Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/auerbachb/claude-code-config/memory-cleannpx skills add auerbachb/claude-code-config --skill memory-cleangit clone --depth 1 https://github.com/auerbachb/claude-code-configWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00109 | $0.01633 |
| Opus 5 | $0.00055 | $0.00816 |
| Sonnet 5 | $0.00022 | $0.00327 |
| Haiku 4.5 | $0.00011 | $0.00163 |
Grade A, and why
memory-clean scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 116 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Audit this project's durable memory store and present prune recommendations. Same discipline as /pm-clean: evidence for every recommendation, conservative on "stale," and nothing is removed without an explicit yes. All detection and mutation lives in the shared, tested script .claude/scripts/memory-audit.py — this file is the recommend-then-confirm layer.
Step 0: Locate the audit script
Prefer the global install; fall back to the in-repo copy when developing the skill itself.
SCRIPT=""
for candidate in \
"$HOME/.claude/skills-worktree/.claude/scripts/memory-audit.py" \
"$HOME/.claude/scripts/memory-audit.py" \
".claude/scripts/memory-audit.py"; do
if [[ -f "$candidate" ]]; then SCRIPT="$candidate"; break; fi
done
if [[ -z "$SCRIPT" ]]; then
echo "ERROR: memory-audit.py not found (checked ~/.claude/scripts/, skills-worktree, in-repo)" >&2
exit 1
fi
Parse $ARGUMENTS: pass through an explicit --dir PATH (for a non-current project or a relocated store) and translate --budget-kb N to --budget-bytes $((N*1024)). With no arguments the script auto-detects the current project's memory dir — the ROOT project, not the worktree, since memory is pinned to the root project across worktree sessions.
Step 1: Scan (read-only)
python3 "$SCRIPT" --check --json [--dir PATH] [--budget-bytes N]
Exit 0 = scanned (a clean store is a valid result). Exit 3 = memory dir not found — tell the user and offer to re-run with --dir PATH. The JSON has memory_dir, index (bytes, entry_count, file_count, budget_bytes, over_budget), orphans, dangling, and advisory (duplicate_names, superseded). Read memory_dir back to the user so they know exactly which store is in scope.
Step 2: Present recommendations
Group findings into scannable sections. Omit any empty section. If nothing is flagged and the index is under budget, report "Memory store is clean — {entry_count} entries, {bytes} bytes, nothing to prune." and stop.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 116 lines · 109 tokens per session scan A e0d2165e6fb0
memory-clean is a skill published in the GitHub repository auerbachb/claude-code-config (5 stars, last pushed 3d ago), licensed MIT. It adds 109 tokens to every session and 1,633 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
fixer
Surgical code fixer for Bug Hunter. Implements minimal, precise fixes for verified bugs. Uses doc-lookup (Context Hub + Context7) to verify correct API usage in patches. Respects fix strategy classifications (safe-autofix vs manual-review vs larger-refactor).
referee
Final arbiter for Bug Hunter. Receives Hunter findings and Skeptic challenges, independently re-reads code, and delivers authoritative verdicts with CVSS scoring and proof-of-concept generation for security findings.
commit-security-scan
Scan code changes for security vulnerabilities using Bug Hunter-native artifacts and STRIDE context. Use whenever the user asks for PR security review, commit-diff scanning, staged-change security checks, branch-comparison security review, or pre-merge security analysis of changed code.
decompose
Decompose project or track into modules with dependency mapping. Project scope updates architecture.md and derives .ai-context.md. Track scope generates hld.md (always) and lld.md (when --lld or High-complexity module triggers it) — design-mandated artifacts that drive implement, deploy-checklist, and upload sign-off.
adr
Create and manage Architecture Decision Records. Documents significant technical decisions with context, alternatives, and consequences. Also supports evaluate (assess proposals) and design (system design) modes.
deploy-checklist
Pre-deployment verification checklist. Generates customized checklists based on tech-stack with rollback triggers. Auto-invoked by /draft:upload.