Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add automagik-dev/genie --skill skill-auditgit clone --depth 1 https://github.com/automagik-dev/genieWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/automagik-dev/genie/skill-audit)<a href="https://agentmods.dev/skills/automagik-dev/genie/skill-audit"><img src="https://agentmods.dev/badge/skills/automagik-dev/genie/skill-audit/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/automagik-dev/genie/skill-audit"><img src="https://agentmods.dev/badge/skills/automagik-dev/genie/skill-audit.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00036 | $0.01805 |
| Opus 5.5 | $0.00014 | $0.00722 |
| Sonnet 5.5 | $0.00007 | $0.00361 |
| Haiku 4.5 | $0.00004 | $0.00180 |
Grade A, and why
skill-audit scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 24d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 57 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Skill Audit
The catalogue is a product surface: every extra entrypoint spends a reader's attention whether or not it fires. Audit it on evidence the repository and the host already hold, and propose verdicts. Deleting or merging a skill is the caller's decision, taken after the proposal, never inside the audit.
The assessment half is a saved workflow, not a procedure this skill performs inline. Its single source of truth is .claude/workflows/skill-audit-sweep.js in the genie repository's canonical workflow catalog (see .claude/workflows/README.md there); this skill is its front door. On a runtime that runs saved workflows, run the script at <repository root>/.claude/workflows/skill-audit-sweep.js when that file exists, otherwise ~/.claude/workflows/skill-audit-sweep.js (delivered by genie install / genie update); give the runtime that explicit script path, never a bare name — both scopes now carry these names and the order a name resolves in is undocumented. Pass {focus?, skills?, searchPass?, skillsDir?, shardCount?, quorum?, model?, timestamp?} — every key optional, and with no skills list the sweep audits whatever the inventory check reports on disk. Freeze the interview below into searchPass before the call; the workflow asks nothing, writes nothing, and moves no file. Relay the returned report unchanged, and list notConvened (agents that returned nothing) and unjudged (roster skills that carry no verdict) beside it rather than filling either gap yourself.
Before authoring
A new skill is the last option, not the first. This interview stays here, with you, and reaches the workflow only as a frozen searchPass record. Search before you write:
- Name the intent. The task the skill performs, the trigger conditions, and three to five keywords with their synonyms.
- Search the shipped catalogue first. Grep the skill directories for the keywords in both the frontmatter description and the body. A hit in an existing description usually means the workflow already has a home.
- Search the host's installed homes. The install record written at the end of a successful update lists the inventory and every agent skills home it wrote, and the skills lines of
genie doctorreport what is present per home. A name already installed from elsewhere is user-owned and is not yours to overwrite. - Vet anything external before adopting it: read its instructions end to end, look for shell commands, file writes, network calls, and credential handling, and prefer copying into a branch you can diff over editing an installed original.
- Decide out loud. Use the existing skill, extend it, or create a fresh one because the search found no close match. Say which, and why.
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 24d ago Changed · +8 lines 228b8832b955
- 29d ago First seen · 49 lines · 36 tokens per session scan A d45ec3f83bdf
skill-audit is a skill published in the GitHub repository automagik-dev/genie (346 stars, last pushed today), licensed MIT. It adds 36 tokens to every session and 1,805 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-17.
Other skills, from other repositories
gh
GitHub CLI skill for interacting with GitHub via the gh command line tool. Use when Bub needs to (1) Create, view, or manage GitHub repositories, (2) Work with issues and pull requests, (3) Create and manage releases, (4) Run and monitor GitHub Actions workflows, (5) Create and manage gists, (6) Install and manage…
project-spine-workspace
Use when the user asks about Project Spine hosted workspaces, team sync, shared workspace templates, invites, or commands such as spine login, spine workspace, spine publish, or spine drift check --push.
github-operations
Unified GitHub interaction covering artifact types, comment conventions, CLI commands, and issue lifecycle. Used when reading from or writing to GitHub Issues, managing the project board, or posting structured comments.
roadmap-writing
Creates phased project roadmaps with dependency graphs, success criteria, and GitHub Milestone structure. Used when planning new projects, creating milestones, or breaking work into phases.
quality
Evaluates whether a GitHub issue is spam, empty, needs more information, or is OK to proceed.
follow-up-after-call
Use after a completed customer, prospect, partner, or important internal sales call, discovery session, demo, or conversation, including when the user supplies or uploads a transcript, notes, recording summary, or other grounded evidence. Advise on, assess, qualify, recap, and produce seller-ready follow-up actions…