Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add KongFangXun/sofagent --skill cordis-plugin-sofagent-auditgit clone --depth 1 https://github.com/KongFangXun/sofagentWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/kongfangxun/sofagent/cordis-plugin-sofagent-audit)<a href="https://agentmods.dev/skills/kongfangxun/sofagent/cordis-plugin-sofagent-audit"><img src="https://agentmods.dev/badge/skills/kongfangxun/sofagent/cordis-plugin-sofagent-audit/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/kongfangxun/sofagent/cordis-plugin-sofagent-audit"><img src="https://agentmods.dev/badge/skills/kongfangxun/sofagent/cordis-plugin-sofagent-audit.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00118 | $0.00577 |
| Opus 5.5 | $0.00047 | $0.00231 |
| Sonnet 5.5 | $0.00024 | $0.00115 |
| Haiku 4.5 | $0.00012 | $0.00058 |
Grade A, and why
cordis-plugin-sofagent-audit scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
cordis-plugin-sofagent-audit
变更机器审阅 + 验收硬门禁——28 规则 + git diff 硬证据 + Turn 停止验收判定（验收不过不放行，开关独立可关）（seam: tools/result + tools/pre-execute + fs/write-intent + agent/turn-stopping）
用途
装上之后：工具调用前后各过一道审计——28 条 git diff 硬证据规则 + 危险操作黑名单；Agent 想收尾时先过机器验收判定，不过不放行（验收门禁有独立开关，settings 里可关）。什么时候用：需要「改了什么、谁改的、有没有越界」有硬证据可查，且交付标准明确、不想让 Agent 自述「做完了」就算完。
接入点（seam: tools/result + tools/pre-execute + fs/write-intent + agent/turn-stopping）：桥接 @sofagent/audit，缺依赖时该能力静默跳过；接入形态（声明 / 实现）见 SEAMS.md。验收判定源 = define_acceptance / check_acceptance 两 MCP tool（v1.4.9 P2 吸收原 cordis-plugin-sofagent-gate 验收面，不另造判定源）。
本插件随 sofagent 主线版本发布（SkillHub 通道：skillhub install cordis-plugin-sofagent-audit 安装与检索；npm 通道未开通）。版本号与 sofagent 主线对齐。
相关链接
- sofagent 主仓：https://github.com/KongFangXun/sofagent
- 开发日志：docs/changelog/v1.4/v1.4.0.md（DSH 插件家族）
What ships with it
5 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago Changed 1d3109da8bb2
- 10d ago Changed 9bf9f22b9773
- 13d ago Changed 363f6f0d7e91
- 16d ago Changed 5927a11afd1d
- 17d ago Changed f134bc5571b2
- 21d ago Changed a0fe9fc8d4bb
- 24d ago Changed a2e67c216acd
- 26d ago Changed a3991652ba27
- 29d ago Changed ba40d88f218d
- 1mo ago First seen · 26 lines · 118 tokens per session scan A b792687b9f63
cordis-plugin-sofagent-audit is a skill published in the GitHub repository KongFangXun/sofagent (54 stars, last pushed 4d ago), licensed MIT. It adds 118 tokens to every session and 577 once invoked, about $0.0005 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
github-comment
Add a comment to a GitHub issue or pull request.
review-implement-phase
Implements triaged review actions, commits focused fixes, and posts Done plus resolves threads. Use when the user wants only the implementation phase of the review-framework workflow.
no-bare-casts
Writing as in TypeScript or TSX production code, modifying a file that contains a bare as cast, silencing a type error with a cast, encountering as unknown as, or reviewing a cast site.
update-pr
Update the pull request for the current session. Use when the user wants to push new changes to an existing PR.
performance-lint-rules
Performance review guidance for Oxc linter rule implementations. Use only when reviewing Rust rule code under crates/oxclinter/src/rules/ or when explicitly auditing those rules for performance improvements.
adversarial-reviewer
Stress-test a code change for concrete correctness defects, unsafe assumptions, and failure modes. Use when the user explicitly asks for an adversarial review, a deep bug hunt, or to tear a change apart, or to check your own change before submitting it. Do not use for ordinary review, style feedback, or general…