Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/chrono-meta/forge-harnessnpx agentmods add skills/chrono-meta/forge-harness/audit-learningsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/chrono-meta/forge-harness/audit-learnings)<a href="https://agentmods.dev/skills/chrono-meta/forge-harness/audit-learnings"><img src="https://agentmods.dev/badge/skills/chrono-meta/forge-harness/audit-learnings/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/chrono-meta/forge-harness/audit-learnings"><img src="https://agentmods.dev/badge/skills/chrono-meta/forge-harness/audit-learnings.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00061 | $0.04629 |
| Opus 5 | $0.00030 | $0.02315 |
| Sonnet 5 | $0.00012 | $0.00926 |
| Haiku 4.5 | $0.00006 | $0.00463 |
Grade A, and why
audit-learnings scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 366 lines — stays where its author put it; the contents beside it link to each section on GitHub.
audit-learnings — Hub Weekly Audit Automation
Phase 2 core of hub_compounding_loop.md. Goal: reduce manual 10 minutes to automated 3 minutes. No code changes. Document creation, editing, and deletion only.
Execution Order
Step 0. Lock Session Goal (Claude Code v2.1.139+, recommended)
Lock the session goal before running so the audit is not derailed by other tasks.
/goal Complete weekly audit — pattern scan → promotion/deprecation candidates → PR
Run this then proceed to Step 1. Skip this step if /goal is not supported.
Effect: Prevents drift where improvements found during the audit are immediately applied. Finish the audit document first, then start fixes.
Step 1. Run Scanner (self-detection + fallback)
Check for _scanner.sh first; if absent, extract directly via git commands.
SINCE="${ARGUMENTS:-7 days ago}"
if [ -f "tracks/_audit/_scanner.sh" ]; then
# Hub environment: use dedicated scanner (9-section full output)
bash tracks/_audit/_scanner.sh "$SINCE"
else
# External user environment: direct git extraction (5-section fallback)
echo "=== COMMITS ==="
git log --since="$SINCE" --oneline --no-merges
echo "=== TOP MODIFIED ==="
git diff --stat "$(git log --since="$SINCE" --format='%H' | tail -1)" HEAD 2>/dev/null | sort -rn | head -20
echo "=== NEW FILES ==="
find . -name "*.md" -newer <(date -d "$SINCE" +%Y%m%d 2>/dev/null || date -v-7d +%Y%m%d) 2>/dev/null | grep -v ".git" | head -20
echo "=== TAG COUNTS ==="
git log --since="$SINCE" --format="%B" | grep -oE '#[a-z-]+:[a-zA-Z0-9_-]+' | sort | uniq -c | sort -rn
echo "=== STALE FILES ==="
find . -name "*.md" -not -newer <(date -d "180 days ago" +%Y%m%d 2>/dev/null || date -v-180d +%Y%m%d) 2>/dev/null | grep -v ".git" | head -20
fi
Constraint: Do not modify _scanner.sh output format if present. The skill reads only.
Step 1.4. Lightweight Harness Structure Check (harness-doctor trigger judgment)
On each audit-learnings run, check CLAUDE.md complexity within 3 seconds. If threshold exceeded, recommend (do not auto-run) harness-doctor full diagnosis.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 366 lines · 61 tokens per session scan A 1a44409c2d48
audit-learnings is a skill published in the GitHub repository chrono-meta/forge-harness (14 stars, last pushed today), licensed MIT. It adds 61 tokens to every session and 4,629 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-04.
Other skills, from other repositories
avatar-contribution-pr
Turn an avatar GitHub issue (from the in-app avatar-editor easter egg) into a merged sprite — validate the art, then either add a new module or replace an existing one, and open a PR that closes the issue. Handles both "Avatar contribution: " (a brand-new sprite) and "Avatar edit: " (a hand-redraw of an existing…
publish-pr
Use in /implement at the draft→ready boundary to squash the branch's review-iteration commits into one (non-interactive soft-reset + recommit + force-with-lease) and mark the draft PR ready. Takes the commit message as input (sourced from the plan-file before cleanup). GitHub-specific (gh) behind a host-neutral…
work-unit-commits
Plan commits as reviewable work units. Trigger: implementation, commit splitting, chained PRs, or keeping tests and docs with code.
taiyi-integration
A project workflow skill for closing a TaiyiForge change and recording it in a CHANGELOG.md file. It checks review results, tests, and the state of the working tree before archiving the change.
git-commit
Generate conventional commit messages for Java projects. Use when user says "commit", "create commit", "commit changes", or after completing code changes that need to be committed.
truecourse-hooks
Install, configure, or remove the TrueCourse pre-commit hook.