Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/andrewcigan/vibe-dev-plugin/auditnpx skills add andrewcigan/vibe-dev-plugin --skill auditgit clone --depth 1 https://github.com/andrewcigan/vibe-dev-pluginWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/andrewcigan/vibe-dev-plugin/audit)<a href="https://agentmods.dev/skills/andrewcigan/vibe-dev-plugin/audit"><img src="https://agentmods.dev/badge/skills/andrewcigan/vibe-dev-plugin/audit.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00076 | $0.01623 |
| Opus 5 | $0.00038 | $0.00812 |
| Sonnet 5 | $0.00015 | $0.00325 |
| Haiku 4.5 | $0.00008 | $0.00162 |
Grade A, and why
audit scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 143 lines — stays where its author put it; the contents beside it link to each section on GitHub.
/audit
Внешняя оценка здоровья проекта. Закрывает self-bias из критики v5.0.
Главная защита: External Evaluator
/audit НЕ оценивает себя. Запускает отдельный subagent (Sonnet, fresh context) с read-only доступом к артефактам проекта. Этот subagent НЕ читает .harness/assessment.json от предыдущего аудита — иначе он будет подвержен self-bias.
Subagent промпт-шаблон:
Ты — независимый аудитор проекта. Не работаешь с этой кодовой базой.
Прочитай ТОЛЬКО:
- CLAUDE.md
- README.md (для людей)
- feature_list.json
- SESSION.md
- domain-rules.yaml
- error-journal.md (если есть)
- docs/ARCHITECTURE.md, docs/PRODUCT.md
- .harness/tools-allowlist.yaml (если есть)
- последние 10 коммитов git log
НЕ читай: предыдущие assessment, прошлые audit results.
Оцени 7 подсистем по шкале 1-5:
- 1: отсутствует или вредна
- 2: weak, inconsistent
- 3: adequate, basics covered
- 4: good, minor gaps
- 5: exemplary, enforced
Для каждой — конкретное обоснование (1-2 строки).
Найди bottleneck (наименьший балл) — это первый приоритет улучшения.
7-tuple assessment
| # | Подсистема | Что проверяет |
|---|---|---|
| 1 | Instructions | CLAUDE.md ≤200 строк, domain-rules.yaml заполнен, нет монолита |
| 2 | State | feature_list.json валиден, SESSION.md свежий, нет дублирования |
| 3 | Verification | 4-layer применяется, negative-gate работает, dual critique для L фичей |
| 4 | Scope | WIP=1 не нарушено, affected_files указаны, no scope-leak |
| 5 | Lifecycle | init.sh чист, 5-dim clean-exit при handoff, cold-start test проходит |
| 6 | Learning | error-journal не дамп, lessons промотированы, recurrence_rate=0%, domain-rules не устарел |
| 7 | Cost & Safety | tools-allowlist enforced, pre-launch-checklist используется, нет секретов в git |
Дополнительные метрики
Error Velocity
errors_per_session_avg_last_7_days = ?
Тренд — растёт ли скорость ошибок?
Recurrence Rate (CRITICAL)
# % ошибок которые уже были раньше
recurrence_rate = recurring_errors / total_errors * 100
Цель: 0%. Если >0% — Learning subsystem недостаточна, урок не дошёл до памяти или памяти не читают.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 143 lines · 76 tokens per session scan A d4481c29248c
audit is a skill published in the GitHub repository andrewcigan/vibe-dev-plugin (5 stars, last pushed 1mo ago), licensed MIT. It adds 76 tokens to every session and 1,623 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
harness
하네스를 구성합니다. 전문 에이전트를 정의하며, 해당 에이전트가 사용할 스킬을 생성하는 메타 스킬. (1) '하네스 구성해줘', '하네스 구축해줘' 요청 시, (2) '하네스 설계', '하네스 엔지니어링' 요청 시, (3) 새로운 도메인/프로젝트에 대한 하네스 기반 자동화 체계를 구축할 때, (4) 하네스 구성을 재구성하거나 확장할 때, (5) '하네스 점검', '하네스 감사', '하네스 현황', '에이전트/스킬 동기화' 등 기존 하네스 운영/유지보수 요청 시 사용.
kimchi
Turn a raw product idea into build-ready docs — one doc per EPIC with locked decisions, exact API contracts, a story-by-story priority plan, and an execute.md handoff Claude can build from across sessions. Gets the clarity by interrogating the user through a roster of expert personas that grill, counter, and refuse to…
compose
The mumei orchestrator. For new features, presents a vehicle picker — spec (full SDD workflow: clarification → requirements → design → tasks each auto-reviewed up to 3 iterations → single user approval → Wave-by-Wave implementation → 4-stage review) or plan (Claude Code plan-mode wrapper: hand off to plan mode…
peruse
Plan-vehicle review pipeline. Runs Stage 0 detector (semgrep + osv-scanner) plus security-reviewer and adversarial-reviewer in parallel against the current diff, validates each finding via issue-validator, aggregates a verdict, and writes a review JSON to .mumei/plans/ /reviews/ .json. Triggers when the user invokes…
release
Release a new version of the mumei repository. Invoke when the user gives an explicit release instruction ("release it", "/release", "patch release", "ship 0.2.0"). Takes no argument or "patch" / "minor" / "major" for a SemVer bump, or a direct version such as "0.2.0". Wraps any uncommitted changes into a single…
glean
This skill should be used BEFORE any feature design. It runs structured gleaning with the user — asking 5 high-leverage questions per round, up to 3 rounds, to extract Goal / Scope / Constraints / Edges / Done. Output is saved to .mumei/scratch/ .md and used as input for /mumei:compose. Triggers include "I want to add…