Borrowing it
Nothing to install: this file belongs to GabrielOnDelphi/Claude-Tools-for-Delphi. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/GabrielOnDelphi/Claude-Tools-for-Delphi/main/.claude/skills/light-code-Win64Audit/SKILL.mdgit clone --depth 1 https://github.com/GabrielOnDelphi/Claude-Tools-for-DelphiWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/gabrielondelphi/claude-tools-for-delphi/light-code-win64audit)<a href="https://agentmods.dev/skills/gabrielondelphi/claude-tools-for-delphi/light-code-win64audit"><img src="https://agentmods.dev/badge/skills/gabrielondelphi/claude-tools-for-delphi/light-code-win64audit/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/gabrielondelphi/claude-tools-for-delphi/light-code-win64audit"><img src="https://agentmods.dev/badge/skills/gabrielondelphi/claude-tools-for-delphi/light-code-win64audit.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00079 | $0.01929 |
| Opus 5 | $0.00039 | $0.00964 |
| Sonnet 5 | $0.00016 | $0.00386 |
| Haiku 4.5 | $0.00008 | $0.00193 |
Grade A, and why
light-code-Win64Audit scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 78 lines — stays where its author put it; the contents beside it link to each section on GitHub.
/light-code-Win64Audit — Win64 pointer-truncation audit
Finds the bug class that broke a real shipping app on Win64: SysIL: UInt := SHGetFileInfo(...) — a pointer-width API result stored in a 32-bit variable. Compiles silently; explodes only on Win64 (ERangeError with range checking, or a corrupted handle without it).
This is a thin launcher: resolve the scope, launch the audit agent(s), summarize. Discovery is done by GREP (deterministic, free), never by reading every file with an LLM. The agent reads code only at grep hits, to check the receiver's declared type.
Step 1 — Resolve scope
$args = one or more folders (or .pas files). No argument → ask which folder to audit; never default to all of c:\Projects without being told.
Default EXCLUDES (skip hits whose path contains): backup, Backups, before upgrade, ToDo, Testers, Tester , RESURSE, FACUT DE ALTII, old. These are archives — report a one-line count for them, nothing more. Do NOT exclude External/third-party folders that are LINKED into shipping projects (LightSaber\External\DiskDrives.pas was the original bug).
Step 2 — Launch the audit agent
Call the Agent tool, subagent_type: "general-purpose", model: "sonnet" (user says "cheap"/"haiku" → model: "haiku"). If the scope has more than ~800 .pas files, split by top-level subfolder into up to 4 agents launched in parallel, one folder set each.
Give each agent this brief verbatim, plus its folder list:
You audit Delphi code for Win64 pointer-truncation bugs. REPORT ONLY — never edit files.
A. Run this grep battery (ripgrep via the Grep tool, glob *.{pas,dpr,inc}) over the given folders:
:=\s*(SHGetFileInfo|ShellExecute\w*|SetTimer|SetWindowsHookEx|GetProp|FindFirstUrlCacheEntry|GetWindowLongPtr|SendMessage\w*|FileOpen|LoadLibrary|GetModuleHandle|FindWindow\w*|GlobalAlloc|GetStockObject|GetClipboardData|ImageList_\w+|CreateCompatible\w+)\(— API results; check each RECEIVER's declared type.(Set|Get)(Window|Class)Long(Ptr)?\([^;\r\n]*\b(Integer|Longint|LongInt|Cardinal|LongWord)\(— 32-bit casts around window-data calls.(Send|Post)Message\w*\([^;\r\n]*\b(Integer|Longint|LongInt|Cardinal)\(— 32-bit casts in wParam/lParam.\b(Integer|Longint|LongInt|Cardinal|LongWord|DWORD)\(\s*@— procedure address truncated to 32 bit.OldWndProc\s*:\s*(Integer|Longint|LongInt|Cardinal|DWORD|LongWord)(case-insensitive) — stored window proc in 32-bit variable.\b(h[A-Z]\w*|\w+Handle|\w+Wnd)\s*:\s*(Integer|Cardinal|LongWord|UInt|DWORD)\b— handle-named variables declared 32-bit.\.Result\s*:=\s*(Integer|Longint|LongInt)\(— pointer stuffed into a message Result via a 32-bit cast.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago Changed · +2 lines 8794184d5da7
- 9d ago First seen · 76 lines · 79 tokens per session scan A 4798167bec8e
light-code-Win64Audit is a skill published in the GitHub repository GabrielOnDelphi/Claude-Tools-for-Delphi (17 stars, last pushed yesterday), licensed MPL-2.0. It adds 79 tokens to every session and 1,929 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
dotnet-reverse
A guide for analyzing compiled .NET and C# programs, including managed Windows executables and libraries. Reverse engineering means studying compiled software to understand how it works, and decompiling turns it back into readable approximate source code.
check-bin-obj-clash
Detects MSBuild projects with conflicting OutputPath or IntermediateOutputPath. USE FOR: builds failing with 'Cannot create a file when that file already exists', 'The process cannot access the file because it is being used by another process', intermittent build failures that succeed on retry, or missing/overwritten…
dart-run-static-analysis
Execute dart analyze to identify warnings and errors, and use dart fix --apply to automatically resolve mechanical lint issues. Use during development to ensure code quality and before committing changes.
hotpath_init
Configure hotpath profiling in a Rust project. Adds the hotpath dependency with feature-gated setup, instruments main with hotpath::main, functions with measure/measureall, and wraps channels, mutexes, rwlocks, streams, futures, reqwest clients, axum routers and byte-level I/O with hotpath macros. Use when the user…
agents-sdk-dotnet-debugging
Use when troubleshooting an agent built with the Microsoft Agents SDK (Microsoft.Agents.Hosting.AspNetCore and related packages) in C# / .NET. Trigger on any of these symptoms: build or C# compile errors, crashes on startup, 401 or auth errors on incoming requests, the bot not responding to messages, appsettings.json…
golang-error-handling
Idiomatic Golang error handling — creation, wrapping with %w, errors.Is/As, errors.Join, custom error types, sentinel errors, panic/recover, the single handling rule, structured logging with slog, HTTP request logging middleware, and samber/oops for production errors. Built to make logs usable at scale with log…