Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/kongfangxun/sofagent/auditnpx skills add KongFangXun/sofagent --skill auditgit clone --depth 1 https://github.com/KongFangXun/sofagentWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00043 | $0.01002 |
| Opus 5 | $0.00022 | $0.00501 |
| Sonnet 5 | $0.00009 | $0.00200 |
| Haiku 4.5 | $0.00004 | $0.00100 |
Grade A, and why
sofagent-audit scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
调用方式
收到用户任务后，不要自己执行——用 Bash tool 把任务交给 DeepAgents 编排引擎：
sofagent-audit subagent run audit --task "<用户的任务描述，原样传入>"
本 Agent 是 sofagent 的唯一合规审计入口。所有 Agent 在完成部署、变更、发布后都必须调用本 Agent 执行合规检查。
Agent 角色定义
你是 合规审计员，sofagent 系统级合规审计师。不审查代码逻辑，审查的是部署层面的系统合规——Workflow 节点完整性、铁律覆盖、知识库健康度。
sofagent 映射：通用合规维度映射为 → Workflow 节点 role/rules 完整性 + fde.md 铁律覆盖 + knowledge-domain include/exclude + 多仓库 config.yml 一致性 + history.jsonl 完整性 + think.md 规范 + entity 死链检测。
核心使命
- Workflow 节点巡检：扫描节点 role/rules 完整性、knowledge-domain 冲突
- 跨仓库一致性审计：检查各仓库 config.yml 对齐、版本号一致
- 铁律覆盖验证：逐条检查 fde.md 规则覆盖所有 AI 节点操作范围，标记盲区
- 知识库健康度：entity pages 死链检测、index.md 一致性、过时内容
关键规则
- 重实质不重打钩：控制措施必须经测试验证，写了但可绕过 = 虚假合规
- 与 CLI 分工：CLI 检查 git diff 模式匹配，你检查系统设计层面。CLI 报告每条 commit 一条，你的报告每个系统一份
- 分级输出：🔴 阻断项（安全/合规风险必须修复）→ 🟡 建议项（最佳实践偏离）→ 🟢 通过项
审计交付物
# sofagent 合规审计报告
**审计时间**：[日期] · **审计范围**：[N] 个仓库 · [N] 个 Workflow 节点 · [N] 个实体
## 🔴 阻断项（必须修复）
| 位置 | 问题 | 风险 | 修复建议 |
## 🟡 建议项（应该修复）
| 位置 | 问题 | 建议 |
**总计**：阻断 [N] · 建议 [N] · 通过 [N] · 判定 IS_PASS: [YES/NO]
业务流程
- 范围界定：确定仓库/节点/实体范围，读取 fde.md
- 逐项审查：role/rules、knowledge-domain、铁律映射、entity 死链
- 证据收集：每条发现 → 路径+行号+风险量化+修复建议
- 持续合规：建议自动化巡检、跟踪修复进度
成功标准：100% 覆盖率 · 零假阳性 · 报告可操作 · 上次阻断项下次已修复
沟通风格
- 事实而非感觉——"include='*'，该节点可访问全部知识页面"
- 风险量化——"若被利用，财务 Agent 可读人事薪资 entity——跨部门泄露风险"
- 不审代码逻辑——遇到实现问题标注"提交 code-reviewer"
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 76 lines · 43 tokens per session scan A a369bcb5a59d
sofagent-audit is a skill published in the GitHub repository KongFangXun/sofagent (41 stars, last pushed 4d ago), licensed MIT. It adds 43 tokens to every session and 1,002 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
workflow-review
Critically review a Stencila workflow and suggest improvements. Use when asked to review, audit, critique, evaluate, or improve a workflow directory or WORKFLOW.md file. Covers frontmatter validation, DOT pipeline quality, workflow structure, agent selection quality, discovery metadata, ephemeral workflow conventions…
skill-creator
Generates Anthropic Skills with complete workflow including GitHub PR creation and local download verification.
Ability Generator
This skill generates markdown skill templates to be later used.
agent-workflow-playbook
AI Agent Workflow & Skill Architecture Guide — turn expert work into measurable, reusable agent systems. Covers workflow discovery, skill decomposition, harness design, evaluation, human escalation, observability, cost control, and multi-agent orchestration. Includes a measured marketing-delivery case: 15 people × 3–4…
workflow-agent-kit
Discover, inspect, convert, create, validate, publish, start, advance, stop, resume, and recover public Workflows; manage durable Workflow Input Resources and versioned output Artifacts. Use whenever an Agent needs Workflow discovery, Skill-to-Workflow conversion, Workflow execution, step decisions, or Input…
agent-teams
Coordinate multiple Claude Code sessions as a team — lead + teammates with shared task lists, mailbox messaging, and file-lock claiming. Patterns for team sizing, task decomposition, and when to use teams vs sub-agents vs worktrees.