Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add BechsteinDigital/claude-shiploop --skill role-auditorgit clone --depth 1 https://github.com/BechsteinDigital/claude-shiploopWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/bechsteindigital/claude-shiploop/role-auditor)<a href="https://agentmods.dev/skills/bechsteindigital/claude-shiploop/role-auditor"><img src="https://agentmods.dev/badge/skills/bechsteindigital/claude-shiploop/role-auditor/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/bechsteindigital/claude-shiploop/role-auditor"><img src="https://agentmods.dev/badge/skills/bechsteindigital/claude-shiploop/role-auditor.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00061 | $0.00824 |
| Opus 5 | $0.00030 | $0.00412 |
| Sonnet 5 | $0.00012 | $0.00165 |
| Haiku 4.5 | $0.00006 | $0.00082 |
Grade A, and why
role-auditor scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 54 lines — stays where its author put it; the contents beside it link to each section on GitHub.
AUDITOR Role (project-agnostic)
Role
Checks the state, not the delta. Finds what no single diff shows: legacy code without review, pattern deviations (2 of N implementations wrong), global boundary violations, doc drift. Fixes nothing, refactors nothing, changes no statuses.
No AskUserQuestion and no Edit tool (audit only; writes solely its report): concerns become findings, never a prompt or a fix.
Required input
Invoked directly, $ARGUMENTS = a subsystem name scopes the audit to it; empty → all subsystems from PROFILE.md.
project/PROFILE.md— architecture overview, subsystems, quality rulesproject/BRIEF.md— core contract (for drift check)project/STATE.md- last audit report under
project/log/*-audit.md, if present (delta comparison)
Method: fan-out instead of reading yourself
Do not read the code broadly in the main context. Per subsystem (from PROFILE.md), start one parallel
read-only subagent (Read/Grep/Glob only) on sonnet, all in one invocation block. Each subagent prompt contains:
scope paths, the quality rules from the profile, the output format (findings with file:line, severity,
confidence; 3–5 strengths; subsystem verdict). The auditor only consolidates the results.
Mandatory checks
- Pattern consistency: compare all implementations of the same pattern (error handling, resource release, concurrency strategy, result vs. exception contracts). Deviation from the majority pattern = finding.
- Boundaries globally: import/dependency direction of all modules against the architecture overview.
- Rule compliance sweep: quality rules from
PROFILE.mdas an inventory with individual verdicts (violation / accepted fallback). - Security posture: secret hygiene, input validation at all outer boundaries (parsers, API, CLI), insecure defaults, dependencies with known risks.
- Doc drift:
BRIEF.md/STATE.md/PROFILE.mdagainst reality: do referenced paths/commands exist? Do STATE and backlog contradict? Status claims against the actual test suite. Drift is a finding of the same class as code findings.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago First seen · 54 lines · 0 tokens per session scan A 50e871db6792
role-auditor is a skill published in the GitHub repository BechsteinDigital/claude-shiploop (4 stars, last pushed 1mo ago), licensed MIT. It adds 61 tokens to every session and 824 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
cleanup-audit
Audit codebase for dead code, unused exports, orphaned files, and stale manifests.
link-check
Verify @file references in AIWG skills and agents against the linking contract — per-file or corpus-wide, with optional auto-fix.
suede-code-review
Suede Labs AI findings-only code review with full context: changed files, callers, contracts, and deploy surface. Covers TypeScript, React, Next.js, database, Swift/iOS, OWASP, accessibility, SEO, observability, commit hygiene, and deploy risk, ranked P0-P3 with file:line evidence and a fix path. Use when asked to…
suede-code
Suede Labs AI combined code review and ship grade in one pass: findings with file:line evidence plus an A-F lane grade, Instant-F security triggers, OWASP checks, a deploy-safety gate, and fix briefs. Use when asked to review this, grade this, security-check this, is this safe to ship, or check this PR before merge …
suede-code-grader
Suede Labs AI blunt A-F ship grade for a code change across correctness, security and permissions, data and state, domain truth, UX and release behavior, tests and verification, and deploy readiness, with Instant-F triggers and evidence-based grade caps on auth, payment, migration, and public-API surfaces. Use when…
ai-driven-code-editor-cli
OpenCode AI - AI-driven code editor/IDE (CLI/TUI version of Cursor/Windsurf). Use when: (1) AI-assisted coding tasks, (2) Code refactoring with AI, (3) GitHub PR review/fixes, (4) Multi-file edits requiring context, (5) Running AI agents on codebases. NOT for: simple one-line ed…