Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add derio-net/super-fr --skill fr-auditgit clone --depth 1 https://github.com/derio-net/super-frWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/derio-net/super-fr/fr-audit)<a href="https://agentmods.dev/skills/derio-net/super-fr/fr-audit"><img src="https://agentmods.dev/badge/skills/derio-net/super-fr/fr-audit/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/derio-net/super-fr/fr-audit"><img src="https://agentmods.dev/badge/skills/derio-net/super-fr/fr-audit.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00063 | $0.02016 |
| Opus 5.5 | $0.00025 | $0.00806 |
| Sonnet 5.5 | $0.00013 | $0.00403 |
| Haiku 4.5 | $0.00006 | $0.00202 |
Grade A, and why
fr-audit scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 120 lines — stays where its author put it; the contents beside it link to each section on GitHub.
fr-audit
Announce at start: "I'm using fr-audit to audit ."
The numbers are not yours to compute. fr usage reads the harness store, classifies tool calls and splits the harness's dollar figure. Your job is choosing what to compare and saying what it means. Never add a figure by hand, never price tokens, never write 0 for —.
The engine
| Command | Does |
|---|---|
fr usage collect --run <id> |
every session a run cursor records, normalized into $HOME/.cache/fr/usage/ |
fr usage collect --session <id> [--harness opencode|hermes] |
one session (default harness: claude-code) |
fr usage report --run <id> [--run <id>…] --format table |
per model, activity, sub-activity and step |
fr usage report --session <id>… --format html -o <file> |
the same as one self-contained page |
fr usage compare --before <date|timestamp|run> --after <date|timestamp|run> |
two sets of runs from the committed usage files, cursors and plan journals: phases, turns, main and subagent cache-read and output, cost (and how many runs were priced), review findings per phase, re-opened findings; per-run rows plus per-set medians and n; --steps adds the main session's per-step turns, tokens, cost and $/turn |
collect and report read a run cursor and the harness store and write only under
the cache; report reads any uncollected session live. compare reads committed
files and writes nothing. Pass --repo <path> when the cursor lives in another checkout.
Choosing what to compare
- One run:
--run <id>. The step table shows which pipeline step spent what. - Before and after a process change:
fr usage compare --before <cutoff> --after <cutoff>(ISO date or timestamp, split on each run'sstarted; or a run id). It reads the committed files, prints—for what a run never recorded. Quote command and output withnand the priced count; say "inconclusive" when the sets are thin or confounded (model change, unpriced, pre-split runs). - A sample: name the sessions and report them together; pooled shares weight each session by its dollars.
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 6d ago Changed 4010e2f9029b
- 9d ago Changed 5ab18f3c9772
- 12d ago Changed · +21 lines fd1c9c7710b8
- 20d ago First seen · 99 lines · 63 tokens per session scan A 20ef301111c1
fr-audit is a skill published in the GitHub repository derio-net/super-fr (2 stars, last pushed 2d ago), licensed MIT. It adds 63 tokens to every session and 2,016 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-26.
Other skills, from other repositories
alive:system-upgrade
Upgrade ALIVE to the current version. Handles v1/v2/v3.x source states, multi-surface aware (alive-mcp / Hermes / Codex), retroactive version detection, partial-failure resume, dry-run previews, and rollback inspection.
pr-review
Comprehensive PR review across six dimensions — cost impact, environment drift, ownership gaps, SOC 2 compliance, deprecated API / version hygiene, and rollback feasibility. Each mode inspects the diff and current file state, reports findings with severity, and recommends concrete fixes. Use when preparing a PR for…
extract-resume
Parse a resume's uploaded PDF into structured JSON (basics, experience, projects, skills, education) and save it to the editor.
ensure-pipelines-host
Ensures the tenant has a usable Power Platform Pipelines host environment before any pipeline operation runs. Detects host state via the same resolution order as the Power Apps UI (org-db setting → BAP env metadata → default-custom-host setting); if any existing host (Platform or Custom) is found, uses it. If no host…
review-depth
Experimental declared review depth for linked-intent development. Use when a LID project's instruction file declares a review depth in prose (e.g. "Review depth - I review through LLD; below that, consolidate to one review") or the user asks to batch phase reviews, consolidate stops, or let go below a phase depth.…
codex-test-gen
Generate unit tests for specified functions using Codex exec.