Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add mblode/agent-skills --skill dx-auditgit clone --depth 1 https://github.com/mblode/agent-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/mblode/agent-skills/dx-audit)<a href="https://agentmods.dev/skills/mblode/agent-skills/dx-audit"><img src="https://agentmods.dev/badge/skills/mblode/agent-skills/dx-audit/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/mblode/agent-skills/dx-audit"><img src="https://agentmods.dev/badge/skills/mblode/agent-skills/dx-audit.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 2 findings, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium MCP Rug Pull · line 51 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 51 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00054 | $0.02289 |
| Opus 5.5 | $0.00022 | $0.00916 |
| Sonnet 5.5 | $0.00011 | $0.00458 |
| Haiku 4.5 | $0.00005 | $0.00229 |
Grade A, and why
dx-audit scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 147 lines — stays where its author put it; the contents beside it link to each section on GitHub.
DX Audit
Audit or improve what developers import, run, configure, or read when something fails.
- IS: a bounded review of public APIs, developer-facing errors, CLI commands, exported types, install and first-run behavior, and config, with fixes only when asked.
- IS NOT: a repo-wide quality sweep (
tidy), end-user UI (ui-designAudit mode), agent trust review (ax-audit), public site or docs agent scores (agent-ready), docs prose or a README (ghostwriter), repository architecture (codebase-architecture), or building a new CLI (scaffold-cli).
Modes
Pick the narrowest mode the request supports, and write a one-line scope receipt before reading code:
| Mode | When | Output |
|---|---|---|
| Targeted (default) | a named or changed public surface | findings report, read-only |
| Fix | the user says fix, improve, simplify, or implement | localized edits inside the receipt, then verification |
| Exhaustive | the user explicitly asks for the whole package or every public surface | every material finding, partitioned by surface |
Scope: <mode>; surfaces: <commands/exports/config>; prefixes: <err-, cli->; excludes: <UI, docs, architecture, private internals>
"DX", "gold standard", and "review holistically" do not by themselves widen a targeted audit into exhaustive. When several skills are invoked together, this one owns only the surfaces above.
Audit progress
DX audit progress:
- [ ] 1. Lock the public surface and write the scope receipt
- [ ] 2. Gather local evidence and run the safe probes
- [ ] 3. Select prefixes, then open candidate rules
- [ ] 4. Rank root causes
- [ ] 5. Report, or fix when asked
- [ ] 6. Verify on the same scope
1. Lock the public surface
Start from git diff against the normal base and keep only changed files reachable from a public entry point: package.json exports or bin, a command registry, an exported type, a documented config loader, or an observed error path. With no useful diff, use the command, export, error, or config the user named. A private helper enters scope only through a public caller.
What ships with it
43 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- evals/evals.json 1.6 KB
- evals/evaluation-scenarios.md 3.4 KB
- references/standards-map.md 4.6 KB
- rules/_sections.md 2.9 KB
- rules/_template.md 616 B
- rules/api-argument-order.md 993 B
- rules/api-async-consistency.md 1.3 KB
- rules/api-naming-consistency.md 1.1 KB
- rules/api-no-hidden-side-effects.md 1.2 KB
- rules/api-predictable-return-shape.md 939 B
- rules/api-sensible-defaults.md 1.1 KB
- rules/api-stable-contract.md 1.6 KB
- rules/cli-agent-input-hardening.md 1.5 KB
- rules/cli-delta-polling.md 1.3 KB
- rules/cli-exit-codes.md 1.3 KB
- rules/cli-flag-naming.md 944 B
- rules/cli-help-and-version.md 1.1 KB
- rules/cli-idempotent-resume.md 1.2 KB
- rules/cli-order-independent-flags.md 793 B
- rules/cli-pipes-tty-and-json.md 1.4 KB
- rules/cli-responsive-and-progress.md 1.0 KB
- rules/cli-safe-mutations.md 1.4 KB
- rules/cli-schema-introspection.md 1.2 KB
- rules/cli-structured-io.md 1.6 KB
- rules/cli-suggest-corrections.md 969 B
- rules/config-optional-with-defaults.md 1.1 KB
- rules/config-validate-and-discover.md 1.3 KB
- rules/config-xdg-and-precedence.md 1.1 KB
- rules/err-fail-fast-validation.md 1.0 KB
- rules/err-name-cause-and-value.md 786 B
- rules/err-no-raw-stack-as-message.md 1017 B
- rules/err-stable-error-codes.md 1.4 KB
- rules/err-suggest-the-fix.md 765 B
- rules/onboard-exports-resolve-typed.md 1.8 KB
- rules/onboard-minimal-install.md 1.0 KB
- rules/onboard-no-required-env.md 1.1 KB
- rules/onboard-tree-shakeable.md 1.3 KB
- rules/onboard-zero-config-quickstart.md 1.1 KB
- rules/types-discriminated-unions.md 1013 B
- rules/types-helpful-generics.md 922 B
- rules/types-no-leaked-any.md 898 B
- rules/types-prefer-inference.md 869 B
- rules/types-public-jsdoc.md 1.0 KB
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago Changed 209c7460cf98
- 23d ago Changed · -3 lines · -28 tokens per session 8555745e5997
- 1mo ago Changed · -1 lines · +1 tokens per session ba39a34afabd
- 1mo ago Changed · +1 lines · +5 tokens per session a4ec8e628371
- 1mo ago Changed · -48 lines · -118 tokens per session 9e2d6aa1b99e
- 1mo ago First seen · 198 lines · 194 tokens per session scan A 4f744b0b09b5
dx-audit is a skill published in the GitHub repository mblode/agent-skills (167 stars, last pushed yesterday), licensed MIT. It adds 54 tokens to every session and 2,289 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
impact
Use when asked what a change could break or affect, "is this safe to commit/push/merge?", "what does this break?", or before committing a multi-file change — the callers outside the diff, the tests guarding them, and the contracts the change crosses.
scrutinize
Ultrathink principal-engineer review gate. Runs a Validate-Identify-Improve-Adjust (VIIA) pass over a target - a plan awaiting approval, just-executed work, a specific file or directory, or the entire workspace - then runs an adversarial refutation layer (Phase 2.5) with cross-family judge rotation (Claude, Kimi k3…
systematic-debugging
4-phase root cause debugging: understand bugs before fixing.
cpp-coding-standards
C++ coding standards based on the C++ Core Guidelines (isocpp.github.io). Use when writing, reviewing, or refactoring C++ code to enforce modern, safe, and idiomatic practices.
node-inspect-debugger
Debug Node.js via --inspect + Chrome DevTools Protocol CLI.
pr-lens
Draw code changes as animated architecture/data-flow SVGs.