Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add jamestexas/agents --skill contract-parity-auditgit clone --depth 1 https://github.com/jamestexas/agentsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/jamestexas/agents/contract-parity-audit)<a href="https://agentmods.dev/skills/jamestexas/agents/contract-parity-audit"><img src="https://agentmods.dev/badge/skills/jamestexas/agents/contract-parity-audit/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/jamestexas/agents/contract-parity-audit"><img src="https://agentmods.dev/badge/skills/jamestexas/agents/contract-parity-audit.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00096 | $0.01543 |
| Opus 5.5 | $0.00038 | $0.00617 |
| Sonnet 5.5 | $0.00019 | $0.00309 |
| Haiku 4.5 | $0.00010 | $0.00154 |
Grade A, and why
contract-parity-audit scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 132 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Contract-Parity Audit
Two matrices answer one question: where does a shared contract get advertised but not delivered? Matrix A diffs every method of a multi-impl interface across its implementations. Matrix B maps every public surface exposing a given operation to the chokepoint it actually reaches. Do not redesign anything — the deliverable is the enumerated gap set that scopes the fix.
Provenance: distilled from the rosary-46e7ff run (2026-09-02, archive
~/codebase-audits/agentic-research-rosary/3274bd9/contract-parity/) that
scoped rosary-44eec8/45504f/457927: the parent audit had sampled 4 methods
and found 2 divergences; the full matrix found 9 — a hit-rate lesson in
why sampling doesn't scope a fix. Sibling of counterfactual-audit; shares
its iron rules (durable evidence directory FIRST, OBSERVED/INFERRED tagging,
read-only, fresh-context subagents, thesis withheld).
Setup
Durable output before any dispatch:
~/codebase-audits/<org>-<repo>/<commit>/contract-parity/ — one file per
matrix. Resolve the full commit SHA; note whether a parent audit exists and
link it. Findings are banked as issues after, never during.
Matrix A — implementation parity
For EVERY method of the target interface (enumerate from the definition — no sampling), one row, reading each implementation end-to-end including delegation chains:
- Method + production callers ("trait-dispatch only" is an answer).
- Per-impl location (file:line) + one-line behavior.
- Validation performed, per impl.
- Atomicity/concurrency mechanism, per impl (lock-held sequence / single statement / transaction / non-atomic multi-step).
- Sanitization (secret scrubbing etc.), per impl.
- Event/audit side effects, per impl.
- Error posture (propagated vs logged-and-continued vs silent), per impl.
- Idempotency / retry safety, per impl.
- Deliberate-bypass semantics (escape hatches are design, not gaps — verify against the incident they exist for before "fixing" them).
- Tests per impl (name them, or NONE).
- The punchline: observable semantic difference.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago Changed · +1 lines 94b1cd5b24a0
- 1mo ago First seen · 131 lines · 96 tokens per session scan A 2ae7f67cd5f2
contract-parity-audit is a skill published in the GitHub repository jamestexas/agents (2 stars, last pushed 23d ago), licensed Apache-2.0. It adds 96 tokens to every session and 1,543 once invoked, about $0.0004 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-09.
Other skills, from other repositories
code-review
Review pull requests for repository fit, meaningful value, trustworthy provenance, differentiation, and maintainability in awesome-copilot.
discount-review
Inspect the discount policy fixture with a repeatable review checklist and helper script.
code-review
Reviews code for bugs, security issues, and best practices.
crit-story
Author a crit story and continue the interactive review loop only when the user explicitly invokes crit-story or directly asks you to generate a crit story. Do not infer this skill from generic review, PR, or diff-review requests.
mcp-server-review
Review a Model Context Protocol (MCP) server implementation against the 2026-07-28 protocol revision, which removed the initialize handshake and Mcp-Session-Id and made the protocol stateless. Use when the user asks to review, audit, upgrade or migrate an MCP server, asks whether their MCP server is spec compliant…
re0-merge
Review and land an external contribution the way this suite does: gate it against the thesis, land it with the author's credit intact, complete a new skill rather than merging it raw, then approve, credit, and explain before closing. Use when reviewing a pull request, as any collaborator or maintainer, not only the…