Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add camilooscargbaptista/cto-toolkit --skill health-checkgit clone --depth 1 https://github.com/camilooscargbaptista/cto-toolkitWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/camilooscargbaptista/cto-toolkit/health-check)<a href="https://agentmods.dev/skills/camilooscargbaptista/cto-toolkit/health-check"><img src="https://agentmods.dev/badge/skills/camilooscargbaptista/cto-toolkit/health-check/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/camilooscargbaptista/cto-toolkit/health-check"><img src="https://agentmods.dev/badge/skills/camilooscargbaptista/cto-toolkit/health-check.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00098 | $0.01056 |
| Opus 5 | $0.00049 | $0.00528 |
| Sonnet 5 | $0.00020 | $0.00211 |
| Haiku 4.5 | $0.00010 | $0.00106 |
Grade A, and why
health-check scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 137 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Project Health Check Orchestrator
You are a CTO performing a comprehensive health check on a project. You coordinate multiple specialized analyses and synthesize them into an executive-level dashboard that engineering leadership can act on.
Execution Plan
Phase 1: Architecture Health
Invoke the architecture-reviewer agent (or apply its framework manually):
- Project structure and organization
- Dependency analysis and direction
- Coupling and cohesion assessment
- Anti-pattern density
- Testability assessment
Phase 2: Technical Debt Inventory
Invoke the tech-debt-analyzer agent (or apply its framework manually):
- TODO/FIXME/HACK audit
- Dependency freshness
- Test coverage gaps
- Documentation completeness
- Infrastructure modernization needs
Phase 3: Security Audit
Invoke the security-auditor agent (or apply its framework manually):
- Secrets scan
- Authentication and authorization review
- Input validation assessment
- Dependency vulnerability check
- OWASP Top 10 assessment
Phase 4: Operational Readiness
Assess using relevant skills:
- CI/CD pipeline maturity
- Monitoring and alerting coverage
- Incident response readiness
- Deployment strategy
- Rollback capability
Phase 5: Developer Experience
Quick assessment of:
- Setup time (clone to running)
- Build and test speed
- Documentation quality
- Onboarding path
Project Health Dashboard
# Project Health Dashboard
**Project**: [name]
**Date**: [date]
**Assessed by**: CTO Toolkit Health Check
## Overall Health Score: [X/100]
## Dimension Breakdown
| Dimension | Score | Trend | Status |
|-----------|-------|-------|--------|
| Architecture | X/100 | ↑↓→ | 🟢🟡🟠🔴 |
| Code Quality | X/100 | ↑↓→ | 🟢🟡🟠🔴 |
| Security | X/100 | ↑↓→ | 🟢🟡🟠🔴 |
| Test Coverage | X/100 | ↑↓→ | 🟢🟡🟠🔴 |
| Tech Debt | X/100 | ↑↓→ | 🟢🟡🟠🔴 |
| Operations | X/100 | ↑↓→ | 🟢🟡🟠🔴 |
| Developer Experience | X/100 | ↑↓→ | 🟢🟡🟠🔴 |
| Documentation | X/100 | ↑↓→ | 🟢🟡🟠🔴 |
**Score guide**: 🟢 80-100 (Healthy) | 🟡 60-79 (Needs Attention) | 🟠 40-59 (At Risk) | 🔴 0-39 (Critical)
## Top 5 Risks
[Ranked by impact × probability]
1. **[Risk]** — Impact: HIGH, Effort to fix: [S/M/L]
2. **[Risk]** — Impact: HIGH, Effort to fix: [S/M/L]
3. ...
## Top 5 Quick Wins
[Highest ROI improvements — fix these first]
1. **[Action]** — Impact: [description], Effort: [hours/days]
2. ...
## Improvement Roadmap
### This Sprint (Quick Wins)
[Actions with effort < 1 day and high impact]
### Next Sprint (High Priority)
[Actions addressing critical risks]
### This Quarter (Strategic)
[Architectural improvements and debt reduction]
### Next Quarter (Foundation)
[Platform investments and process improvements]
## Detailed Reports
[Reference to the full reports from each phase]
### Architecture Report
[Summary of architecture-reviewer findings]
### Tech Debt Inventory
[Summary of tech-debt-analyzer findings]
### Security Audit
[Summary of security-auditor findings]
### Operational Readiness
[Summary of ops assessment]
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 11d ago First seen · 137 lines · 98 tokens per session scan A ce5677aadabc
health-check is a skill published in the GitHub repository camilooscargbaptista/cto-toolkit (7 stars, last pushed 5mo ago), licensed MIT. It adds 98 tokens to every session and 1,056 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
preset-health
Nested swiss-knife reference for saved-preset health checks. Read this when the human asks whether saved presets still work, which preset is expired or misconfigured, why system(action="presets") shows a bad connectivity status, or for a safe procedure to enumerate saved presets, classify each failure (expired key…
gcp-cloud-logging
Google Cloud Logging — log search, VPC flow logs, firewall logs, audit logs, log buckets and views. Use when searching GCP logs, investigating denied VPC flow traffic, checking who deleted a VM, analyzing firewall rule hits, or troubleshooting a GCP application error.
Vulnerability Scanning & Assessment
Dependency auditing, CVE detection, configuration security review, CVSS scoring, and prioritized vulnerability reporting.
node-inspect-debugger
Debug Node.js with node inspect, inspector attach, breakpoints, Chrome DevTools Protocol, heap snapshots, and CPU profiles.
python-debugpy
Debug Python with pdb, breakpoint(), post-mortem inspection, and debugpy remote or headless attach.
laravel-audit-performance
Audit a Laravel application's performance deeply and safely: unnecessary queries, N+1, collection vs database work, memory amplification, repeated computation, I/O, queues, and rendering cost — verifying that every proposed optimization preserves behavior before reporting it. Use when auditing performance or…