Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/luiseiman/dotforge/audit-projectnpx skills add luiseiman/dotforge --skill audit-projectgit clone --depth 1 https://github.com/luiseiman/dotforgeWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00026 | $0.03023 |
| Opus 5 | $0.00013 | $0.01511 |
| Sonnet 5 | $0.00005 | $0.00605 |
| Haiku 4.5 | $0.00003 | $0.00302 |
Grade A, and why
audit-project scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 203 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Audit Project
Run a full audit of the Claude Code configuration for the current project.
Step 1: Detect stack
Use detection rules from $DOTFORGE_DIR/stacks/detect.md.
Step 1b: Detect project tier
Auto-detect project tier based on signals:
- simple (<5K LOC, 1 stack, no CI config): recommended items are relaxed (items 8-10 don't penalize)
- standard (5K-50K LOC, 1-2 stacks): default behavior
- complex (>50K LOC, 3+ stacks, monorepo indicators like
packages/orapps/): recommended items 8-10 become semi-obligatory (each worth 0-2 instead of 0-1)
Detection signals:
- LOC: count non-empty lines in source files (
find . -name '*.py' -o -name '*.ts' -o -name '*.js' -o -name '*.go' -o -name '*.java' -o -name '*.swift' | xargs wc -l) - Stack count: number of stacks detected in step 1
- CI: presence of
.github/workflows/,.gitlab-ci.yml,Jenkinsfile,.circleci/ - Monorepo: presence of
packages/,apps/,lerna.json,pnpm-workspace.yaml,turbo.json
Save tier in registry entry.
Step 1c: Config coherence check
Before scoring, validate internal coherence. Run $DOTFORGE_DIR/tests/test-config.sh <project-dir> or perform equivalent checks inline:
- Hooks referenced in settings.json exist and are executable
- Rules have valid
globs:orpaths:frontmatter (withalwaysApply: falsefor lazy loading) - Rule globs match at least 1 real file in the project
- settings.json is valid JSON with deny list covering .env, *.key, *.pem
- CLAUDE.md has minimum required sections (stack, build/test, architecture)
- No contradictory allow+deny patterns in settings.json
- No prompt injection patterns in rules or CLAUDE.md
If coherence check finds critical failures (missing hooks, invalid JSON), report them in a ── COHERENCE ── section BEFORE the score. These are configuration bugs, not gaps.
Step 2: Load checklist
Read $DOTFORGE_DIR/audit/checklist.md for evaluation criteria.
Read $DOTFORGE_DIR/audit/scoring.md for weights and caps.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 203 lines · 26 tokens per session scan A 9fdb791d512a
audit-project is a skill published in the GitHub repository luiseiman/dotforge (8 stars, last pushed 2mo ago), licensed MIT. It adds 26 tokens to every session and 3,023 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
factory-llm-workflows
LLM workflow conventions distilled from production agent/RAG work. Covers LangGraph TypedDict state schemas, node factory closures, conditional edge routing, structured output via JSON schema, prompt fallback patterns with optional PromptHub override, hybrid search with confidence gating + fallback supplement, SSE…
factory-llm-workflow-engineer
Use when building LangGraph workflows, agents, RAG systems, structured-output nodes, streaming chat surfaces, or anything LLM-driven with state. Carries the factory's LLM conventions — TypedDict state schemas, node factory closures, named conditional-edge routers, JSON-schema structured output, local-prompt-fallback…
prompt-optimizer
Analyzes draft prompts, identifies gaps, matches available skills/agents, and recommends optimal workflows. Advisory only — never executes, only optimizes. Use when unsure which skills or approach to use for a task.
export-rules
Export Claude Hangar skills and rules to other AI coding tool formats. Use when: "export rules", "cursor rules", "windsurf rules", "export-rules", "convert to mdc".
rules-distill
Scans all skills and rules to extract cross-cutting principles that should become shared rules. Meta-governance tool for keeping rules synchronized with growing skill collections.
codebase-map
Generate a structural overview of the codebase for context recovery. Use when: "map", "codebase map", "overview", "orient", "what is this project", or after /compact.