Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add CES-Ltd/Lumi --skill skill-auditgit clone --depth 1 https://github.com/CES-Ltd/LumiWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/ces-ltd/lumi/skill-audit)<a href="https://agentmods.dev/skills/ces-ltd/lumi/skill-audit"><img src="https://agentmods.dev/badge/skills/ces-ltd/lumi/skill-audit/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/ces-ltd/lumi/skill-audit"><img src="https://agentmods.dev/badge/skills/ces-ltd/lumi/skill-audit.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00059 | $0.03012 |
| Opus 5.5 | $0.00024 | $0.01205 |
| Sonnet 5.5 | $0.00012 | $0.00602 |
| Haiku 4.5 | $0.00006 | $0.00301 |
Grade A, and why
skill-audit scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
This is a copy
91% identical to skill-audit — 32 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.
How it starts
The opening of the file, as written. The whole thing — 559 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Systematic Audit Process
Overview
Comprehensive, methodical auditing to find issues, inconsistencies, and broken features across a codebase.
Core principle: Define scope → Create checklist → Execute systematically → Report findings → Prioritize fixes.
When to Use
Use this skill when user wants to:
- Audit entire application for issues
- Find all instances of a problem pattern
- Check for broken features systematically
- Comprehensive quality verification
- Identify inconsistencies across codebase
Do NOT use for:
- Security vulnerability scanning (use skill-security-audit)
- Code quality review (use skill-code-review)
- Single file searches (use Grep/Glob directly)
- Performance profiling
The Process
Phase 1: Scope Definition
Step 1: Understand Audit Objectives
**Audit Objectives:**
What to audit: [app features, code patterns, specific issues]
Why auditing: [what prompted this, what problem are we solving]
Scope: [entire app, specific module, particular feature set]
Depth: [surface-level or deep inspection]
Step 2: Define Audit Criteria
Use AskUserQuestion if needed:
**Audit Focus:**
Which aspects should I audit?
1. Functional - Do features work as expected?
2. Consistency - Are patterns applied uniformly?
3. Completeness - Are implementations finished?
4. Quality - Is code maintainable?
5. User-facing - Does UI/UX work correctly?
6. Integration - Do components work together?
Step 3: Create Audit Plan
**Audit Plan**
**Areas to Cover:**
1. [Area 1: e.g., All form submissions]
2. [Area 2: e.g., All API endpoints]
3. [Area 3: e.g., All button states]
4. [Area 4: e.g., All error handling]
**Methodology:**
- [ ] Identify all instances
- [ ] Test each systematically
- [ ] Document findings
- [ ] Categorize by severity
- [ ] Propose fixes
**Estimated Coverage:** [X components, Y files, Z features]
Phase 2: Discovery
Step 1: Identify Audit Targets
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 559 lines · 59 tokens per session scan A 6315f29df78e
skill-audit is a skill published in the GitHub repository CES-Ltd/Lumi (39 stars, last pushed 5mo ago), licensed MIT. It adds 59 tokens to every session and 3,012 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. It is 91% identical to skill-audit, differing in 32 lines, and is treated as a copy.
Other skills, from other repositories
skill-repair
Diagnose and fix failing or degraded skills automatically - systemic-first triage, per-category playbooks, and a verification plan.
self-improve
Improve the agent itself, or audit its recent performance - better skills, prompts, workflows, and config, plus a quality/reliability/memory-hygiene review of what it did and what failed.
posthog-errors
Weekly cross-project error overview from PostHog - enumerates every project the OAuth grant covers, pulls the last 7 days of error-tracking issues per project, ranks them by impact, flags what's new vs ongoing, and sends one digest with per-project totals, the top issues, and a clickable link to a full committed…
aeon-doctor
Static config-correctness linter for this instance - catches the silent-failure class (unquoted schedules, duplicate keys, unconfigured skills, mode typos, broken requires/MCP refs) that no run-based health skill can see. Notifies only on problems.
python-code-quality
Code quality checks, linting, formatting, and type checking commands for the Agent Framework Python codebase. Use this when running checks, fixing lint errors, or troubleshooting CI failures.
browser-edge-cases
SOP for debugging browser automation failures on complex websites. Use when browser tools fail on specific sites like LinkedIn, Twitter/X, SPAs, or sites with Shadow DOM.