ci-audit

ci-audit is a skill for Claude Code from coreyhaines31/makerskills. It costs 146 tokens per session (1,874 once invoked), scanned A, original, MIT.

A measurement skill for finding wasted time and billed minutes in GitHub Actions, GitHub's service for running automated jobs. It examines queues, setup and run times, scheduled jobs, failures, and per-job billing rules.

In plain words
What is it for?
Use it to audit one repository or many, inspect workflow and job timings, count scheduled runs, and rank possible reductions in GitHub Actions usage.
Why use it?
It shows which workflows consume waiting time or paid minutes, including quietly failing schedules, so you can decide which fixes are worth making.

Skill for Claude Code

Written for Claude Code: shipped in a Claude Code plugin. Also seen: mentions subagents.

Part of the makerskills plugin — 24 skills shipped together

Good fit Use it to audit one repository or many, inspect workflow and job timings, count scheduled runs, and rank possible reductions in GitHub Actions usage.

Compare 6 skills from other repositories ↓
Install with agentmods
npx agentmods add skills/coreyhaines31/makerskills/ci-audit
Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent
npx skills add coreyhaines31/makerskills --skill ci-audit
Clone the repo
git clone --depth 1 https://github.com/coreyhaines31/makerskills

Made for: Claude Code.

Or install makerskills, the plugin that ships this one along with the rest of its 24 skills.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for ci-audit

README.md
[![agentmods](https://agentmods.dev/badge/skills/coreyhaines31/makerskills/ci-audit/github.svg)](https://agentmods.dev/skills/coreyhaines31/makerskills/ci-audit)
Your own site
<a href="https://agentmods.dev/skills/coreyhaines31/makerskills/ci-audit"><img src="https://agentmods.dev/badge/skills/coreyhaines31/makerskills/ci-audit/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for ci-audit

Your own site · 80×15
<a href="https://agentmods.dev/skills/coreyhaines31/makerskills/ci-audit"><img src="https://agentmods.dev/badge/skills/coreyhaines31/makerskills/ci-audit.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 146 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 1,874 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00146 $0.01874
Opus 5.5 $0.00058 $0.00750
Sonnet 5.5 $0.00029 $0.00375
Haiku 4.5 $0.00015 $0.00187

Measured yesterday against content hash 3dcc297f1619, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

ci-audit scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.

The scan reads SKILL.md. This mod also ships 1 executable file (scripts/ci_audit.py), listed below but not scanned — reading those needs a real analyzer, not pattern matching.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

skills/ci-audit/SKILL.md · 114 lines

How it starts

The opening of the file, as written. The whole thing — 114 lines — stays where its author put it; the contents beside it link to each section on GitHub.

/ci-audit — Find and fix wasted GitHub Actions time

Measure first, then fix the few things that matter. In real audits the biggest win was rarely a slow test suite. It was a scheduled pipeline that had failed every day for months, a 30-second hourly cron billed as 730 minutes a month, or an SDK silently retrying a dead request three times.

A stdlib script, scripts/ci_audit.py in this skill's folder, does the measuring. You read its output, decide what's worth fixing, and ship it.

python3 <skill-dir>/scripts/ci_audit.py inventory <owner>              # which repos run Actions, private vs public
python3 <skill-dir>/scripts/ci_audit.py month <owner/repo>             # billable minutes by workflow, 30 days
python3 <skill-dir>/scripts/ci_audit.py jobs <owner/repo> --runs 150   # queue / setup / run per job
python3 <skill-dir>/scripts/ci_audit.py steps <owner/repo> <run-id>    # per-step seconds for one run
python3 <skill-dir>/scripts/ci_audit.py schedules <owner/repo>         # every cron as runs per month

It needs the GitHub CLI (gh) logged in. month and jobs make one API call per run, so a busy repo takes a minute or two. Run them in the background.

Step 0 — Scope and rules

Before measuring, settle with the user:

  • Which owners and repos. One repo, or everything pushed to in the last 60 days.
  • Off-limits repos. Someone else (a teammate, another agent) is mid-feature there. Those get an issue with numbers, never a pushed branch.
  • Where merges go. The integration branch (development, say) by default. Releasing to the default branch is a separate yes, but crons and scheduled fixes only take effect after it (Step 6).
  • What's out of scope: cutting test coverage, paid runners, switching CI vendors. Recommend those with numbers; don't do them.

Read references/gotchas.md now.

Step 1 — Inventory and money

  1. ci_audit.py inventory <owner> for each owner. Note private vs public: only private repos cost money, but every repo's wait time matters when agents block on CI.
  2. For an org, pull real billing: gh api "/organizations/<org>/settings/billing/usage?year=YYYY&month=M". For a personal account, use ci_audit.py month on each private repo and compare the total with the plan's included minutes.
  3. Write down the top 5 repos by billable minutes. That's where the time goes.

Read the full file on GitHub · 114 lines

Files

What ships with it

3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. yesterday First seen · 114 lines · 146 tokens per session scan A 3dcc297f1619

Subscribe to this mod's changes

ci-audit is a skill published in the GitHub repository coreyhaines31/makerskills (892 stars, last pushed 2d ago), licensed MIT. It adds 146 tokens to every session and 1,874 once invoked, about $0.0006 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-11-06.

Related

ci-audit compared with skills from other repositories

ci-audit next to 6 skills from other repositories
ModTypeStarsLast pushLicenceScanTokensWorks with
ci-auditcoreyhaines31/makerskillsSkill8922d agoMITA146Claude Code
devops-engineerJeffallan/claude-skillsSkill12k7d agoMITA107Claude Code
scenario-roblox-toolingscenario-labs/skillsSkill3.2kyesterdayMITA179Claude Code
scenario-unity-pipeline-automationscenario-labs/skillsSkill3.2kyesterdayMITA128Claude Code
scenario-godot-pipeline-automationscenario-labs/skillsSkill3.2kyesterdayMITA125Claude Code
schedule-recipemohitagw15856/pm-claude-skillsSkill1.5ktodayMITA94Claude Code
github-actions-genlaolaoshiren/claude-code-skills-zhSkill9072d agoMITA57Claude Code, Codex