Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add EvolveHQ/docflow --skill auditgit clone --depth 1 https://github.com/EvolveHQ/docflowWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/evolvehq/docflow/audit)<a href="https://agentmods.dev/skills/evolvehq/docflow/audit"><img src="https://agentmods.dev/badge/skills/evolvehq/docflow/audit/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/evolvehq/docflow/audit"><img src="https://agentmods.dev/badge/skills/evolvehq/docflow/audit.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00141 | $0.09023 |
| Opus 5.5 | $0.00056 | $0.03609 |
| Sonnet 5.5 | $0.00028 | $0.01805 |
| Haiku 4.5 | $0.00014 | $0.00902 |
Grade A, and why
audit scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 637 lines — stays where its author put it; the contents beside it link to each section on GitHub.
audit
Check a documentation-led repo against the conventions it declares.
This is the enforcement AGENTS.md cannot guarantee on its own.
Step 0 — Preconditions and context
-
Confirm the repo is bootstrapped.
-
Read
CONVENTIONS.mdto learn what to enforce: the ADR shape scheme — a single shape, two shapes declared by ashape:field in each ADR's metadata block (no number boundary is recorded and none is read), or the legacy range encoding described in item 4 — status lifecycle, integration model, multi-agent mode, language mandate, optional artefacts present (GLOSSARY, domains/), the canonical glossary shape recorded in §Glossary (optional heading and prose, then oneTerm | Definitiontable), and any Q10 domain hard rules, and the artefact root (default: repository root) — resolveadr/,plan/,INDEX.md,_agent/against it and honour it in the cross-reference and INDEX-sync checks. -
If a
federation.mdexists, this repo is part of a multi-repo product. Note itsRole(central/home/coordinatorindex-holder, or a plainmember) and read the recorded identity scheme; the cross-repo checks (check 12) run from the index-holding repo. -
Legacy range encoding. Some two-shape repos were scaffolded before the shape became a declared field and encode it in the number instead: capability ADRs below a cutoff, technology ADRs at or above it, and the technology template sitting at the boundary as a pseudo-ADR. Two signals identify it, and either one alone is enough:
CONVENTIONS.md§ADR Shapes records a cutoff — a capability range and a technology range rather than ashape:field; oradr/holds a template file numbered other than0000(e.g.adr/0100-template.md, or whatever boundary the project chose).
Treat the two as one condition, not two findings. When it holds the catalogue is valid, not broken — it predates the declared field. Run the checks below under the legacy rules noted against checks 1, 2 and 4, so a repo that passed before keeps passing, and report the single finding of check 15. A migration onto the declared field is offered in Step 4; nothing is rewritten here.
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 11d ago Changed · +133 lines 9512dff186e3
- 1mo ago Changed · +30 lines 06fee6077c4f
- 1mo ago Changed · +107 lines eed853cca82a
- 1mo ago Changed · -4 tokens per session 6553e7bfc6cc
- 1mo ago Changed · +212 lines 1535feb51397
- 1mo ago Changed · +19 lines c346202dec59
- 1mo ago First seen · 136 lines · 145 tokens per session scan A a262fed33967
audit is a skill published in the GitHub repository EvolveHQ/docflow (16 stars, last pushed 2d ago), licensed MIT. It adds 141 tokens to every session and 9,023 once invoked, about $0.0006 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
adr-compliance
This skill should be used when the user asks about "ADR compliance", "architecture compliance", "ADR audit", "enforce ADRs", "check code against ADRs", "ADR violations", or needs guidance on auditing code compliance with accepted architectural decision records.
adr-integration
This skill should be used when the user asks about "ADR integration", "ADR CI/CD", "ADR tooling", "ADR automation", "export ADRs", "ADR documentation site", or needs guidance on integrating ADRs with CI/CD, documentation sites, and other tools.
adr-decision-drivers
This skill should be used when the user asks about "decision drivers", "architectural forces", "quality attributes", "how to identify trade-offs", "non-functional requirements for ADRs", or needs help identifying, documenting, and weighing the forces that influence architectural decisions.
adr-fundamentals
This skill should be used when the user asks "what is an ADR", "when should I create an ADR", "ADR best practices", "architecture decision records", "ADR lifecycle", "how to document architecture decisions", or needs guidance on ADR fundamentals, when to create ADRs, or ADR lifecycle management.
adr-quality
This skill should be used when the user asks about "ADR quality", "review ADR", "ADR checklist", "improve ADR", "ADR validation", "good ADR examples", or needs guidance on evaluating, improving, and maintaining high-quality architectural decision records.
han-release
Cut a Han release: update CHANGELOG.md with the changes since the last release, bump and tag every plugin that changed as {plugin-name}--v{version} so a version-constrained dependency can resolve, and publish a GitHub release crediting every merged pull request and closed issue to the people behind it. Use when…