Borrowing it
Nothing to install: this file belongs to lukas-grigis/ralphctl. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/lukas-grigis/ralphctl/main/.claude/skills/drift-sweep/SKILL.mdgit clone --depth 1 https://github.com/lukas-grigis/ralphctlWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/lukas-grigis/ralphctl/drift-sweep)<a href="https://agentmods.dev/skills/lukas-grigis/ralphctl/drift-sweep"><img src="https://agentmods.dev/badge/skills/lukas-grigis/ralphctl/drift-sweep.svg" alt="Measured on agentmods" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00181 | $0.01571 |
| Opus 5 | $0.00090 | $0.00785 |
| Sonnet 5 | $0.00036 | $0.00314 |
| Haiku 4.5 | $0.00018 | $0.00157 |
Grade A, and why
drift-sweep scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 95 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Drift Sweep
The .claude/ agent and doc files mirror the shape of src/ — module paths, symbol names, env vars,
command names, version numbers. The code moves every day; these mirrors do not move with it unless someone
makes them. The result is silent drift: an agent confidently points the next session at runtime/mount.tsx
(deleted), a doc cites RALPHCTL_JSON (never shipped), every agent hardcodes v0.7.0 while the repo is at
0.12.x. None of it fails a test, so nothing catches it — until a session follows a dead pointer and wastes
a turn, or a contributor trusts a stale acceptance criterion.
This skill is the cheap, repeatable counter-pressure: a mechanical sweep that surfaces candidates, followed by judgement to confirm them. It is deliberately conservative — a false "this is drift" wastes a fix; a missed one rots quietly. So the script flags, and you verify.
When this earns its keep
- Someone asks to audit, refresh, or clean up
.claude/orCLAUDE.md. - Before a release — stale version stamps and dead paths shipping in docs is avoidable.
- Right after a rename/move under
src/(a sibling renamed, a file relocated, a symbol dropped) — the agent and doc files that named the old shape are now wrong.
How to run it
-
Run the sweep harness to get the candidate list:
bash .claude/skills/drift-sweep/scripts/sweep.shIt scans
CLAUDE.md,.claude/agents/,.claude/docs/, and.claude/skills/(markdown only) and prints candidates grouped into five buckets:- [1] Version stamps — every
vX.Y.Zvspackage.json. Noise is expected here: external tool versions (Claude Code, Copilot CLI) and historical migration notes (v0.6.x → …) are legitimately pinned. A bare current-feature stamp likev0.7.0in a "this is how it works today" sentence is the real target. - [2] Missing paths — referenced
src/,tests/,scripts/files/dirs that no longer exist. Highest signal; a gone path is almost always real drift. - [3] Unread env vars —
RALPHCTL_*named in docs with zero non-test reads insrc/(unshipped or removed). - [4] Known stale patterns — recurring renames (
tests/integration/flows/→…/application/flows/, thesignals/→contract/sibling rename,runtime/mount.tsx,InkPromptAdapter,PromptPort). - [5] Symbol sample — backticked identifiers to spot-check; too noisy to auto-resolve, so pick the load-bearing ones and grep them yourself.
- [1] Version stamps — every
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 7d ago First seen · 95 lines · 181 tokens per session scan A ac860cf3f165
drift-sweep is a skill published in the GitHub repository lukas-grigis/ralphctl (23 stars, last pushed yesterday), licensed MIT. It adds 181 tokens to every session and 1,571 once invoked, about $0.0009 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
atomic-debug
Hypothesis-driven debugging skill. Use when a bug, test failure, crash, or unexpected behavior is reported. Auto-trigger on error pastes or "broken/doesn't work/failing" language. Explicit invocation: /atomic-debug. Output: symptom statement → hypothesis table → cheapest test first → root cause. No symptom-patching.…
system-health
Suggest whether the machine needs a DISK or MEMORY cleanup — and catch the case where Heimdall ITSELF is the hog (runaway orphaned python from the presence keeper). Use when the machine is slow / swapping / laggy, disk or "System Data" is full, memory is exhausted, at the start of a long session, or when the user asks…
ci-self-heal
A diagnostic guide for analysing failed continuous-integration checks. Continuous integration, or CI, automatically tests and builds code changes; this guide classifies failures and suggests fixes without editing the code.
incident-rca
A diagnostic process for producing a structured root-cause analysis of a serious production incident, such as a P0 or P1 outage. It compares logs, measurements, request traces, code changes, and architecture decisions, and gives ranked explanations and actions.
bug-fix
A structured bug-fixing workflow that takes a problem from reproduction and evidence-based cause finding through approval, implementation, testing, and cleanup.
rca
Disciplined root-cause analysis for diagnosing why something is broken. Use whenever the user is debugging a bug, regression, incident, outage, flaky or intermittent behavior, a failing test, or asks "why is X happening" / "why did this break" / "whats causing this" — even if they never say the words "root cause." It…