Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/clever-cc-plugins/cc-confignpx agentmods add skills/clever-cc-plugins/cc-config/auditing-configWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/clever-cc-plugins/cc-config/auditing-config)<a href="https://agentmods.dev/skills/clever-cc-plugins/cc-config/auditing-config"><img src="https://agentmods.dev/badge/skills/clever-cc-plugins/cc-config/auditing-config/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/clever-cc-plugins/cc-config/auditing-config"><img src="https://agentmods.dev/badge/skills/clever-cc-plugins/cc-config/auditing-config.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00118 | $0.11383 |
| Opus 5.5 | $0.00047 | $0.04553 |
| Sonnet 5.5 | $0.00024 | $0.02277 |
| Haiku 4.5 | $0.00012 | $0.01138 |
Grade B, and why
auditing-config scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 22d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Recursive force deletemediumDestructive command
rm -rf with a variable or a broad path is one typo away from removing the wrong tree.
- Are destructive commands blocked? (`rm -rf`, and consider network download commands unless specifically needed) Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.
How it starts
The opening of the file, as written. The whole thing — 583 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Optimize Claude Code Configuration
You are auditing and improving an existing Claude Code setup. The project has code, possibly documentation, and possibly OpenSpec specifications. Your job is to identify what's good (preserve it), what's missing, what's bloated, and what violates current best practices — then fix it with the user's approval.
Philosophy
Configuration is a multiplier, but only if it's lean. A 60-line CLAUDE.md with progressive disclosure outperforms a 300-line monolith. Three well-chosen MCP servers beat twenty poorly managed ones. A PostToolUse hook that runs the formatter on every edit eliminates an entire class of manual intervention forever.
The guiding question for every instruction in CLAUDE.md: "Would removing this line cause Claude to make a concrete mistake?" If no — remove it.
Step 0: Recall learnings
If .claude/learnings.md exists, read all entries and apply them silently to inform this run. The [skill-name] tag on each entry is provenance only — all entries apply regardless of which skill wrote them. Do not announce that learnings were loaded.
If the file does not exist, proceed without mention.
Step 1–2: Inventory and analysis
Step 1 (inventory) and Step 2 (analysis) below are read-heavy — dozens of files whose content feeds into three tiered findings lists. Do this reading directly, in the main conversation: work through the checklist sections in order, read each file as you reach it, and keep running notes of the metrics and findings as you go rather than re-reading anything. The interactive approval (Step 3) and the actual edits (Step 4) happen afterward, in the same thread, so the user can see and steer them.
If $ARGUMENTS specifies a focus area, still work through every section below, but prioritize
reading and depth on the sections that match it.
The Configuration files, Project context, and Current state metrics bullets below
are the inventory scope for Step 1. The ### 2x sections that follow are the Step 2 analysis
checklist — work through them in order (2a, 2a-bis, 2b, ... 2i), reading whatever each one
needs as you reach it.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 22d ago Changed · -5 lines 09f9d7abff9f
- 1mo ago First seen · 588 lines · 118 tokens per session scan B c8ea3391e748
auditing-config is a skill published in the GitHub repository clever-cc-plugins/cc-config (1 stars, last pushed 14d ago), licensed MIT. It adds 118 tokens to every session and 11,383 once invoked, about $0.0005 per session on Opus 5.5. A static security scan graded it B with 1 finding (recursive force delete). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
atomize
Use this skill to repurpose one core message across multiple content formats in a single run — e.g. turning a campaign brief or a single piece into a LinkedIn post, newsletter, and blog post at once, each properly adapted to its own conventions while keeping the core claim and proof points identical. Invoke when the…
blog-article
Use this skill when the owner wants to write, draft, or generate a blog article. Invoke when the user says "write a blog article", "draft a blog post", "create a blog article", "generate a blog post", "write a how-to article", "draft a thought leadership piece", "write a pillar page", or similar requests for long-form…
content-onboarding
Use this skill when setting up a new marketing project with Claude Code, registering context files, or extending the context of an existing project. Invoke when the user asks to "onboard a new client", "set up context files", "initialize marketing project", "register context", "add context", or "set up project…
long-tail-copy
Use this skill to draft a finished marketing or PR text for an output format that does NOT have its own dedicated skill — for example a newsletter, whitepaper, landing-page copy, product description, email, webinar abstract, or ad copy. Invoke when the user says "draft a newsletter", "write the copy for this landing…
facebook-post
Use this skill when the owner wants to write, draft, or generate a Facebook post. Invoke when the user says "write a Facebook post", "create a Facebook post", "draft for Facebook", "write for Facebook", or "generate a Facebook post".
humanize
Use this skill to remove AI "tells" from an existing draft and make it read as human-written, calibrated to the project's brand voice. Invoke when the user says "humanize this", "make this sound less AI", "remove AI tells from this", "this reads like ChatGPT wrote it", "polish this draft to sound human", or pastes a…