Borrowing it
Nothing to install: this file belongs to haoxiang-xu/PuPu. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/haoxiang-xu/PuPu/main/.agents/skills/issue-feature-audit/SKILL.mdgit clone --depth 1 https://github.com/haoxiang-xu/PuPuWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/haoxiang-xu/pupu/issue-feature-audit)<a href="https://agentmods.dev/skills/haoxiang-xu/pupu/issue-feature-audit"><img src="https://agentmods.dev/badge/skills/haoxiang-xu/pupu/issue-feature-audit/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/haoxiang-xu/pupu/issue-feature-audit"><img src="https://agentmods.dev/badge/skills/haoxiang-xu/pupu/issue-feature-audit.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00094 | $0.02547 |
| Opus 5.5 | $0.00038 | $0.01019 |
| Sonnet 5.5 | $0.00019 | $0.00509 |
| Haiku 4.5 | $0.00009 | $0.00255 |
Grade A, and why
issue-feature-audit scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 153 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Issue: Feature Audit
Five consistency checks against one completed feature. Run before a direct Release sub-issue is marked Done; close-sprint treats an unaudited new feature as not-done-yet. Scope = the feature's diff and its blast radius, not the whole repo — except i18n, which is always a full scan (cheap, script-driven).
Findings are report-first: list violations with file:line, propose the fix, let the project maintainer/implementer decide. Only i18n missing-key auto-fill applies changes directly (rule inherited from the old i18n-coverage skill).
Retired workflow exclusions
Do not read, request, or validate implementation-owner confirmations, Quorum or court records, cases, proposals, rulings, handoffs, HS/RS/AT records, or any other retired authorization artifact. Their presence or absence must never affect PASS/FAIL. For cross-boundary work, use only the current Release issue or direct Plan plus the technical BC/SEQ/AC and immutable artifact evidence below.
Release membership
For a ticket audit, first resolve the ticket's direct Size=Release parent and verify its Project item. The Parent issue and Sub-issues progress Project fields are views; GitHub's issue relationship is authoritative. A ticket without a Release parent may receive a standalone audit report, but it does not change release state. Every ticket labelled new feature needs a fresh audit PASS bound to its delivered candidate digest, or an explicit maintainer waiver, before its parent Release can close.
Plumbing: before reading or changing a Project field, follow the shared board rules: run the project-scope preflight, discover the current fields, and verify the child's Project item.
Check 1 — i18n coverage (full scan, scripts in this directory)
en.json is the source of truth; runtime silently falls back to English, so gaps are invisible without this.
node .agents/skills/issue-feature-audit/scripts/audit.mjs --root <repo-root> > /tmp/i18n-report.json(add--strictonly on request — noisy). Report contains per-localemissing/orphan/placeholderMismatch+code.missingInEn/deadKeys/dynamicCount.- Auto-fill
missing(the ONLY auto-apply): translate each missing key's en value (preserve{placeholder}tokens verbatim), write flat JSON map, thennode .agents/skills/issue-feature-audit/scripts/apply.mjs --root <repo-root> --locale <name> --translations /tmp/<name>.json. Never overwrites existing values. - Report for confirmation: orphan/dead-key deletions, placeholder-mismatch edits,
missingInEnbugs (raw key shows in UI), and thedynamicCountblind spot. Deletions/edits need explicit OK. Never commit.
What ships with it
10 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- agents/openai.yaml 205 B
- references/pupu-test-api.md 6.6 KB
- scripts/apply.mjs 1.5 KB runs code
- scripts/apply.test.mjs 1.1 KB runs code
- scripts/audit.mjs 4.0 KB runs code
- scripts/audit.test.mjs 2.4 KB runs code
- scripts/keys.mjs 2.2 KB runs code
- scripts/keys.test.mjs 2.5 KB runs code
- scripts/scan.mjs 1.1 KB runs code
- scripts/scan.test.mjs 1.6 KB runs code
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 153 lines · 94 tokens per session scan A 5e02a8a9e69b
issue-feature-audit is a skill published in the GitHub repository haoxiang-xu/PuPu (36 stars, last pushed 3d ago), licensed Apache-2.0. It adds 94 tokens to every session and 2,547 once invoked, about $0.0004 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-21.
Other skills, from other repositories
humanizer
Rewrite AI-generated copy in Spanish and English so it sounds direct, concrete and human while preserving meaning, facts and numbers exactly. Use when drafts feel robotic, verbose or translated and need short active sentences without em-dashes.
review-all
Multi-agent code review for diffs (project-agnostic). Covers standards, bugs, security, DRY, smells, perf, tests, API contracts, a11y/i18n. Verifies each finding to eliminate false positives. Use for /review-all, pre-PR/pre-commit review, or auditing uncommitted/staged changes.
i18n-rtl-audit
Audit a page for internationalization readiness — layout breaks under long translations (pseudo-localization), RTL rendering issues, hardcoded UI strings, and missing lang/dir attributes. Playwright MCP only, no signup.
fec-drawio-studio
An editable workflow for making technical diagrams in draw.io (also called diagrams.net), with the original .drawio file saved alongside exported images or documents. It covers architecture, database, UML, sequence, flow, machine-learning, and code-structure diagrams.
fec-nextjs-project-standard
A development guide for Next.js 14 and newer projects using App Router, Next.js’s file-based routing system. It covers server-rendered pages, layouts, data loading, middleware, metadata, and server actions.
fec-state-management
A guide for deciding where an application's changing information should live, such as inside a component, in the URL, in a form, in a browser cache, or in a shared store. A store is a shared place for client-side information used across parts of an app.