Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add cloudx-io/cloudx-sdk-agents --skill cloudx-auditgit clone --depth 1 https://github.com/cloudx-io/cloudx-sdk-agentsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/cloudx-io/cloudx-sdk-agents/cloudx-audit)<a href="https://agentmods.dev/skills/cloudx-io/cloudx-sdk-agents/cloudx-audit"><img src="https://agentmods.dev/badge/skills/cloudx-io/cloudx-sdk-agents/cloudx-audit/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/cloudx-io/cloudx-sdk-agents/cloudx-audit"><img src="https://agentmods.dev/badge/skills/cloudx-io/cloudx-sdk-agents/cloudx-audit.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00061 | $0.00634 |
| Opus 5.5 | $0.00024 | $0.00254 |
| Sonnet 5.5 | $0.00012 | $0.00127 |
| Haiku 4.5 | $0.00006 | $0.00063 |
Grade A, and why
cloudx-audit scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 48 lines — stays where its author put it; the contents beside it link to each section on GitHub.
CloudX Integration Audit
Audit the CloudX integration already present in this app. Do not add new
integration work — for that, use cloudx-integrate.
Iron rule: never judge the integration against APIs from memory. Fetch the
current docs first (https://docs.cloudx.io/llms.txt, then the platform pages —
see ../cloudx-integrate/references/doc-map.md) and diff the code against what
the docs say today. An integration written against an older SDK may compile
and still be wrong or incomplete; the platform changelog page shows what changed.
Steps
- Detect — platform, CloudX SDK dependency and adapters present, ad formats
used, existing mediation SDKs, CMP tooling. Match playbook signals in
../cloudx-integrate/references/playbook-index.mdand read the playbooks that apply. - Fetch — the platform integration overview, the ad-format page for each format the app uses, the platform changelog, and adapter pages for adapters present.
- Diff code against current docs:
- Dependency coordinates and adapter set vs the current documented ones.
For each installed adapter, verify its overview page's requirements are
fully met (extra Maven repositories, manifest/Info.plist entries, native
view requirements). If the publisher's enabled-network set is knowable
(ask, or CloudX MCP/CLI
config/show), flag mismatches both ways: compiled-in adapters for networks not enabled (dead weight) and enabled networks with no adapter in the binary (silent zero contribution). - Initialization: documented location, once, before ad loads, correct config.
- Each ad format: creation, listeners, readiness checks, show requirements, lifecycle/destroy handling per the current docs page.
- Removed/renamed APIs still referenced (changelog is the evidence).
- Dependency coordinates and adapter set vs the current documented ones.
For each installed adapter, verify its overview page's requirements are
fully met (extra Maven repositories, manifest/Info.plist entries, native
view requirements). If the publisher's enabled-network set is knowable
(ask, or CloudX MCP/CLI
- Coexistence — if another mediation stack is present: both init paths
intact, fallback or first-look wiring per the platform's first-look docs
page, no circular loading, per
coexist-mediation.md. - Privacy — CMP writes IAB consent strings before ads load; no usage of
privacy APIs the changelog marks removed; consent forwarded to any
coexisting mediation SDK (per
consent-and-cmp.md). - Report — findings ranked by severity: breaks now / breaks on upgrade / revenue risk / hygiene. Each finding cites the file:line and the docs page that contradicts it. End with the SDK-version gap (dependency present vs current documented version) and the changelog entries in between.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 48 lines · 61 tokens per session scan A a04c62749369
cloudx-audit is a skill published in the GitHub repository cloudx-io/cloudx-sdk-agents (15 stars, last pushed 2mo ago), licensed MIT. It adds 61 tokens to every session and 634 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
flutter
Use when building, structuring, testing or optimizing a Flutter app — feature-first layering, Riverpod 3 or Bloc, typed gorouter, freezed models, a dio data layer, Material 3, jank hunting, widget/golden tests. Targets Flutter 3.44 / Dart 3.12. NOT React Native (that is react-native), NOT Compose Multiplatform (that…
android-coroutines-pro
Deep-reviews Kotlin coroutines and Flow code for structured-concurrency correctness — scope and dispatcher discipline, cooperative cancellation, exception propagation, hot/cold flow patterns, and coroutine testing. Use when reading, writing, or reviewing concurrency-heavy Kotlin/Android code.
coredata-swift6-pro
Reviews Core Data code for Swift 6 strict concurrency compliance, modern context usage, and SPM compatibility. Use when reading, writing, or reviewing Core Data code under Swift 6.
android-compose-pro
Deep-reviews Jetpack Compose code for recomposition stability, side-effect correctness, lazy-list performance, and state modeling. Use when reading, writing, or reviewing non-trivial Compose UI — especially when chasing jank, runaway recomposition, or effect bugs.
swift-error-handling-pro
Reviews Swift error handling for modern patterns including typed throws, Result vs throws, LocalizedError conformance, and async error propagation. Use when writing or reviewing Swift error types and throwing functions.
swift-logging-pro
Reviews Swift logging code using os.Logger for correct privacy markers, subsystem/category conventions, and appropriate log levels. Use when writing or reviewing logging code.