Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/ggwhite/4x/4x-auditnpx skills add ggwhite/4x --skill 4x-auditgit clone --depth 1 https://github.com/ggwhite/4xWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/ggwhite/4x/4x-audit)<a href="https://agentmods.dev/skills/ggwhite/4x/4x-audit"><img src="https://agentmods.dev/badge/skills/ggwhite/4x/4x-audit.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00140 | $0.01951 |
| Opus 5 | $0.00070 | $0.00975 |
| Sonnet 5 | $0.00028 | $0.00390 |
| Haiku 4.5 | $0.00014 | $0.00195 |
Grade A, and why
4x-audit scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 142 lines — stays where its author put it; the contents beside it link to each section on GitHub.
4x Audit
掃描 4x pipeline 累積的 artifacts，以旁觀者角度找出未處理的問題。
掃描範圍
三路並行（用 Agent tool 各派一個 researcher subagent）：
Source 1: Feature Gaps
檔案：docs/reference/discovered-feature-gaps.md（若不存在則跳過）
以下標記一律視為「已處理」（feature ID 前綴依專案而異，F 和 ws 都要吃）：
[已開 FXXX]/[已開 ws-XXX]— 已開 feature 追蹤[已直接修正]— 已直接修掉[不做]— 評估後決定不處理[延後]— 刻意延後；仍列出但歸入報告的獨立「延後」區塊，不算未處理缺口
對無標記項目，先對照 .4x/features/*.yaml 的 description 內容——若已有 feature
實質覆蓋該項（常見：audit 或人工開了 feature 但忘了回標），歸入 reconcile 清單
（Step 6 補標記），不要當成未處理缺口報出來。
剩下真正未處理的項目，對每筆分類：
- priority：P0（金流/安全）、P1（功能不完整/資料不正確）、P2（已知限制/工具改善）、P3（文件/低影響）
- category：金流安全 / 功能缺口 / 資料正確性 / 工具改善 / 部署設定 / 文件
Source 2: Escalations + Review Reports
先讀 .4x/features/*.yaml 的 status，只掃 status 非 done / abandoned 的
feature 的 run 目錄。done feature 的舊 report 是歷史紀錄不是待辦——功能已
合入，其中的 WARNING 多半早已收斂，全掃會把上線功能的舊 warning 每次重報一遍
（實測：kairos 92 個 done feature 累積 606 行 WARNING、4x repo 140 份含
WARNING 的舊 report，全是噪音）。
對入選 feature 掃描 .4x/run/{feature-id}/rounds/*/ 下的：
escalation.json—needed: true且根因只是繞過（workaround）沒真正修的review-report.md/deep-review-report.md— WARNING / CONDITIONAL PASS 項目test-report.md— 標記為「已知限制」但應該修的
聚焦在：
- 跨 feature 重複出現的問題
- 從沒被修的 WARNING
同時回報「done/abandoned 但 run 目錄還在」的 feature 清單（4x clean --dry-run
可直接取得），交給 Step 6 詢問是否清理。
Source 3: Learnings 反覆模式
檔案：.4x/learnings.json + .4x/learnings-context.md（CLAUDE.md 內 inline 版亦可）
按主題分群（排除 status=stale 的條目），找出出現 3 次以上的同類問題。
注意樣本池只增不減：判定為 systemic issue 前，先對照 .4x/features/*.yaml
檢查該根因是否已被後續 feature 修掉——已修的不算 systemic issue。
產出兩份：
- systemic issues：主題名、出現次數、根因、建議工具/流程改善
- 過時 learnings 的 id 清單（根因已修、或一次性環境備忘且 used_count=0）—— 交給 Step 6 詢問是否清理
執行步驟
Step 1: 前置檢查
確認在有 .4x/ 目錄的專案根目錄。沒有就提示使用者切到正確目錄。
Step 2: 派 3 個 researcher subagent 並行掃描
每個 agent 回傳 JSON array（結構化資料）。 prompt 中明確指定：
- 掃描的檔案路徑（用絕對路徑，基於 working directory）
- 回傳格式（JSON array）
- 分類標準
Step 3: 整合報告
等三路全部回來後：
- 合併去重（同一問題可能出現在 gaps 和 review 兩處）
- 按 priority 排序
- 計算統計：total / P0 / P1 / P2 / P3
- 分為三區塊：
- Systemic Issues（learnings 反覆模式）— 修一個根因消除多條 learnings
- Unactioned Feature Gaps（discovered-feature-gaps 未標已開）
- Unresolved Review Findings（review/escalation 中放過的）
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 6d ago First seen · 142 lines · 140 tokens per session scan A a1b1ef4143b8
4x-audit is a skill published in the GitHub repository ggwhite/4x (33 stars, last pushed 12d ago), licensed MIT. It adds 140 tokens to every session and 1,951 once invoked, about $0.0007 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
debug-optimize-lcp
Guides debugging and optimizing Largest Contentful Paint (LCP) using Chrome DevTools MCP tools. Use this skill whenever the user asks about LCP performance, slow page loads, Core Web Vitals optimization, or wants to understand why their page's main content takes too long to appear. Also use when the user mentions…
systematic-debugging
Use when debugging a failing test, build error, or runtime issue that isn't immediately obvious. Guides a 4-phase root cause analysis instead of random fix attempts.
diagnose
Trace from a reproduced symptom to the source code that causes it. Pin the specific file and approximate line, rate confidence in the cause and clarity of the fix independently, and always propose a concrete fix.
azsdk-common-pipeline-analysis
Analyze Azure SDK CI/CD pipeline failures into a structured diagnosis, and define the required output format. Load this skill before calling azsdkanalyzepipeline, which returns raw failure data that this skill interprets and formats. USE FOR: "pipeline failed", "build failure", "CI check failing", "tests failing in…
repro-admin
Reproduce an EmDash admin UI bug. Attach a container, start the demo dev server, drive the admin with agent-browser using the dev-bypass session, and capture the reproduction as screenshots plus a replayable transcript.
log-error-digest
Analyze log files to troubleshoot errors, identify peak error periods, and produce error clustering, frequency statistics, and time distribution reports. Supports JSON, syslog, and Nginx formats with automatic detection. Use when a user uploads a .log file and asks to analyze errors, find patterns, debug issues, or…