Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add GoldenWing-360/claude-security-skills --skill distributed-system-auditgit clone --depth 1 https://github.com/GoldenWing-360/claude-security-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/goldenwing-360/claude-security-skills/distributed-system-audit)<a href="https://agentmods.dev/skills/goldenwing-360/claude-security-skills/distributed-system-audit"><img src="https://agentmods.dev/badge/skills/goldenwing-360/claude-security-skills/distributed-system-audit/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/goldenwing-360/claude-security-skills/distributed-system-audit"><img src="https://agentmods.dev/badge/skills/goldenwing-360/claude-security-skills/distributed-system-audit.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00080 | $0.02960 |
| Opus 5 | $0.00040 | $0.01480 |
| Sonnet 5 | $0.00016 | $0.00592 |
| Haiku 4.5 | $0.00008 | $0.00296 |
Grade A, and why
distributed-system-audit scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 258 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Distributed System Audit
A separate skill from codebase-audit. That one walks the code in one repo; this one walks the system: many processes, many trust boundaries, protocols between them, and the failure modes that don't exist when everything runs in one process.
The biggest mistake auditors make on distributed systems is treating them as N independent code audits. The interesting findings live between the components, in the assumptions they make about each other.
When to invoke
- Auditing a client/server product (native agents + control plane)
- Auditing a microservices or service-mesh setup
- Auditing an IoT or fleet-management backend
- Auditing a multi-tenant SaaS with worker / job-runner architecture
- Acquisition due-diligence on a distributed product
- Handing over operations of a multi-component system
- After an incident that crossed component boundaries
Pairs with codebase-audit for the per-component code-level work, kubernetes-security if the control plane is K8s, message-bus-security for the messaging layer, agent-client-security for the client-side.
Step 0 — Map first, judge later
The first deliverable of a distributed-system audit is an architecture diagram you produced, not the findings. Until you can draw every component and every channel between them, you don't understand the system well enough to audit it.
Spend the first 30% of the engagement on the map. It pays off triple.
┌────────────────────┐
│ Web Admin UI │
└─────────┬──────────┘
│ HTTPS + session cookie
┌─────────▼──────────┐
┌─────────────────│ Control Plane API ├───────────────────┐
│ └─────────┬──────────┘ │
│ │ │
write events │ writes │ writes
│ ▼ ▼
┌─────▼─────┐ ┌────────────┐ ┌────────────────┐
│ Audit log │ │ Postgres │ │ Object storage │
└───────────┘ │ (tenancy) │ │ (user uploads) │
└─────┬──────┘ └────────────────┘
│
┌──────────▼──────────┐
│ Message bus (NATS) │
└──────────┬──────────┘
publishes commands
│
┌────────────┼────────────┐
▼ ▼ ▼
┌────────────┐ Agent_1 Agent_2 ...
│ Agent_n │ (host A) (host B)
│ (host Z) │ customer machines
└────────────┘
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 11d ago First seen · 258 lines · 80 tokens per session scan A 6a521f2b4c1e
distributed-system-audit is a skill published in the GitHub repository GoldenWing-360/claude-security-skills (17 stars, last pushed 1mo ago), licensed MIT. It adds 80 tokens to every session and 2,960 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
tanstack-start
Build a full-stack TanStack Start app on Cloudflare Workers from scratch — SSR, file-based routing, server functions, D1+Drizzle, better-auth, Tailwind v4+shadcn/ui. Use whenever the user mentions TanStack Start, asks to scaffold a full-stack Cloudflare app with SSR, wants an SSR dashboard, or asks for a React 19 +…
mcp-builder
Build MCP servers in Python with FastMCP. Define tools / resources / prompts, build the server, test locally, deploy to FastMCP Cloud or Docker. Use whenever the user mentions building an MCP server, exposing tools to LLMs, FastMCP, building a Claude integration, or troubleshooting FastMCP module-level server…
hono-api-scaffolder
Scaffold Hono API routes for Cloudflare Workers. Produces route files, middleware, typed bindings, Zod validation, error handling, and APIENDPOINTS.md documentation. Use after a project is set up with cloudflare-worker-builder or vite-flare-starter, when you need to add API routes, create endpoints, or generate API…
cloudflare-worker-builder
Scaffold and deploy Cloudflare Workers with Hono routing, Vite plugin, and Static Assets. Describe project, scaffold structure, configure bindings, deploy. Use whenever the user wants to create a Worker project, set up Hono on Cloudflare, configure D1 / R2 / KV / Queues bindings, or troubleshoot Worker export syntax…
wordpress-setup
Connect to a WordPress site via WP-CLI over SSH or the REST API. Check CLI, test SSH, set up auth, verify access, save config. Use whenever the user wants to connect to a WordPress site, set up WP-CLI access, create an Application Password, or troubleshoot WordPress connection / auth issues.
vite-flare-starter
Scaffold a full-stack Cloudflare app from the vite-flare-starter template — React 19 + Hono + D1+Drizzle + better-auth + Tailwind v4+shadcn/ui + TanStack Query + R2 + Workers AI. Run setup.sh to clone, configure, and deploy. Use whenever the user wants a batteries-included Cloudflare full-stack app, vite-flare-starter…