Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add first-tree-ai/first-tree --skill context-tree-auditgit clone --depth 1 https://github.com/first-tree-ai/first-treeWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/first-tree-ai/first-tree/context-tree-audit)<a href="https://agentmods.dev/skills/first-tree-ai/first-tree/context-tree-audit"><img src="https://agentmods.dev/badge/skills/first-tree-ai/first-tree/context-tree-audit/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/first-tree-ai/first-tree/context-tree-audit"><img src="https://agentmods.dev/badge/skills/first-tree-ai/first-tree/context-tree-audit.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00077 | $0.01593 |
| Opus 5.5 | $0.00031 | $0.00637 |
| Sonnet 5.5 | $0.00015 | $0.00319 |
| Haiku 4.5 | $0.00008 | $0.00159 |
Grade A, and why
context-tree-audit scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 142 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Context Tree Audit
Purpose
Audit a stable snapshot of stored normal content on the bound Context Tree's actual binding branch and route each evidence-backed finding to the smallest safe follow-up.
The workspace-generated AGENTS.md / CLAUDE.md Context Tree Policy is the
only content-policy and authority baseline. Apply it directly; do not recreate
its definitions or rules in this skill. If the policy or binding is missing,
stop and report the environment gap.
Trigger Boundary
Use this skill only when a human explicitly asks for a broad stored-tree audit
or names a domain or set of normal paths to audit. This trigger is exclusive:
do not run first-tree-read first and expand a task-scoped read into an audit.
Do not use this workflow for a concrete source artifact that should be written to the tree, a Context Tree pull request or merge request review, ordinary task context, or an empty-tree setup. Those remain owned by their dedicated skills.
Choose the execution mode from the request:
- Report-only (default): a request to audit, inspect, or report grants read-only authority. Perform no commit, push, pull request, merge request, issue, tracked ask, or other external mutation; report findings and recommended routes in the completion response.
- Maintenance: select this only when the human explicitly asks to maintain, fix, or create follow-up artifacts. Mutation authority extends only to the requested artifact kinds. High-confidence local findings may produce one focused artifact per coherent finding group. Nothing is merged automatically.
Stable Snapshot
- Read
.first-tree/workspace.jsonand the generated Tree Location section. Resolve the bound tree checkout, upstream, and actual binding branch. Use the branch declared in Tree Location; never assumemainor substitute the checkout's current branch. Fail closed on a missing binding, repository mismatch, or ambiguous branch. - From the bound checkout, inspect
first-tree tree tree --helpbefore using its current selectors. - Fetch the bound upstream branch and resolve its exact remote HEAD SHA. If freshness cannot be confirmed because of network, permission, or remote identity failure, do not claim a current audit and do not create a semantic fix.
- Create a uniquely named, agent-owned detached worktree at that exact SHA. Never switch or edit the main tree checkout and never reuse an unowned path.
- Report the repository, branch, exact SHA, requested scope, and execution mode. Keep all discovery reads fixed to this snapshot.
- In the registered, clean detached worktree, run the selected
first-tree tree tree --no-pull ...command and confirm its HEAD is still the exact audited SHA. Never resolve the audit scope from the mutable main checkout after the snapshot exists. - In the detached worktree, run
first-tree tree verify --jsonbefore any semantic node read. Record validator failures as mechanical findings and do not hide them inside semantic conclusions. - If validation passes, read only the scoped normal nodes plus the minimum parent, sibling, relationship, and source evidence needed to judge them under the generated policy.
- Remove the detached worktree through
git worktree removewhen finished. Never use--force; a dirty snapshot is an integrity failure.
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 142 lines · 77 tokens per session scan A f4cbce427a70
context-tree-audit is a skill published in the GitHub repository first-tree-ai/first-tree (157 stars, last pushed 8d ago), licensed Apache-2.0. It adds 77 tokens to every session and 1,593 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
sivtr-memory
Retrieve shared local work memory: terminal activity, AI conversation history, prior decisions, validation evidence, debugging trails, recaps, and handoff context. Use before asking the user to repeat local work context.
memorywhale
Query and write durable debugging memory recorded by MemoryWhale. Use when debugging a failure that may have happened before, when you need the exact error/flags/output from an earlier attempt, when the user asks "how did we fix this last time?", or once you've figured out why something failed / how a fix worked and…
memorywhale-evidence
Use MemoryWhale debugging evidence when the user requests recall or a recurring failure may have relevant recorded history.
memorywhale-debugging
MemoryWhale debugging; compiler failures; terminal diagnostics.
doris-debug-resource-isolation
Use for Doris Workload Group / resource tag queue starvation, CPU/memory isolation leaks, and workload policy debugging. Commands: SHOW WORKLOAD GROUPS, EXPLAIN resource.
remem
Use when the user asks Codex to recall prior project context, save durable decisions or bug fixes, inspect remem memory health, or activate remem automatic memory hooks from the Codex plugin.