Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add fall-out-bug/sdp --skill stratauditgit clone --depth 1 https://github.com/fall-out-bug/sdpWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/fall-out-bug/sdp/strataudit)<a href="https://agentmods.dev/skills/fall-out-bug/sdp/strataudit"><img src="https://agentmods.dev/badge/skills/fall-out-bug/sdp/strataudit/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/fall-out-bug/sdp/strataudit"><img src="https://agentmods.dev/badge/skills/fall-out-bug/sdp/strataudit.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00042 | $0.00812 |
| Opus 5.5 | $0.00017 | $0.00325 |
| Sonnet 5.5 | $0.00008 | $0.00162 |
| Haiku 4.5 | $0.00004 | $0.00081 |
Grade A, and why
strataudit scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 88 lines — stays where its author put it; the contents beside it link to each section on GitHub.
@strataudit - Strategy Traceability Audit
Run a document-backed strategy audit over a real corpus or existing .strataudit
artifacts. This skill is for evidence-backed audit work, not free-form strategy prose.
Use When
- the user needs alignment analysis across strategic and delivery documents
- the answer must be backed by extracted entities, traces, findings, or saved artifacts
- the user needs one of these modes:
corpus-audit,traceability-audit,coverage-audit,evidence-pack,report-redraft
Do Not Use When
- the user wants only a short narrative summary
- there is no accessible corpus and no existing artifacts
- the task is brainstorming or roadmap generation from scratch
- the problem is operational debugging rather than document traceability
Safety Guards
- only rely on real document text or saved audit artifacts
- do not fabricate quotes, traces, or initiatives
- preserve source language in the evidence layer unless explicitly asked to derive display text
- similarity alone is never enough to call a trace verified
- if provenance is weak, downgrade the claim or refuse to make it
Audit Modes
| Mode | Use when | Must emit |
|---|---|---|
corpus-audit |
corpus quality and ingest readiness are unclear | corpus inventory, exclusions, level coverage, caveats |
traceability-audit |
the user wants cross-level alignment and missing links | traces, findings, caveats |
coverage-audit |
the user asks what is and is not covered | coverage summary with explicit denominators |
evidence-pack |
the user wants inspectable proof behind claims | source-backed findings, trace tables, caveats |
report-redraft |
the user wants a better report from existing artifacts | rewritten sections with unchanged trust boundaries |
Start with corpus-audit when corpus quality is unknown. Use report-redraft
only when an evidence pack or prior audit artifacts already exist.
Runtime Order
- use an injected host-native runtime from the harness when available
- otherwise use a configured OpenAI-compatible runtime
- use OpenRouter as the default network enhancer/fallback
- use artifact-only mode when the question can be answered from existing outputs
- use
sdp-strataudit runonly as CLI fallback
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 88 lines · 42 tokens per session scan A cb38a08e0f01
strataudit is a skill published in the GitHub repository fall-out-bug/sdp (19 stars, last pushed 4mo ago), licensed MIT. It adds 42 tokens to every session and 812 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
norma-workflow
Run every coding task through Norma's deterministic checks and record the outcome to the audit trail. Use whenever you create or modify code in a workspace connected to the Norma MCP server, when asked to review code against organization standards, or when asked to work through the repository's open issues.
Tech Debt Auditor
Identifies and prioritizes technical debt in a codebase with an effort/impact matrix.
Unit Test Improver
Reviews existing unit tests for gaps, weak assertions, and missing edge cases, then rewrites them to be more robust.
Refactor Planner
Creates a safe, step-by-step plan to refactor messy code without breaking existing behavior.
code-discipline
Coding methodology for production-grade software development. Enforces structured thinking before coding, verifying reality, simplicity, surgical changes, contract awareness, and verifiable success criteria. Use when writing, reviewing, or refactoring code that needs to remain reliable over time, including production…
umbra-trust-review
Verify AI-generated code before shipping. Run Umbra's Trust Score scan before committing or finishing any coding task, treat findings as blocking issues, and re-scan until clean. Use when finishing a task, before a commit, or when reviewing code written by an agent.