Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/data-wise/craft/guard-auditnpx skills add Data-Wise/craft --skill guard-auditgit clone --depth 1 https://github.com/Data-Wise/craftWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00087 | $0.02460 |
| Opus 5 | $0.00044 | $0.01230 |
| Sonnet 5 | $0.00017 | $0.00492 |
| Haiku 4.5 | $0.00009 | $0.00246 |
Grade A, and why
guard-audit scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Reads agent configuration directorieslowAgent snooping
.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.
Analyze branch guard configuration to find false positives and reduce friction. Proposes changes to `.claude/branch-guard.json` — never modifies the guard script itself. Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.
How it starts
The opening of the file, as written. The whole thing — 221 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Guard Audit
Analyze branch guard configuration to find false positives and reduce friction. Proposes changes to .claude/branch-guard.json — never modifies the guard script itself.
When to Use
- User reports branch guard blocking legitimate operations
- User says "audit guard", "tune guard", "guard friction"
- After multiple guard false positives in a session
- User wants to understand guard behavior
Prerequisites
scripts/branch-guard.shmust exist (the guard script)- Git repository with branch protection enabled
Guard Audit Pipeline
Execute these steps in order.
Step 1: Discovery
Read the branch guard script and extract all protection rules:
# Extract protection patterns from branch-guard.sh
grep -n "BLOCKED\|blocked\|exit 2\|protection" scripts/branch-guard.sh
# Extract regex patterns used for detection
grep -n "grep.*-E\|=~\|pattern\|regex" scripts/branch-guard.sh
# Read existing config (if any)
cat .claude/branch-guard.json 2>/dev/null || echo "No config file found"
Present a summary:
┌───────────────────────────────────────────────────────────────┐
│ GUARD DISCOVERY │
├───────────────────────────────────────────────────────────────┤
│ Script: scripts/branch-guard.sh (N lines) │
│ Config: .claude/branch-guard.json (found/not found — flat │
│ branch→level map, e.g. {"main":"block-all"}) │
│ Branches: main (block-all), dev (smart), feature/* (none) │
│ │
│ Protection Rules Found: │
│ 1. [HIGH] Destructive git commands (reset --hard, clean -f) │
│ 2. [HIGH] Force push to protected branches │
│ 3. [MEDIUM] New code files via Write or shell redirection │
│ 4. [MEDIUM] Guard-bypass marker creation │
│ ... (N total rules) │
└───────────────────────────────────────────────────────────────┘
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 221 lines · 87 tokens per session scan A d418fb496aec
guard-audit is a skill published in the GitHub repository Data-Wise/craft (4 stars, last pushed 16d ago), licensed MIT. It adds 87 tokens to every session and 2,460 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 1 finding (reads agent configuration directories). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
architecture-review
Conducts a comprehensive multi-perspective architecture review using ALL architecture team members. Use when the user requests "Start architecture review", "Full architecture review", "Review architecture for version X.Y.Z", "Conduct comprehensive review", or when they want assessment from multiple perspectives. Do…
architecture-status
Reports on the health and state of architecture documentation (counts of ADRs, reviews, activity levels, documentation gaps). Use when the user asks "What's our architecture status?", "Show architecture documentation", "How many ADRs do we have?", "What decisions are documented?", "Architecture health check", or wants…
pragmatic-guard
Enables and configures Pragmatic Guard Mode (YAGNI Enforcement) to prevent over-engineering. Use when the user requests "Enable pragmatic mode", "Turn on YAGNI enforcement", "Activate simplicity guard", "Challenge complexity", or similar phrases.
specialist-review
Conducts a focused review from ONE specific specialist's perspective (e.g., Security Specialist, Performance Expert). Use when the user requests "Ask [specialist role] to review [target]", "Get [specialist]'s opinion on [topic]", "Have [role] review [code/component]", or when they want deep expertise in ONE specific…
create-adr
Creates a NEW Architectural Decision Record (ADR) documenting a specific architectural decision. Use when the user requests "Create ADR for [topic]", "Document decision about [topic]", "Write ADR for [choice]", or when documenting technology choices, patterns, or architectural approaches. Do NOT use for reviews (use…
list-members
Displays the roster of architecture team members with their specialties and expertise areas. Use when the user asks "Who's on the architecture team?", "List architecture members", "Show me the architects", "What specialists are available?", "Who can I ask for reviews?", or wants to discover available experts. Do NOT…