Borrowing it
Nothing to install: this file belongs to CBNU-TeamH/RMF-Block. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/CBNU-TeamH/RMF-Block/main/.agents/skills/doc-drift-audit/SKILL.mdgit clone --depth 1 https://github.com/CBNU-TeamH/RMF-BlockWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/cbnu-teamh/rmf-block/doc-drift-audit)<a href="https://agentmods.dev/skills/cbnu-teamh/rmf-block/doc-drift-audit"><img src="https://agentmods.dev/badge/skills/cbnu-teamh/rmf-block/doc-drift-audit/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/cbnu-teamh/rmf-block/doc-drift-audit"><img src="https://agentmods.dev/badge/skills/cbnu-teamh/rmf-block/doc-drift-audit.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00099 | $0.03193 |
| Opus 5.5 | $0.00040 | $0.01277 |
| Sonnet 5.5 | $0.00020 | $0.00639 |
| Haiku 4.5 | $0.00010 | $0.00319 |
Grade A, and why
doc-drift-audit scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 118 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Doc drift audit
A procedure, not a tool. It needs git, gh and node, nothing specific to one agent. Steps that say fan out run one sub-agent per part in parallel if your tool has sub-agents; otherwise run the same parts one after another in a single session — the instructions and outputs are identical.
The coordinator (you) plans, verifies, decides and integrates. Sub-agents find and edit. Never delegate a judgement call (what to fix, which doc owns a fact).
Run every command from the repo root; $SKILL is this skill's directory — .claude/skills/doc-drift-audit (canonical) or its copy .agents/skills/doc-drift-audit; both work. <scratch> is any working directory outside the repo (a session scratchpad, /tmp/…); keep all audit files there, not in the repo.
Single-session mode (no sub-agents): run each fan-out step part by part yourself, still writing every result to its file and keeping only counts in mind before moving on. Do the A/F verification (step 5) as a separate pass that re-reads the files from disk and doubts the findings — ideally in a fresh session, since the same context that wrote a finding is the worst judge of it.
Progress
Copy this into your notes and tick as you go:
- [ ] 0 base commit + issue(s) to close
- [ ] 1 baseline posted on the issue
- [ ] 2 parts.json
- [ ] 3 facts (optional)
- [ ] 4 audit JSON per part
- [ ] 5 verify-AF.json
- [ ] 6 checklist posted, human approval read back
- [ ] 7 edits committed per group, handoffs collected
- [ ] 8 integrated, verified, after-numbers, audit task archived, PR open
Two rules for every step:
- Precision over recall. A false finding costs a human's attention; a missed one costs nothing until the next audit. An auditor that finds nothing has done a good run.
- A step that didn't run is not a clean step. If a check, review or verifier couldn't run, say so — never report it as passed.
0. Before you start
- There is an issue to close: the open
drift-auditissue. If that issue's body names another issue as the audit's definition (here it names this skill; older ones named #129), close that too; otherwise there is just the one. - Find the issue:
gh issue list --label drift-audit --state open— call its number$ISSUE. - Record the base commit on an up-to-date main:
git fetch && git switch -c docs/drift-audit origin/main && BASE=$(git rev-parse HEAD). Every measurement, sub-agent prompt and worktree uses it. - Register the task the repo's way (here: copy
tasks/templates/todo.mdandtasks/templates/lessons.mdtotasks/active/YYYYMMDD-drift-audit-{todo,lessons}.md, thenpnpm tasks:index). - Name the audit's task doc slug exactly
YYYYMMDD-drift-audit(in this repo,scripts/post-merge-reminders.mjstreats that slug as "an audit happened" and resets its count from its archive date). - Every prompt you give a sub-agent starts with: check
git log --oneline -1is<sha>; stop and report if not. Worktrees and checkouts drift; this check is what stops an agent from working on a stale base.
What ships with it
8 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- references/apply-instructions.md 2.5 KB
- references/audit-instructions.md 3.5 KB
- references/verify-instructions.md 2.3 KB
- scripts/baseline.mjs 4.0 KB runs code
- scripts/derive-parts.mjs 2.0 KB runs code
- scripts/extract-facts.mjs 2.3 KB runs code
- scripts/read-approvals.mjs 1023 B runs code
- scripts/render-checklist.mjs 2.4 KB runs code
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 10d ago Changed · +1 lines 2759c2a69094
- 1mo ago First seen · 117 lines · 99 tokens per session scan A bda7c8e6cd2a
doc-drift-audit is a skill published in the GitHub repository CBNU-TeamH/RMF-Block (3 stars, last pushed 9d ago), licensed MIT. It adds 99 tokens to every session and 3,193 once invoked, about $0.0004 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-03.
doc-drift-audit compared with skills from other repositories
| Mod | Type | Stars | Last push | Licence | Scan | Tokens | Works with |
|---|---|---|---|---|---|---|---|
| doc-drift-auditCBNU-TeamH/RMF-Block | Skill | 3 | 9d ago | MIT | A | 99 | Claude Code, Codex |
| merge-batchdiegosouzapw/OmniRoute | Skill | 83k | 6d ago | MIT | A | 46 | Claude Code |
| prowler-commitprowler-cloud/prowler | Skill | 15k | yesterday | Apache-2.0 | A | 44 | Claude Code, Codex |
| gh-auth-isolationgithub/gh-aw | Skill | 5.6k | yesterday | MIT | A | 20 | Claude Code, Codex |
| github-skillzeenie-ai/OpenCompany | Skill | 1.1k | yesterday | MIT | A | 51 | Claude Code |
| comet-githubrpamis/comet | Skill | 3.3k | yesterday | MIT | A | 72 | Claude Code, Codex |
| release-helperSahir619/fable-method | Skill | 2.3k | 1mo ago | MIT | A | 43 | Claude Code |