What is stocktake-skills?

A catalog audit for a collection of agent skills that checks descriptions, required safeguards, verification commands, and the index for drift or omissions.

Use it during maintenance, before a major release, or when the skill catalog may no longer match the project.

It finds stale or incomplete skill documentation and broken checks before they affect a release.

stocktake-skills — Skill for Claude Code and Codex by danielvm-git: A catalog audit for a collection of agent skills…

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods

npx agentmods add skills/danielvm-git/bigpowers/stocktake-skills

Any agent

npx skills add danielvm-git/bigpowers --skill stocktake-skills

Clone the repo

git clone --depth 1 https://github.com/danielvm-git/bigpowers

Made for: Claude Code, Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/danielvm-git/bigpowers/stocktake-skills.svg)](https://agentmods.dev/skills/danielvm-git/bigpowers/stocktake-skills)

Your own site

<a href="https://agentmods.dev/skills/danielvm-git/bigpowers/stocktake-skills"><img src="https://agentmods.dev/badge/skills/danielvm-git/bigpowers/stocktake-skills.svg" alt="Measured on agentmods" height="20"></a>

Per session 46 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 916 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. Scan, not verified.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5	$0.00046	$0.00916
Opus 5	$0.00023	$0.00458
Sonnet 5	$0.00009	$0.00183
Haiku 4.5	$0.00005	$0.00092

Measured 2d ago against content hash 17c6c386e490, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

stocktake-skills scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.cline/skills/stocktake-skills/SKILL.md · 75 lines

How it starts

The opening of the file, as written. The whole thing — 75 lines — stays where its author put it; the contents beside it link to each section on GitHub.

story: e09s01

Stocktake Skills

HARD GATE — HARD GATE — Skill inventory must be current. Missing HARD GATEs, stale descriptions, or broken verify commands are defects, not cosmetic. Fix them in evolve-skill.

Audit SKILL.md catalog for drift, stale triggers, missing HARD GATEs, and INDEX mismatches.

Modes

Mode	Scope
Quick Scan	Skills changed since last tag or in current diff
Full	All skills per SKILL-INDEX.md + catalog audit
--verify	Run `bash scripts/run-skill-verify.sh` and append health results to the stocktake report

Process

Catalog validator (code-enforced) — run bash scripts/validate-skill-catalog.sh. Any FAIL is a critical finding before manual review. Add --archive to list zero-usage skills from metrics.skill_timings for auto-archiving candidates (move to specs/epics/archive/ or delete after user confirms). 0b. Agentic STE audit (e79s04) — run bash scripts/validate-agentic-ste.sh --audit skills/. Flag hedge words and sentences over 20 words per AGENTIC-STE.md. Record WARN lines in the stocktake report as STE debt — do NOT rewrite the full catalog in one pass. Route critical repeat offenders to evolve-skill.
Run bash scripts/audit-catalog.sh to verify pi/skills ↔ source SKILL.md sync. Mismatch is a critical finding.
Run mode; for each skill check: exists, verb-noun, <300 lines total, HARD GATE present, INDEX row matches.
Write specs/STOCKTAKE-<date>.md with findings table (skill, issue, severity).
Effectiveness report (--full mode only): Read specs/state.yaml metrics.skill_timings and report:
- Top 5 most-used skills (by calls, total_seconds)
- Skills with zero calls (potential dead weight)
- Skills with high average time (candidates for evolve-skill)
Critical findings → plan-work story; cosmetic → evolve-skill candidate.
--verify mode: Run bash scripts/run-skill-verify.sh and append a ## Verify Health section to the stocktake report: "N/68 PASS, M FAIL, K SKIP". FAIL skills are critical findings and go straight to plan-work.

Read the full file on GitHub · 75 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

2d ago First seen · 75 lines · 46 tokens per session scan A 17c6c386e490

Subscribe to this mod's changes

stocktake-skills is a skill published in the GitHub repository danielvm-git/bigpowers (167 stars, last pushed 4d ago), licensed MIT. It adds 46 tokens to every session and 916 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.

Building agents Testing ai-agents automation bmad claude-code clean-code cursor-rules

shared/tech-stack-detection

检测项目技术栈的通用方法，通过分析配置文件识别语言、框架、工具链.

echoVic/boss-skill · 29 tokens

devops/changelog-generation

自动生成 CHANGELOG，基于 git 提交历史和 pipeline 产物信息，遵循 Conventional Commits 和 Keep a Changelog 规范.

echoVic/boss-skill · 36 tokens

debloat

Compress an artifact that has accreted into bloat — padding, over-qualification, fused sentences, walls of enumeration, adjacent restatement — down to its load-bearing density, meaning preserved. Use when prose is correct and current but has grown verbose or patched-over and you want it tight without a full rewrite.

LilMGenius/paperthin · 66 tokens

boss

可审计的 agent 团队：BMAD 全自动研发流水线编排器。编排 9 个专业 Agent（PM、架构师、UI Designer、Tech Lead、Scrum Master、Frontend、Backend、QA、DevOps）从需求到部署，每一步都有事件溯源 + 不可绕过门禁 + 确定性 eval——可验证测试真跑、门禁真过。支持单环节切片命令（/boss:plan /review /qa /ship）与无 CLI 纯 Markdown 降级。 Triggers: 'boss mode', '/boss', '全自动开发', '从需求到部署', '帮我做一个', 'build this', 'ship it', '全流程'…

echoVic/boss-skill · 277 tokens

api-gateway

API Gateway patterns (Kong, Traefik, AWS API Gateway) — rate limiting, auth, routing, versioning. Use when implementing API gateway, reverse proxy, or API management.

TheBeardedBearSAS/claude-craft · 43 tokens

wasm

WebAssembly (WASM) integration, WASI, component model, Rust/Go to WASM compilation. Use when implementing WASM modules, browser/edge compute, or polyglot runtime.