Borrowing it
Nothing to install: this file belongs to frostney/pascal-mcp-sdk. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/frostney/pascal-mcp-sdk/main/.agents/skills/codebase-audit/SKILL.mdgit clone --depth 1 https://github.com/frostney/pascal-mcp-sdkWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/frostney/pascal-mcp-sdk/codebase-audit)<a href="https://agentmods.dev/skills/frostney/pascal-mcp-sdk/codebase-audit"><img src="https://agentmods.dev/badge/skills/frostney/pascal-mcp-sdk/codebase-audit/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/frostney/pascal-mcp-sdk/codebase-audit"><img src="https://agentmods.dev/badge/skills/frostney/pascal-mcp-sdk/codebase-audit.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00070 | $0.01953 |
| Opus 5.5 | $0.00028 | $0.00781 |
| Sonnet 5.5 | $0.00014 | $0.00391 |
| Haiku 4.5 | $0.00007 | $0.00195 |
Grade A, and why
codebase-audit scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 181 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Codebase audit
Assess the repository's current state rather than a branch diff. Produce a truthful coverage map, actionable findings, and coherent remediation batches.
Modes and boundaries
The audit is non-remediating by default. It may run safe local tests, builds, servers, browser flows, disposable repros, isolated test data, and temporary artifacts, but it must not edit repository content or create persistent or externally visible side effects. Clean up disposable artifacts and report anything retained.
subagents is an additive execution input. Without it, do not delegate any part
of the audit.
A request to save JSON authorizes only the named findings artifact; it does not authorize remediation. Read references/findings-json.md only when JSON output is requested.
There is no fix-all mode. After reporting, offer remediation batches. A fix
follow-up begins only when the user selects a coherent batch or finding IDs. It
authorizes focused local edits and validation on a focused branch, not commits,
pushes, publication, issue creation, deployments, or shared-state mutation.
Map before judging
- Read applicable project instructions, vision and product documentation, current source, tests, configuration, lockfiles, generated interfaces, completion contracts, packaging, and deployment definitions.
- Map user-visible capabilities, entry points, modules, trust boundaries, data and state flows, background work, external dependencies, tests, tooling, and operational paths.
- Choose perspectives from the actual codebase:
- always cover behavior, correctness, architecture and consistency, simplification, self-documentation, test value, and operations;
- add UI/UX and accessibility when interfaces exist;
- add security and adversarial-input analysis at trust boundaries;
- add persistence, migration, transaction, concurrency, and idempotency analysis for stateful paths;
- add API, CLI, library, packaging, compatibility, deployment, rollback, observability, and performance analysis only where those surfaces exist.
- For a shallow subsystem, trace its complete path and direct interactions. For a layered codebase, partition work by capability and perspective so later areas do not receive progressively thinner analysis.
- Build a bounded churn map from repository history. Rank frequently changed
files, then inspect function, method, class, or module history where symbols
are reliable. Use the repository's declared churn window or 90 days when none
exists. Prefer its code-health tool; otherwise use Git file history and
git log -Lfor stable symbols. Follow renames; state the window, touch count, and line churn, and label file-level fallback.
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 181 lines · 70 tokens per session scan A d701c48b7be3
codebase-audit is a skill published in the GitHub repository frostney/pascal-mcp-sdk (2 stars, last pushed 4d ago), licensed MIT. It adds 70 tokens to every session and 1,953 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
stage-refactor-checklist
Comprehensive checklist for refactoring a schemacompiler stage folder. Use EVERY TIME you refactor a compiler stage (resolve, unify, codegen, etc.). Read this before writing any code.
invariant-first-coding
Reason from proven invariants before coding. Use when reviewing fallback logic, narrowing types, handling conversions, deciding whether an error path is real or impossible, removing overdefensive code, or when the user questions whether code is being too theatrical, too hedged, or not fail-closed enough.
state-machine-dfa
Document state machines with mermaid diagrams and DFA transition files. Use when writing, reviewing, or adding state-driven logic to modules that have sequential phase transitions, lifecycle management, or protocol handshakes.
daily-bugfix-check
Check the current author's commits from the last 24 hours and proactively find and fix any bugs they introduced. Use when the user asks for a daily bugfix check, wants to review today's commits for issues, or asks to "check my recent code for bugs." Combines commit review with the recent-code-bugfix workflow.
second-opinion
Get an independent review of the current change from a different model family (GPT via Codex, Copilot or Cursor; Gemini via Antigravity) through agent-intern, then check each finding against the code and reconcile it with your own view. Use before merging a risky diff, when stuck on a bug, or when the user asks for a…
code-simplifier
Review substantial mcp-reporter changes for unnecessary complexity while preserving tested behavior and public contracts.