Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add joshukraine/dotfiles --skill drift-checkgit clone --depth 1 https://github.com/joshukraine/dotfilesWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/joshukraine/dotfiles/drift-check)<a href="https://agentmods.dev/skills/joshukraine/dotfiles/drift-check"><img src="https://agentmods.dev/badge/skills/joshukraine/dotfiles/drift-check/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/joshukraine/dotfiles/drift-check"><img src="https://agentmods.dev/badge/skills/joshukraine/dotfiles/drift-check.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00020 | $0.01053 |
| Opus 5.5 | $0.00008 | $0.00421 |
| Sonnet 5.5 | $0.00004 | $0.00211 |
| Haiku 4.5 | $0.00002 | $0.00105 |
Grade A, and why
drift-check scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 84 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Drift Check
Pre-PR deviation check against the project spec. Run this before /create-pr to verify alignment between implementation and documentation.
Reference: See
~/.claude/docs/prd-workflow/spec-driven-development.md§2–§4 for the deviation threshold, workflow, and checkpoint cadence that this skill operationalizes.
Not the same as /code-review — that inspects the diff for correctness bugs and cleanups; this checks the diff against the spec and docs for deviations. They run at the same pre-PR moment and complement each other.
Your task
Perform a lightweight, advisory review of the current branch's changes against the project's spec and living documents. This is a read-only check — do not modify any files.
Step 1: Identify scope
- Determine the default branch first — don't assume
main. Rungit rev-parse --abbrev-ref origin/HEAD; it prints e.g.origin/mainororigin/master, and the part afterorigin/is the base branch for the commands below. If it errors (noorigin/HEADset locally), fall back togit remote show origin(read its "HEAD branch:" line) or default tomain. Use this detected base wherever<base>appears below. (Run the detection as a plain command and substitute the result literally — don't wrap it in$(...), which triggers a permission prompt.) - Run
git log <base>..HEAD --onelineto see all commits on this branch - Run
git diff <base>...HEAD --statto see all files changed - Determine which feature area this work relates to (from branch name, commit messages, or changed files)
Step 2: Identify the relevant spec
- Check for
docs/prd/ROADMAP.md— if it exists, identify which phase or item this work relates to - Check for
docs/prd/files that cover the feature area - Check for living documents (domain model, integration guides, runbooks) that describe the current state of the affected models or features
- If no spec exists for this work (e.g., a bug fix or chore with no PRD entry), note that and skip to Step 4
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 84 lines · 20 tokens per session scan A 812c5e7cbc9d
drift-check is a skill published in the GitHub repository joshukraine/dotfiles (429 stars, last pushed 7d ago), licensed MIT. It adds 20 tokens to every session and 1,053 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
review-pr
Review an existing GitHub PR — one verified single-pass read of the diff, inline P1–P3 findings, fixes for the P1/P2s pushed to the PR branch, scoped verification, resolved threads, a summary. Escalates to a two-reader second opinion only for large source changes. Use when asked to review and fix a PR, or to run the…
pr-comments
Fetch, triage, and address PR review comments for the current branch. Use when asked to check PR comments, address review feedback, fix PR comments, or pull PR comments.
simplify
Reviews changed code for reuse, simplification, efficiency and altitude, then applies the fixes. Quality, not correctness bugs.
differential-review
Performs security-focused differential review of code changes (PRs, commits, diffs). Adapts analysis depth to codebase size, uses git history for context, calculates blast radius, checks test coverage, and generates comprehensive markdown reports. Automatically detects and prevents security regressions.
audit-context-building
Enables ultra-granular, line-by-line code analysis to build deep architectural context before vulnerability or bug finding.
verify-behavior
Verify or reproduce visible product behavior by driving the real UI with pi-computer-use's checked tools, requiring verified expect postconditions and durable state evidence for meaningful UI flows. Use when triage needs visual reproduction, implementation needs behavioral proof, review needs interactive confirmation…