Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/arnabdeypolimi/claude_code_setup/auditnpx skills add arnabdeypolimi/claude_code_setup --skill auditgit clone --depth 1 https://github.com/arnabdeypolimi/claude_code_setupWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00054 | $0.01904 |
| Opus 5 | $0.00027 | $0.00952 |
| Sonnet 5 | $0.00011 | $0.00381 |
| Haiku 4.5 | $0.00005 | $0.00190 |
Grade A, and why
audit scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
This is a copy
86% identical to audit — 9 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.
How it starts
The opening of the file, as written. The whole thing — 147 lines — stays where its author put it; the contents beside it link to each section on GitHub.
MANDATORY PREPARATION
Invoke /frontend-design — it contains design principles, anti-patterns, and the Context Gathering Protocol. Follow the protocol before proceeding — if no design context exists yet, you MUST run /teach-impeccable first.
Run systematic technical quality checks and generate a comprehensive report. Don't fix issues — document them for other commands to address.
This is a code-level audit, not a design critique. Check what's measurable and verifiable in the implementation.
Diagnostic Scan
Run comprehensive checks across 5 dimensions. Score each dimension 0-4 using the criteria below.
1. Accessibility (A11y)
Check for:
- Contrast issues: Text contrast ratios < 4.5:1 (or 7:1 for AAA)
- Missing ARIA: Interactive elements without proper roles, labels, or states
- Keyboard navigation: Missing focus indicators, illogical tab order, keyboard traps
- Semantic HTML: Improper heading hierarchy, missing landmarks, divs instead of buttons
- Alt text: Missing or poor image descriptions
- Form issues: Inputs without labels, poor error messaging, missing required indicators
Score 0-4: 0=Inaccessible (fails WCAG A), 1=Major gaps (few ARIA labels, no keyboard nav), 2=Partial (some a11y effort, significant gaps), 3=Good (WCAG AA mostly met, minor gaps), 4=Excellent (WCAG AA fully met, approaches AAA)
2. Performance
Check for:
- Layout thrashing: Reading/writing layout properties in loops
- Expensive animations: Animating layout properties (width, height, top, left) instead of transform/opacity
- Missing optimization: Images without lazy loading, unoptimized assets, missing will-change
- Bundle size: Unnecessary imports, unused dependencies
- Render performance: Unnecessary re-renders, missing memoization
Score 0-4: 0=Severe issues (layout thrash, unoptimized everything), 1=Major problems (no lazy loading, expensive animations), 2=Partial (some optimization, gaps remain), 3=Good (mostly optimized, minor improvements possible), 4=Excellent (fast, lean, well-optimized)
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 147 lines · 54 tokens per session scan A 3a475438b19d
audit is a skill published in the GitHub repository arnabdeypolimi/claude_code_setup (4 stars, last pushed 3mo ago), licensed MIT. It adds 54 tokens to every session and 1,904 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. It is 86% identical to audit, differing in 9 lines, and is treated as a copy.
Other skills, from other repositories
find-your-level
Interactive quiz that maps your AI/ML knowledge to a starting point in the 523-lesson, 20-phase AI Engineering from Scratch curriculum. Trigger phrases: "where should I start", "find my level", "what do I know", "which phase", "assess my knowledge", "placement test", "skip ahead".
learn-mcp
Focused interactive tutor for the Model Context Protocol (MCP) path in AI Engineering from Scratch. Start or resume this route when a learner wants to build, secure, debug, verify, or operate MCP clients, servers, transports, gateways, registries, or conformance gates. Teaches one lesson per invocation and records…
start-learning
One-time onboarding for the AI Engineering from Scratch curriculum (523 lessons, 20 phases). Interviews the learner, runs the placement quiz, and writes LEARNING.md, a persistent study plan the learn skill drives. Trigger phrases: "start learning", "set up the course", "begin the curriculum", "onboard me", "create my…
learn-agent-skills
Focused interactive tutor for the Agent Skills Engineering path in AI Engineering from Scratch. Start or resume this route when a learner wants to create, discover, invoke, secure, evaluate, package, or port Agent Skills. Teaches one lesson per invocation and records evidence in AGENT-SKILLS-LEARNING.md.
skill-release-gate
Evaluate an Agent Skill bundle for structural integrity, trigger quality, artifact improvement, script correctness, safety, installed-tree integrity, and target-host portability before release.
migration-review
Review database migration files when a change adds or modifies paths under migrations/. Use it before merge to collect forward, rollback, locking, and data-safety evidence.