Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add jdpalumbo2/workbench --skill clodex-auditgit clone --depth 1 https://github.com/jdpalumbo2/workbenchWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/jdpalumbo2/workbench/clodex-audit)<a href="https://agentmods.dev/skills/jdpalumbo2/workbench/clodex-audit"><img src="https://agentmods.dev/badge/skills/jdpalumbo2/workbench/clodex-audit.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00056 | $0.02633 |
| Opus 5 | $0.00028 | $0.01316 |
| Sonnet 5 | $0.00011 | $0.00527 |
| Haiku 4.5 | $0.00006 | $0.00263 |
Grade A, and why
clodex-audit scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 237 lines — stays where its author put it; the contents beside it link to each section on GitHub.
clodex-audit — investigate, tag every claim, route the follow-ons
Overview
This lane earns its existence from usage evidence: two major audit asks ran manually in one weekend, both excellent, and their report shape is encoded here. It owes the run exactly three things:
- A report file in the repo, at the profile's plans directory (or a
reports/sibling when the repo has one), in the §5 shape. - Every claim in it tagged —
VERIFIED (<method>)orHYPOTHESIS (<what would confirm it>)— with the load-bearing ones also recorded as findings (finding:recorded,source: "audit") and the artifacts that prove them as evidence (verification:evidence). - The run closed with
release.stateuntouched atnot-started— an audit releases nothing, and its manifest must say so without ceremony.
The manifest's stage stays open for the life of an audit. The lane's
operational shape — open → investigate → report → closed — lives in this
document's sections, not in stage events: the vocabulary is frozen at 23
names, stage:plan:entered would be a lie, and a run at stage open with
lane audit is exactly how the router and the runs index recognize an
audit in flight. No build, no verify, no ship, ever; the follow-on work an
audit surfaces is routed per item (§5) into new runs.
You arrive here from clodex, which owns preflight, the profile, and the
run directory. Invoked without an absolute run dir → stop and invoke
clodex.
0. Paths and commands
CLODEX_HOME="${CLODEX_HOME:-$HOME/.claude/skills/clodex}"
STATE="$CLODEX_HOME/state/clodex_state.py"
RUN_DIR="<the absolute run dir the router handed you>"
SNAP="$(python3 "$STATE" rebuild "$RUN_DIR")"
REPO="$(printf '%s' "$SNAP" | python3 -c 'import json,sys;print(json.load(sys.stdin)["repo"])')"
cd "$REPO"
Engine verbs, exit codes, and the lock rules are the clodex skill's
§"Paths and commands" and §2. Events are written to files and piped on
stdin, or passed inline with append -e for small ones.
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 6d ago First seen · 237 lines · 56 tokens per session scan A fe13fcd50432
clodex-audit is a skill published in the GitHub repository jdpalumbo2/workbench (1 stars, last pushed 4d ago), licensed MIT. It adds 56 tokens to every session and 2,633 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
code-review-excellence
This skill should be used when the user asks to review a diff or pull request, write review comments, audit code quality, establish review standards, or improve how a team performs code review.
do-it-review
Use to assess requirements and implementation quality independently, or to resolve a batch of review findings.
tfx-prune
A cleanup workflow that asks three AI coding assistants to independently identify unnecessary code, then removes only issues they agree are unwanted. It checks for duplication, needless abstractions, excessive error handling, and similar readability problems.
tfx-analysis
A code and architecture analysis workflow that can ask several command-line agents to examine a project from different viewpoints, including architecture, security, performance, user experience, and documentation.
tfx-review
A code-review workflow that asks several command-line AI reviewers to inspect changes independently, then reports issues that at least two reviewers agree on. TDD means test-driven development, where tests are written to guide implementation, but this add-on is for reviewing code rather than defining TDD.
show
Visualize code structure, changes, and verification evidence in the smallest useful view. Use for connections, flows, diffs, file maps, Mermaid diagrams, evidence maps, or focused HTML; show facts and label unknowns.