Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/dancolta/subscope/stack-auditnpx skills add dancolta/subscope --skill stack-auditgit clone --depth 1 https://github.com/dancolta/subscopeWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00081 | $0.00447 |
| Opus 5 | $0.00041 | $0.00224 |
| Sonnet 5 | $0.00016 | $0.00089 |
| Haiku 4.5 | $0.00008 | $0.00045 |
Grade A, and why
subscope-stack-audit scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
/subscope-stack-audit (🧱)
Run the daily surface in stack-audit mode, tuned for OPs publicly listing many SaaS tools and asking how to consolidate.
cd "$CLAUDE_PLUGIN_ROOT" && PYTHONPATH=engine python3 -m subscope.cli fetch-score --mode stack-audit --candidates
The engine searches each configured sub for stack-consolidation language (stack, tool sprawl, consolidate, "what can I cut") across the recent window via keyless Reddit search, then hands you the candidates. Surfaces land in the cooling queue (30 min hold) like the default run.
Judge every entry in candidates[] against the user's offer with the offer-relevance judge in skills/run/SKILL.md Step 3.5 (load offer.yml, example-pains.yml, brand-anchor.yml, keywords.yml once). A thread where the OP lists many tools and asks what to cut is the highest-intent format. Surface only BUYER and AUTHORITY verdicts, ranked BUYER first, each with a one-line reason, rendering each surfaced thread as a clickable markdown link [title](url) from the candidate's url verbatim. Render the result as the two-table layout in run Step 4 (a BUYER SIGNALS table, then an AUTHORITY PLAYS table). Cap at this mode's pattern_caps. On zero judged surfaces, print the empty-state ladder from run's "After completion". Optional Notion sync writes the Pattern column = stack-audit (emoji prefix 🧱); see skills/run/SKILL.md for the Notion procedure. No drafting.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 18 lines · 81 tokens per session scan A e0c842ee60e7
subscope-stack-audit is a skill published in the GitHub repository dancolta/subscope (25 stars, last pushed 21d ago), licensed MIT. It adds 81 tokens to every session and 447 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
broker-integration
Integrate a new Indian broker into OpenAlgo, or modify an existing broker plugin. Use when wiring up a broker's auth/login, orders, quotes, depth, history, funds, margin, symbol master, or WebSocket streaming; when a broker does not appear in the login dropdown or fails to load; or when debugging broker-specific…
chart-indicator
Build a custom indicator for the OpenAlgo /trading charting terminal (openalgo-charts). Use when asked to create, port, or debug a chart indicator, overlay, oscillator, band, or on-chart signal, including porting a study written for another charting platform. Writes a plain-JS descriptor into strategies/indicators/…
rekal-init
Bootstrap rekal memory for a project. Scans the codebase for architecture, conventions, dependencies, workflows, and config, then stores durable knowledge as properly typed, tagged, deduplicated memories. Use when starting rekal on a new project, or when user says "init rekal", "bootstrap memory", "populate rekal"…
fd-audit
Audit a change for resource leaks in OpenAlgo — file descriptors AND unbounded memory growth. Run after building a feature or fixing anything that touches databases, WebSockets or streaming, threads or executors, subprocesses, files, sockets, caches, or module-level registries. Also use when the user reports "too many…
flow-builder
Build, edit or debug an OpenAlgo Flow workflow - the no-code node graph at /flow. Use when asked to create a workflow, wire a webhook or TradingView alert to an order, add a node, port a strategy into Flow, or work out why a workflow imported but did nothing. Produces a workflow JSON that is validated against the real…
security-audit
Run OpenAlgo's periodic security audit across backend, frontend, database, cache, routes and dependencies, producing a dated xlsx report. Use for the monthly or twice-monthly review, before a release, after a dependency bump, or when the user asks for a security check, vulnerability scan, or audit report.