Getting it into your agent
There is no command for this one: it runs only inside a plugin, and the catalogue could not identify which plugin ships it. The source is linked below.
Wrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/jianshuo/claude-skills/wjs-auditing-project)<a href="https://agentmods.dev/skills/jianshuo/claude-skills/wjs-auditing-project"><img src="https://agentmods.dev/badge/skills/jianshuo/claude-skills/wjs-auditing-project/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/jianshuo/claude-skills/wjs-auditing-project"><img src="https://agentmods.dev/badge/skills/jianshuo/claude-skills/wjs-auditing-project.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00145 | $0.02688 |
| Opus 5 | $0.00072 | $0.01344 |
| Sonnet 5 | $0.00029 | $0.00538 |
| Haiku 4.5 | $0.00015 | $0.00269 |
Grade A, and why
wjs-auditing-project scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 162 lines — stays where its author put it; the contents beside it link to each section on GitHub.
wjs-auditing-project
Overview
Holistic project-state audit. Find everything that's stalled, broken, or diverged from the plan — then fix it together after the user confirms the checklist.
Hard two-phase split:
- Investigate → present grouped checklist (read-only; no commits, no merges, no pushes)
- Fix — only after the user explicitly confirms what to do
Never collapse the phases. The user wants to see the full picture before any action. "Just go ahead and fix everything" is fine as confirmation, but you still produce the checklist first so they can scan it.
When to use
- "看看现在的项目到底出了什么问题" / "make it right" / "what's broken"
- "为什么我的反馈还没上线"
- "为什么很久没有新 build / 没提交 App Store"
- "有没有 PR / 分支没合"
- Returning to a project after time away
- Before a release / TestFlight push, to make sure nothing is dangling
Phase 1 — Investigate (parallel)
Run all the read-only checks in one message with parallel Bash calls. Don't ask the user which to run; run them all. Many will return "nothing wrong" — that's fine, those just don't show up in the checklist.
A. Working tree & stashes
git status— uncommitted work?git stash list— forgotten stashes?git branch -vv— local branches, ahead/behind trackinggit log --oneline main..HEAD— what's on current branch not in maingit fetch origin --prune && git log --oneline HEAD..@{upstream}— what's on remote not localgit branch -r --merged mainandgit branch -r --no-merged main— remote branches still floating
B. Open / draft PRs
gh pr list --state open --json number,title,isDraft,mergeable,mergeStateStatus,updatedAt,author,headRefName- For any PR older than 7 days OR with
mergeStateStatus≠CLEAN: capture the failing checks viagh pr checks <num> - Auto-merge bot PRs (per memory: in-app feedback → @claude PR → auto-merge):
gh pr list --author "app/claude" --state all --limit 20— any merged but not yet in a TestFlight build? Any stuck open?
C. CI / GitHub Actions
gh run list --limit 20 --json conclusion,name,headBranch,createdAt,databaseId,eventgh run list --status failure --limit 10— failures specifically- For each failure on
mainor on an open PR's branch:gh run view <id> --log-failed | tail -100to capture the actual error
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago First seen · 162 lines · 145 tokens per session scan A a4f056d798d8
wjs-auditing-project is a skill published in the GitHub repository jianshuo/claude-skills (129 stars, last pushed 22d ago), licensed MIT. It adds 145 tokens to every session and 2,688 once invoked, about $0.0007 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
operating-cadence
Designs the rhythm an organization runs on — which reviews happen weekly, monthly and quarterly, what each one decides, who owns the numbers presented, and how a signal at the front line reaches the people who can act on it. Use this to set up a management operating system, fix a meeting calendar that produces no…
run-history
Inspect CCAM dashboard-run history and relate live run handles to persisted Claude Code or Codex sessions. Use when finding a prior launched task, checking whether a run is still attached, reviewing start/end status, or deciding whether to resume, view, or relaunch work.
clash-resolution-analyzer
Analyze BIM clash detection results and suggest resolutions. Prioritize clashes, identify patterns, assign responsibility, and track resolution status.
issue-report-generator
Automatically generate clear, actionable issue reports from failing tests and repository analysis. Analyze test failures to understand expected vs. actual behavior, identify affected code components, and produce well-structured Markdown reports suitable for GitHub Issues or similar trackers. Use when a test fails…
mk:jira-analyst
Full Jira ticket context analysis via the jira-analyst agent — including media (attached images / PDFs / screenshots) and linked issues. Produces structured findings suitable for posting back as a Jira comment. Read-only. Triggers: 'analyze KEY', 'rca for KEY', 'describe KEY with media'. NOT for complexity scoring…
postmortem-solo
Run a lightweight, blame-free postmortem after an incident, failed launch, or missed deadline — for one person. Use when the user says "that didn't go well", "the launch flopped", "we had an outage", "I missed my deadline", or wants to learn from a recent failure.