Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/melodic-software/claude-code-plugins/audit-install-statenpx skills add melodic-software/claude-code-plugins --skill audit-install-stategit clone --depth 1 https://github.com/melodic-software/claude-code-pluginsWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00222 | $0.03557 |
| Opus 5 | $0.00111 | $0.01778 |
| Sonnet 5 | $0.00044 | $0.00711 |
| Haiku 4.5 | $0.00022 | $0.00356 |
Grade A, and why
audit-install-state scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
Any claim about what Claude Code itself does must come from the raw markdown endpoint. `curl -sSL` How it starts
The opening of the file, as written. The whole thing — 233 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Purpose
Answers four questions about a Claude Code installation, and refuses to answer a fifth.
- What is actually here? Every entry labelled automatically as an authored surface or a bulk tree, so a ~100k-file tree does not drown a ~150-file answer. Per-file rows live in the CSV.
- What does the product already manage? Claude Code runs its own retention sweep. Recommending a manual prune of a path it owns generates churn, not space.
- For each number in a filename. What IS that number? A liveness lookup against a TCP port or a
shell
$$returns a clean, confident, wrong "dead." - Is this tree in a deliberate or experimental state? If it is, "looks like decay" is the wrong reading of almost everything.
The fifth question, so what should I delete?, is deliberately not answered. This skill is
report-only and never writes to the target tree. Deletion belongs to /disk-hygiene:clean, and
shedding project state belongs to claude project purge.
Scope boundary
| Question | Owner |
|---|---|
| Is this machine's Claude Code install directory healthy? | this skill |
| Are a repo's project-scope config FILES correct? | /claude-config:audit |
| Are permission grants portable and durable? | /claude-config:audit-permission-grants |
| Is the plugin fleet current, and at what scope? | /claude-ops:plugins audit |
| Delete a genuinely unmanaged leftover | /disk-hygiene:clean |
Full rationale for every scope decision, and where each finding hands off: reference/scope-and-handoffs.md.
Boundary, the bundled doctor skill
One native Claude Code surface asks a question that sounds like this skill's, and the two are routinely conflated:
doctor(bundled skill, aliascheckup). Ships with Claude Code rather than as a marketplace plugin. It health-checks an installation and offers to fix what it finds: installation problems, unused extensions, duplicated or bloated memory files, slow hooks, updates, permissions. It also estimates what the skill listing costs in context. It is the one bundled skilldisableBundledSkillsdoes not remove;DISABLE_DOCTOR_COMMAND=1or askillOverridesentry hides it instead.- This skill (marketplace plugin), the deep read-only inventory of the install tree: every file classified, product-managed retention separated from genuinely unmanaged state, filename schemes resolved before any liveness check, and a deliberate-or-experimental state detected before anything is called stale.
What ships with it
8 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 233 lines · 222 tokens per session scan A e363cc9d06df
audit-install-state is a skill published in the GitHub repository melodic-software/claude-code-plugins (13 stars, last pushed today), licensed MIT. It adds 222 tokens to every session and 3,557 once invoked, about $0.0011 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
deep-research
Conducts iterative deep research on any topic using web search, progressive exploration, and structured synthesis. Use when asked for comprehensive research, deep investigation, thorough analysis, or multi-source exploration of any topic. Triggers: research, investigate, deep dive, comprehensive analysis, explore…
error-ux
Principles and patterns for writing error messages that help users recover. Use when auditing, writing, or improving error messages in code. Triggers: error messages, user experience, error handling, exception messages, validation errors.
adversarial-patterns
Library of realistic adversarial attack vectors and anti-patterns to avoid. Contains examples of valid attacks and subtle gaming patterns to reject.
documentation-testing
Provides heuristics for identifying incomplete or broken documentation. Use when validating README setup instructions, testing onboarding flows, or auditing documentation quality. Triggers: docs, readme, onboarding, setup validation, documentation audit.
adversarial-analysis
Analyze code to identify explicit contracts, implicit usage patterns, and realistic boundary conditions. Contains concrete formulas for calculating input realism limits. Use before generating adversarial tests.
build-expression-tree
For symbolic computation: ASTs, mathematical expressions, code that manipulates code structure, expression transformations.