role-auditor

role-auditor is a skill for Claude Code from BechsteinDigital/claude-shiploop. It costs 61 tokens per session (824 once invoked), scanned A, original, MIT.

A read-only whole-repository audit role that checks the project’s overall state, including consistency, boundaries, security, rules, and documentation.

In plain words
What is it for?
Use it before releases, after major rework, at milestones, or during periodic checks.
Why use it?
It finds problems spread across the repository that may not be visible in one code change, and records findings without modifying the project.

Skill for Claude Code

Written for Claude Code: disallowed-tools in frontmatter. Also seen: model in frontmatter; mentions subagents; names the AskUserQuestion tool.

Part of the claude-shiploop plugin — 8 skills shipped together

Good fit Use it before releases, after major rework, at milestones, or during periodic checks.

Compare 6 skills from other repositories ↓
Install with agentmods
npx agentmods add skills/bechsteindigital/claude-shiploop/role-auditor
Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent
npx skills add BechsteinDigital/claude-shiploop --skill role-auditor
Clone the repo
git clone --depth 1 https://github.com/BechsteinDigital/claude-shiploop

Made for: Claude Code.

Or install claude-shiploop, the plugin that ships this one along with the rest of its 8 skills.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for role-auditor

README.md
[![agentmods](https://agentmods.dev/badge/skills/bechsteindigital/claude-shiploop/role-auditor/github.svg)](https://agentmods.dev/skills/bechsteindigital/claude-shiploop/role-auditor)
Your own site
<a href="https://agentmods.dev/skills/bechsteindigital/claude-shiploop/role-auditor"><img src="https://agentmods.dev/badge/skills/bechsteindigital/claude-shiploop/role-auditor/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for role-auditor

Your own site · 80×15
<a href="https://agentmods.dev/skills/bechsteindigital/claude-shiploop/role-auditor"><img src="https://agentmods.dev/badge/skills/bechsteindigital/claude-shiploop/role-auditor.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 61 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 824 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00061 $0.00824
Opus 5 $0.00030 $0.00412
Sonnet 5 $0.00012 $0.00165
Haiku 4.5 $0.00006 $0.00082

Measured 12d ago against content hash 50e871db6792, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-12, from the pricing page.

Security

Grade A, and why

role-auditor scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

role-auditor/SKILL.md · 54 lines

How it starts

The opening of the file, as written. The whole thing — 54 lines — stays where its author put it; the contents beside it link to each section on GitHub.

AUDITOR Role (project-agnostic)

Role

Checks the state, not the delta. Finds what no single diff shows: legacy code without review, pattern deviations (2 of N implementations wrong), global boundary violations, doc drift. Fixes nothing, refactors nothing, changes no statuses.

No AskUserQuestion and no Edit tool (audit only; writes solely its report): concerns become findings, never a prompt or a fix.

Required input

Invoked directly, $ARGUMENTS = a subsystem name scopes the audit to it; empty → all subsystems from PROFILE.md.

  1. project/PROFILE.md — architecture overview, subsystems, quality rules
  2. project/BRIEF.md — core contract (for drift check)
  3. project/STATE.md
  4. last audit report under project/log/*-audit.md, if present (delta comparison)

Method: fan-out instead of reading yourself

Do not read the code broadly in the main context. Per subsystem (from PROFILE.md), start one parallel read-only subagent (Read/Grep/Glob only) on sonnet, all in one invocation block. Each subagent prompt contains: scope paths, the quality rules from the profile, the output format (findings with file:line, severity, confidence; 3–5 strengths; subsystem verdict). The auditor only consolidates the results.

Mandatory checks

  1. Pattern consistency: compare all implementations of the same pattern (error handling, resource release, concurrency strategy, result vs. exception contracts). Deviation from the majority pattern = finding.
  2. Boundaries globally: import/dependency direction of all modules against the architecture overview.
  3. Rule compliance sweep: quality rules from PROFILE.md as an inventory with individual verdicts (violation / accepted fallback).
  4. Security posture: secret hygiene, input validation at all outer boundaries (parsers, API, CLI), insecure defaults, dependencies with known risks.
  5. Doc drift: BRIEF.md/STATE.md/PROFILE.md against reality: do referenced paths/commands exist? Do STATE and backlog contradict? Status claims against the actual test suite. Drift is a finding of the same class as code findings.

Read the full file on GitHub · 54 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 12d ago First seen · 54 lines · 0 tokens per session scan A 50e871db6792

Subscribe to this mod's changes

role-auditor is a skill published in the GitHub repository BechsteinDigital/claude-shiploop (4 stars, last pushed 1mo ago), licensed MIT. It adds 61 tokens to every session and 824 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Related

Other skills, from other repositories

cleanup-audit

Audit codebase for dead code, unused exports, orphaned files, and stale manifests.

jmagly/aiwg · 21 tokens

link-check

Verify @file references in AIWG skills and agents against the linking contract — per-file or corpus-wide, with optional auto-fix.

jmagly/aiwg · 29 tokens

suede-code-review

Suede Labs AI findings-only code review with full context: changed files, callers, contracts, and deploy surface. Covers TypeScript, React, Next.js, database, Swift/iOS, OWASP, accessibility, SEO, observability, commit hygiene, and deploy risk, ranked P0-P3 with file:line evidence and a fix path. Use when asked to…

JasonColapietro/suede-creator-skills · 191 tokens

suede-code

Suede Labs AI combined code review and ship grade in one pass: findings with file:line evidence plus an A-F lane grade, Instant-F security triggers, OWASP checks, a deploy-safety gate, and fix briefs. Use when asked to review this, grade this, security-check this, is this safe to ship, or check this PR before merge …

JasonColapietro/suede-creator-skills · 167 tokens

suede-code-grader

Suede Labs AI blunt A-F ship grade for a code change across correctness, security and permissions, data and state, domain truth, UX and release behavior, tests and verification, and deploy readiness, with Instant-F triggers and evidence-based grade caps on auth, payment, migration, and public-API surfaces. Use when…

JasonColapietro/suede-creator-skills · 156 tokens

ai-driven-code-editor-cli

OpenCode AI - AI-driven code editor/IDE (CLI/TUI version of Cursor/Windsurf). Use when: (1) AI-assisted coding tasks, (2) Code refactoring with AI, (3) GitHub PR review/fixes, (4) Multi-file edits requiring context, (5) Running AI agents on codebases. NOT for: simple one-line ed…

rondoflow/rondoflow · 84 tokens