Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add kurone-kito/idd-skill --skill idd-spec-auditgit clone --depth 1 https://github.com/kurone-kito/idd-skillWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/kurone-kito/idd-skill/idd-spec-audit)<a href="https://agentmods.dev/skills/kurone-kito/idd-skill/idd-spec-audit"><img src="https://agentmods.dev/badge/skills/kurone-kito/idd-skill/idd-spec-audit/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/kurone-kito/idd-skill/idd-spec-audit"><img src="https://agentmods.dev/badge/skills/kurone-kito/idd-skill/idd-spec-audit.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00094 | $0.02320 |
| Opus 5.5 | $0.00038 | $0.00928 |
| Sonnet 5.5 | $0.00019 | $0.00464 |
| Haiku 4.5 | $0.00009 | $0.00232 |
Grade A, and why
idd-spec-audit scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 190 lines — stays where its author put it; the contents beside it link to each section on GitHub.
IDD Spec Audit
scripts/audit-docs.mjs catches byte-level drift — sync-pair mismatches,
budgets, config-vs-instruction agreement — but not semantic drift: prose
that contradicts a sibling file, leaked session context, passages that
are not completable from a cold read, or wording that stalls an
autonomous step. This skill runs that check as N parallel LLM read
passes, adapted from mew-ton/soloscrum's define-pr-lifecycle audit
model.
Scope
- Audit targets (findings may cite these):
.github/instructions/**/*.md(includinglite/), the issue-authoring skill bundle at its installed location, and every agent entry file present in this installation (CLAUDE.md,AGENTS.md,GEMINI.md, and.github/copilot-instructions.md). All but the first are conditional on the adopter's own setup: onboarding creates each entry file unless the operator explicitly opted out of it, the issue-authoring companion is opt-in, and.github/copilot-instructions.mdis touched only if it already existed — skip an audit target that does not exist in the current installation rather than fail the run over it. Cover every present entry file, not justCLAUDE.md: onboarding requiresCLAUDE.md,AGENTS.md, andGEMINI.mdto agree on repository-specific guidance, so a cross-file contradiction (R2) or a restatement-scope drift (R5) can land in any of them. Audit every target that does exist regardless of whether this installation happens to regenerate it from an upstream source (for example, this source repository regenerates.github/instructions/**fromidd-template/viaaudit/sync-manifest.json) — this skill audits the corpus a worker session actually reads, not any upstream source, so being a regenerated target never exempts a file here. - Reference-only inputs (read for R2/R4, never a finding target):
docs/idd-concept-ownership.md(R2's closed concept-index seed) anddocs/idd-autonomy-contract.md(R4's reversible/irreversible classification baseline), both atdocs/in an installed repository. Both are read in full every pass. - Out of scope as an audit target / finding source: this skill's
own bundle wherever it is installed (
skills/idd-spec-audit/**— the skill necessarily reads its own bundle, thisSKILL.mdandreferences/report-template.md, to run at all, but no finding ever cites a file there); any generated mirror tree in this installation, if one exists (for example, in this source repository,.claude/**, since every file there mirrors a canonical source elsewhere); and every other file underdocs/**besides the two reference-only inputs above (summary docs rely on the files they cite by design, so they are not audited as if they were the primary spec).
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago Changed bb820aa57018
- 1mo ago Changed c0dce4a7e760
- 1mo ago Changed · +8 lines · -6 tokens per session a597ec141307
- 1mo ago First seen · 182 lines · 100 tokens per session scan A e74b29a7628e
idd-spec-audit is a skill published in the GitHub repository kurone-kito/idd-skill (11 stars, last pushed today), licensed MIT. It adds 94 tokens to every session and 2,320 once invoked, about $0.0004 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
understand-diff
Use when you need to analyze git diffs or pull requests to understand what changed, affected components, and risks.
code-reviewer
Use when asked to review, check or diagnose Spring Boot code: a pull request, diff, module or file before it merges; a slow endpoint or query (N+1, unbounded reads, JPA and Hibernate performance); security, JSpecify null-safety, architecture boundaries or Boot 4 migration risks in existing code; or whether the tests…
auto-test-code
A structured process for critically reviewing and testing software code. It records review findings, test plans, commands, results, and supporting files in a project workspace.
git-pr-review
A read-only reviewer for GitHub pull requests, which are proposed code changes submitted for review. It produces an evidence-based report about whether a pull request should be merged.
review
Plan-aware graph-enhanced code review before merge. CRITICAL issues block merge. Use after fix/verify.
flutter-dart-code-review
Library-agnostic Flutter/Dart code review checklist covering widget best practices, state management patterns (BLoC, Riverpod, Provider, GetX, MobX, Signals), Dart idioms, performance, accessibility, security, and clean architecture.