Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/kvdm-co-pilot/create-cmpnpx agentmods add skills/kvdm-co-pilot/create-cmp/cmp-auditWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/kvdm-co-pilot/create-cmp/cmp-audit)<a href="https://agentmods.dev/skills/kvdm-co-pilot/create-cmp/cmp-audit"><img src="https://agentmods.dev/badge/skills/kvdm-co-pilot/create-cmp/cmp-audit/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/kvdm-co-pilot/create-cmp/cmp-audit"><img src="https://agentmods.dev/badge/skills/kvdm-co-pilot/create-cmp/cmp-audit.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00157 | $0.02245 |
| Opus 5.5 | $0.00063 | $0.00898 |
| Sonnet 5.5 | $0.00031 | $0.00449 |
| Haiku 4.5 | $0.00016 | $0.00225 |
Grade A, and why
cmp-audit scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 26d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 159 lines — stays where its author put it; the contents beside it link to each section on GitHub.
cmp-audit — interrogate one subsystem until it confesses
Your job: take one subsystem and try to break it on paper — the audit that finds the bugs the lane structurally cannot, because they live below the JVM seam (platform scheduling, notification delivery, process lifecycle) or between clauses the spec never wrote. The output is evidence, not vibes: every finding is a file:line and a concrete failure scenario, survived a refuter pass, and lands in the project's normal change flow.
1. Scope — one subsystem, three bodies of evidence
The user names the subsystem ("the notifications", "reminders", "sync") or you infer it from their words — confirm the inference in one sentence before reading. Then read, completely:
- Its spec clauses — every
specs/*.spec.mdclause that governs the subsystem's behavior (and note what the spec is silent about; silence is where defects live). - Its implementation across ALL source sets —
commonMainANDandroidMain/iosMain. Platform code is where desktop-tier tests cannot see; an audit that reads only common code audits the part that was already testable. - Its tests — which clauses they cite, which source set they run in, and therefore which claims are actually exercised versus merely asserted in prose.
2. Interrogate — the platform-semantics question bank
Ask these against the code you just read. They are questions, not checkboxes: each one is answered with a file:line or with "not applicable because …" — never with a tick.
IDENTITY — do two logical things ever share one platform identity?
- Android
PendingIntentequality is requestCode +filterEquals— extras do not count. Do two logically distinct intents differ only in extras? - Notification identity is tag+id. Can two different logical notifications compute the same pair and overwrite each other?
- Alarm/job/work identity: is the id derived from the domain key, or from something that collides (a constant, an index, a truncated hash, an id that gets reused after delete)?
- If identity is derived from a mutable field, what happens when that field changes — does the old identity leak, unreachable?
- Is there a documented id-space partition, or could two features' ids collide?
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 26d ago Changed · +1 lines f0d883c00db7
- 1mo ago Changed · -5 lines · -78 tokens per session 34861ffd179b
- 1mo ago First seen · 163 lines · 235 tokens per session scan A 48fcb59b7b6d
cmp-audit is a skill published in the GitHub repository kvdm-co-pilot/create-cmp (0 stars, last pushed 9d ago), licensed MIT. It adds 157 tokens to every session and 2,245 once invoked, about $0.0006 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
compose-multiplatform
Use when building one shared Compose UI in Kotlin across Android, iOS, and desktop — commonMain @Composables, expect/actual, source-set placement, native interop, multiplatform ViewModel/navigation/Koin. NOT a single-platform native build (that is kotlin-android / swift-ios), and NOT Dart/Flutter cross-platform UI…
m3-expressive
Material 3 Expressive design patterns for Jetpack Compose - expressive theming, motion physics, shape morphing, typography emphasis, color emphasis, and all 28 expressive components.
liquid-glass
Apple Liquid Glass design patterns for SwiftUI iOS 26 - glass effects, morphing, containers, interactive glass, tinting, accessibility, and cross-platform glass design.
android-device-integrity
Android app/device integrity and anti-fraud for a fintech app — the Play Integrity API (com.google.android.play:integrity): Standard requests (StandardIntegrityManager.prepareIntegrityToken → StandardIntegrityTokenProvider.request with a requestHash → StandardIntegrityToken) vs Classic requests…
offline-first
Offline-first architecture patterns - NetworkBoundResource, sync strategies, conflict resolution, cache invalidation, and connectivity monitoring.
app-store-review
Audit an iOS app's App Store submission readiness and rejection risk for a fintech app — App Review Guidelines domains (Safety/Performance/Business/Design/Legal), PrivacyInfo.xcprivacy (NSPrivacyAccessedAPITypes required-reason APIs, NSPrivacyTrackingDomains, NSPrivacyCollectedDataTypes), App Privacy nutrition labels…