or needs final findings filtered to verified actionable defects. Use nobrainer-build for ordinary implementation and correction work.
use-cli-recall
A command-line tool for searching records of earlier coding sessions and checking the current code with fast file-search tools.
before-and-after
Captures before/after screenshots of web pages or elements for visual comparison. Use when user says "take before and after", "screenshot comparison", "visual diff", "PR screenshots", "compare old and new", or needs to document UI changes. Accepts two URLs (file://, http://, https://) or two image paths.