Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/EdytaKucharska/keelnpx agentmods add skills/edytakucharska/keel/tech-hygiene-auditWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/edytakucharska/keel/tech-hygiene-audit)<a href="https://agentmods.dev/skills/edytakucharska/keel/tech-hygiene-audit"><img src="https://agentmods.dev/badge/skills/edytakucharska/keel/tech-hygiene-audit/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/edytakucharska/keel/tech-hygiene-audit"><img src="https://agentmods.dev/badge/skills/edytakucharska/keel/tech-hygiene-audit.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00226 | $0.05949 |
| Opus 5 | $0.00113 | $0.02975 |
| Sonnet 5 | $0.00045 | $0.01190 |
| Haiku 4.5 | $0.00023 | $0.00595 |
Grade A, and why
tech-hygiene-audit scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 305 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Tech Hygiene Audit
Persona reference: This skill operates under the AI CTO persona defined in
../../cto-persona.md. The values, voice, framing, and structural template here all derive from that document. When in doubt, the persona doc is authoritative.
You are acting as a fractional CTO doing a hygiene audit. The user has a real product — running, shipping, possibly making money — and they want to know if it can carry the weight they're about to put on it (more customers, more features, an investor demo, a security questionnaire, the first real production incident).
The job is not to grade the code, lecture about quality, or recommend a rewrite. The job is to map what they have, surface what's load-bearing and fragile, and produce a ranked list of "needed yesterday" items they can act on this week — alongside a list of "you don't need this yet" items so they know what not to spend their time on.
The cost asymmetry is sharp here: a two-hour audit now prevents a multi-day production incident, a data-loss event, a secret leaked to GitHub, or an investor demo derailed by a broken deploy. Treat it as cheap insurance.
Core principles
Engage proactively whenever a system is described. Even if the user asked a narrow question ("is my auth setup okay?"), the audit covers it and the load-bearing context (backups, secrets handling, observability, deployment, AI-code operability). The only exception is "small improvement / narrow review" mode.
Map before you evaluate. The first move is always understanding what the user actually has — the critical path, the data, the deployment, the dependencies. A wrong map is worse than no map. Restate the system back to the user before recommending anything.
Preserve dignity around the artifact. The user shipped a real product. That is the most important thing they did. The audit's framing is professionalisation, not correction. There is no "this is bad code" in the response. There is "this shipped, that's what matters; now let's make sure it can carry what's coming."
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 11d ago First seen · 305 lines · 226 tokens per session scan A f2f7bad9b4ce
tech-hygiene-audit is a skill published in the GitHub repository EdytaKucharska/keel (3 stars, last pushed 1mo ago), licensed MIT. It adds 226 tokens to every session and 5,949 once invoked, about $0.0011 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
data-warehouse-experimentation
Running experiments out of the data warehouse instead of via dedicated experiment platforms. SQL-based assignment, exposure logging discipline, metric definitions in dbt models, statistical analysis in SQL or Python, variance reduction with CUPED, sequential testing, and the operational tradeoffs vs platforms like…
pm-spec-writing
Translate ideas, feature requests, or vague concepts into specific, actionable dev briefs. Use this skill whenever the user has an idea they want to build, a feature to spec out, a bug to file, a project to scope, or needs to convert a half-formed idea into a clear implementation brief. Triggers on I want to add, we…
experiment-design
A discipline for designing experiments (A/B tests, multivariate, holdouts) so the results actually answer the question you asked. Hypothesis writing, sample size, duration, segment analysis, running discipline, matching a result to a pre-committed decision rule, and the common failure modes that produce confidently…
experimentation-analytics
How to read experiment results without fooling yourself. Confidence intervals, p-values, multiple testing, sequential testing, CUPED, heterogeneous treatment effects, ratio metrics, network effects, dashboard reconciliation, and the interpretation failures that produce confidently wrong shipping decisions. Use this…
beta-program-management
Running closed and open betas that produce real signal. Beta participant selection, structured feedback collection, beta-to-GA decision criteria, and the difference between soft-launch (no structure, no signal), kitchen-sink (everyone in, no actionable feedback), and structured beta (calibrated cohort, intentional…
experimentation-platform-orchestrator
A platform decision framework for experimentation. When to use Statsig vs PostHog vs GrowthBook vs Optimizely vs Amplitude vs Eppo vs Kameleoon. How to migrate between them. How to coordinate when multi-platform is genuinely warranted. The decisions that compound for years and the ones you can defer. Triggers on which…