Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add bdfinst/agentic-dev-team --skill co-evolution-auditgit clone --depth 1 https://github.com/bdfinst/agentic-dev-teamWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/bdfinst/agentic-dev-team/co-evolution-audit)<a href="https://agentmods.dev/skills/bdfinst/agentic-dev-team/co-evolution-audit"><img src="https://agentmods.dev/badge/skills/bdfinst/agentic-dev-team/co-evolution-audit/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/bdfinst/agentic-dev-team/co-evolution-audit"><img src="https://agentmods.dev/badge/skills/bdfinst/agentic-dev-team/co-evolution-audit.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00128 | $0.02669 |
| Opus 5.5 | $0.00051 | $0.01068 |
| Sonnet 5.5 | $0.00026 | $0.00534 |
| Haiku 4.5 | $0.00013 | $0.00267 |
Grade A, and why
co-evolution-audit scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 270 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Co-Evolution Audit
Role: worker. Reads git history, pairs production files to their test files, and reports stale-coverage pairs. Does not edit any code or tests.
The Problem
A file that churns repeatedly while its tests never change is a high-risk signal: the tests are likely passing for structural reasons (they still compile and run) rather than because they verify current behavior. This divergence is invisible to coverage tools — coverage stays green even as the behavioral gap widens with every production change.
Parse Arguments
Arguments: $ARGUMENTS
| Flag | Default | Meaning |
|---|---|---|
--since <date|N-days> |
90 days ago |
Lookback window. Accepts ISO date (2025-01-01) or relative (90 days ago). |
--max-commits <N> |
200 |
Cap on commits scanned. The window is the earlier of --since and --max-commits. |
--min-churn <N> |
3 |
Minimum production-file change count to flag a pair. |
--max-test-churn <N> |
1 |
Maximum test-file change count for a pair to be flagged. A pair is flagged when production churn ≥ --min-churn AND test churn ≤ --max-test-churn. |
Graceful skip conditions
If any of the following is true, print a one-line notice and exit cleanly (do not fail):
- The working directory has no
.gitdirectory and is not inside a git repository (git rev-parse --git-dirfails). git logreturns zero commits in the requested window.- The repository is a shallow clone with fewer than 10 commits.
Step 1: Collect churn data
Run git log to collect per-file change frequency over the window:
git log --since="90 days ago" --max-count=200 --name-only \
--pretty=format:"" -- . | grep -v '^$' | sort | uniq -c | sort -rn
This produces a frequency table: how many commits touched each file.
Alternatively, --stat can be used for a combined view:
git log --since="90 days ago" --max-count=200 --stat \
--pretty=format:"COMMIT:%H"
Parse the output into a map: file_path → commit_count. Exclude merge
commits (--no-merges) to avoid inflating counts from merge-heavy workflows.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 270 lines · 128 tokens per session scan A b013ba359ee8
co-evolution-audit is a skill published in the GitHub repository bdfinst/agentic-dev-team (295 stars, last pushed 4d ago), licensed MIT. It adds 128 tokens to every session and 2,669 once invoked, about $0.0005 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
codew-release-qa-sweep
Use before claiming Codewhale release work is done: run the full gate sweep and list the manual QA targets.
model-merging
Merge multiple fine-tuned models using mergekit to combine capabilities without retraining. Use when creating specialized models by blending domain-specific expertise (math + coding + chat), improving performance beyond single models, or experimenting rapidly with model variants. Covers SLERP, TIES-Merging, DARE, Task…
mem0-test-integration
Verify a Mem0 integration produced by /mem0-integrate. Runs in the same workspace on the same branch (loose coupling) — installs dependencies, runs the repo's native test suite, then exercises a real end-to-end smoke flow against the user's API key. Produces a scorecard. TRIGGER when: user has just run /mem0-integrate…
cw-gates
Use before claiming any Codewhale change is done, green, or ready to land: the focused-to-broad verification ladder, the budget checks CI enforces, and the rules for what counts as a passing test.
workflow-patterns
Use this skill when implementing tasks according to Conductor's TDD workflow, handling phase checkpoints, managing git commits for tasks, or understanding the verification protocol.
release-safety
Release safety rules. INVOKE WHEN: yarn release, npm publish, release canary, release packages, publishing, skip checks, skip tests. NEVER skip checks or tests without explicit permission.