Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/AlpacaLabsLLC/skills-for-architectsnpx agentmods add skills/alpacalabsllc/skills-for-architects/product-auditWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/alpacalabsllc/skills-for-architects/product-audit)<a href="https://agentmods.dev/skills/alpacalabsllc/skills-for-architects/product-audit"><img src="https://agentmods.dev/badge/skills/alpacalabsllc/skills-for-architects/product-audit/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/alpacalabsllc/skills-for-architects/product-audit"><img src="https://agentmods.dev/badge/skills/alpacalabsllc/skills-for-architects/product-audit.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00044 | $0.01413 |
| Opus 5.5 | $0.00018 | $0.00565 |
| Sonnet 5.5 | $0.00009 | $0.00283 |
| Haiku 4.5 | $0.00004 | $0.00141 |
Grade A, and why
product-audit scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 62 lines — stays where its author put it; the contents beside it link to each section on GitHub.
/as:product-audit — Audit a product selection
Before acting, read the host contract and this component's declaration (skill:product-audit). Load only its referenced mode profiles from the shared catalog. Compose modes required by the actual task; declarations are requirements, not proof of access or permission.
Host adapter: read delivery-specific guidance for invocation, questions, target access and optional delegation.
Input and authority
For source-independent captured evidence, use the shared product-observation adapter with explicit item/revision bindings. Include its conflicts and notices alongside the legacy audit projection; never discard identity, variant, unit, currency, or price-basis uncertainty when reporting findings.
Accept one item, selected tags, or a complete schedule. For project records, resolve exact native project context and read its instructions. A missing/ambiguous boundary is not permission to create a project. One-off comparison uses an explicitly supplied snapshot without adoption. Read the complete native audit owner and input schema.
For adopted schedules, use /as:master-schedule to read the pinned item/schedule revisions. Item IDs are immutable; tags and workbook rows are only locators. An old workbook or optional product-library.csv does not override current records. One-off library comparisons retain the exact header and CSV conventions.
Steps
- Establish the requested scope, revision, source basis and live versus snapshot mode. Default a request to check current product facts to live retrieval. No routine second confirmation is needed for a read-only comparison.
- Live audit always retrieves/re-parses the relevant sources in this invocation. Use the host browser/PDF capabilities; do not present cached catalog data as freshly verified. Record source/page or field locator and observed-at time. If access fails, keep
unavailable; do not downgrade to snapshot comparison silently. Snapshot mode explicitly compares saved observations and cannot establish current facts. - Separate manufacturer/dealer, selected versus available configuration, actual model/accessory and installed/cutout dimensions. Preserve unknown prices/currency, evidence conflicts and user overrides. A variant combination is not a manufacturer-confirmed SKU without source evidence.
- Build the complete typed input and apply
ffe_audit.assessthrough available native capabilities under its owning semantics. It compares supplied observations only, performs no retrieval and cannot authenticate the host's evidence. Preserve strict number kinds, ASCII-escaped logical input hash, full findings order and exact comparison counts. Missing validation capability is a limitation, not a successful check. - Present discrepancies, missing evidence, stale observations and conflicting sources, tied to immutable item/revision and field. Exact value comparisons do not convert units: resolve dimensional meaning and units before constructing comparable observations. Missing evidence is unknown, not proof that the specification is wrong.
- When a durable report is requested/authorized, preview the exact collision-safe target under
ffe/jobs/<job-id>/audits/, then save the report and source references. Use one confirmation gate only if required and not already authorized. Refuse overwrite; preserve previous reports. Do not persist machine-absolute paths in records. Report the actual file created.
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago Changed fe31ae3658d9
- 1mo ago First seen · 62 lines · 44 tokens per session scan A 6c66366256c0
product-audit is a skill published in the GitHub repository AlpacaLabsLLC/skills-for-architects (395 stars, last pushed 7d ago), licensed MIT. It adds 44 tokens to every session and 1,413 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-21.
Other skills, from other repositories
oci-drawio-icon-native
Build and validate OCI draw.io diagrams in icon-native mode so they never depend on mxgraph.oci. runtime libraries. Use when authoring or fixing Oracle Cloud architecture diagrams in draw.io that must render portably.
microservices-architecture
Guides service boundary analysis, communication pattern selection, data consistency design, API contract strategy, and resilience checklist for microservices systems. Complements the microservices fragment. Invoked when the user asks to design a microservices system, split a monolith, or review service boundaries.
relational-database-design
Designs or reviews a relational database schema for a given domain. Covers table structure, normalization, indexes, constraints, and migration strategy. Invoked when the user asks to design a schema, review a database structure, or optimize a data model.
wireframe-prototyping
Creates low-fidelity wireframes and interaction annotations for a feature or screen. Covers user flow identification, ASCII wireframe sketching, interaction annotation, and acceptance criteria. Invoked when the user asks to wireframe a screen, prototype a UI, or sketch a user flow.
refactor
Refactors specified code to improve clarity, reduce duplication, or align with the project's architectural patterns — without changing external behavior. Invoked when the user asks to refactor, clean up, simplify, or restructure code.
diagram-design
Designs implementation-grounded architecture, sequence, and flow diagrams from existing code and documentation. Ensures notation is chosen intentionally, avoids invented components or flows, and explicitly flags mismatches across ADRs, RFCs, and code.