Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add ChanningLua/prax-agent --skill docs-auditgit clone --depth 1 https://github.com/ChanningLua/prax-agentWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/channinglua/prax-agent/docs-audit)<a href="https://agentmods.dev/skills/channinglua/prax-agent/docs-audit"><img src="https://agentmods.dev/badge/skills/channinglua/prax-agent/docs-audit/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/channinglua/prax-agent/docs-audit"><img src="https://agentmods.dev/badge/skills/channinglua/prax-agent/docs-audit.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00030 | $0.01903 |
| Opus 5.5 | $0.00012 | $0.00761 |
| Sonnet 5.5 | $0.00006 | $0.00381 |
| Haiku 4.5 | $0.00003 | $0.00190 |
Grade A, and why
docs-audit scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 185 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Docs Freshness Audit
痛点:代码改了 40 天了,文档还停在 3 个月前。没人专门盯,自然就 drift。这个 skill 每周扫一次、给出有证据的清单,让技术写作不用手动翻 git blame。
何时触发
- cron 每周跑一次
- 用户说:"扫一下文档哪些过时了"、"查 docs freshness"
- PR 改了
src/但没改docs/时触发(需要 hook 配合,本 skill 不负责触发点)
输入
- 窗口:默认 30 天(
--since="30 days ago"),用户可覆盖 - 源目录:默认
src/、core/、tools/、lib/里实际存在的 - 文档目录:默认
docs/+README.md+CHANGELOG.md
实际检测前先用 Glob 探一下项目里实际的目录布局,不要假设。
输出
一个 markdown 报告 + 可选 GitHub issue:
.prax/reports/docs-audit-<YYYY-MM-DD>.md
不自动改文档(写作是人的事)。不删已有报告(历史归档有价值)。
工作流程
Step 1:摸底
# 列出项目里实际的源目录和文档目录
ls -d src/ core/ tools/ lib/ docs/ 2>/dev/null
find . -maxdepth 2 -name "README*.md" -not -path "./node_modules/*"
Step 2:找近期改过的源文件
git log --since="30 days ago" --name-only --pretty=format: -- <source-dirs> \
| sort -u \
| grep -v '^$' \
| grep -E '\.(py|ts|tsx|js|jsx|go|rs|java|kt|md)$'
.md 也保留——文档自己也可能"过时"(比如指向已删除的文件)。
Step 3:对每个源文件查文档提及
# 对 src/auth.py,grep docs/ 和 README
SOURCE=src/auth.py
STEM=$(basename $SOURCE .py) # auth
grep -rln "$SOURCE\|$STEM" docs/ README*.md CHANGELOG.md 2>/dev/null
四种情况分类:
| 场景 | 判定 | 列入报告? |
|---|---|---|
| 源文件新增(无 history)+ 文档无提及 | 可能是内部实现,skip | ❌ |
| 源文件改过 + 文档也改过(窗口内) | 健康 | ❌ |
| 源文件改过 + 文档完全没提过 | 可能是内部模块,不是公开 API | ⚠ 低优先级 |
| 源文件改过 + 文档提过但文档未改 | 真 drift | ✅ 高优先级 |
Step 4:生成报告
模板:
---
generated_at: 2026-04-22T09:00:00+08:00
window: "last 30 days"
repo_head: <short sha>
stale_count: 7
---
# Docs Freshness Audit — 2026-04-22
扫描窗口:过去 30 天。发现 **7 处可能的文档过时**。
## 🔴 高优先级(文档提及 + 代码改了 + 文档没改)
### 1. `src/auth.py` ↔ `docs/authentication.md`
**证据**:
- 源文件最近 commit:
a1b2c3d 2026-04-20 feat(auth): migrate session cookies to SameSite=Strict d4e5f6g 2026-04-15 fix(auth): token refresh race
- 文档最后修改:2026-02-10(64 天前)
- 文档中仍提到:SameSite=Lax(第 45 行)
**建议**:更新 `docs/authentication.md` 的 cookie 配置段。
### 2. ...
## 🟡 低优先级(代码改了但文档没提过)
- `core/cache.py`(3 commits in window)—— 可能是内部模块,酌情是否要补文档
## 📊 统计
- 扫描源文件:124
- 窗口内改动:18
- 真 drift:7
- 可能内部:11
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 185 lines · 30 tokens per session scan A ba1b5cf436bb
docs-audit is a skill published in the GitHub repository ChanningLua/prax-agent (272 stars, last pushed 1mo ago), licensed MIT. It adds 30 tokens to every session and 1,903 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
template-audit
Audit and quality-gate scripts for the template research framework. Covers documentation linting, filepath audits, mock-usage checking, template drift, and confidentiality / git-guard checks.
han-release
Cut a Han release: update CHANGELOG.md with the changes since the last release, bump and tag every plugin that changed as {plugin-name}--v{version} so a version-constrained dependency can resolve, and publish a GitHub release crediting every merged pull request and closed issue to the people behind it. Use when…
han-update-documentation
Update Han plugin documentation so every skill, agent, guidance doc, index, and cross-reference is current and accurate. On a non-default branch, scopes the pass to entities the branch actually touched. On the default branch, performs a full documentation sweep across the whole plugin. Use when updating, refreshing…
contribute-spec-fix
Fix a broken OpenAPI spec in jentic-public-apis with an OpenAPI Overlay, validate it (spectral lint + idempotency check), and contribute it back via a PR to the community catalog. Falls back to applying the same overlay to the local Jentic registry if the user can't wait for maintainer approval, and closes the loop by…
do
Work a SpecWeave increment task by task - claim, implement inside its Files, test, commit, done with evidence - alone, unattended or in lanes, then close. Use for "implement", "continue", "auto".
release
Guide through the Cortex TMS release process — version bump, changelog, sync, tag, publish. Every step requires user approval.