Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/melodic-software/claude-code-plugins/audit-instructionsnpx skills add melodic-software/claude-code-plugins --skill audit-instructionsgit clone --depth 1 https://github.com/melodic-software/claude-code-pluginsWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00201 | $0.05492 |
| Opus 5 | $0.00101 | $0.02746 |
| Sonnet 5 | $0.00040 | $0.01098 |
| Haiku 4.5 | $0.00020 | $0.00549 |
Grade A, and why
audit-instructions scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks the agent to reveal its instructionslowSystem prompt leakage
Directions to print, repeat or translate the system prompt extract configuration the operator did not intend to expose.
marker), I10 (reasoning-echo directives), the I8 families under per-family ids: `I8-a` Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.
How it starts
The opening of the file, as written. The whole thing — 337 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Purpose
Audit whether the instructions you have written for Claude Code are still earning their context cost against current model capability. As models improve, prior-model-era scar tissue accretes: workarounds for mistakes the model no longer makes, prescriptive step lists that now constrain more than they help, bare prohibitions, and show-your-thinking directives. This skill sweeps the locally-owned instruction surfaces, cites each finding to current official prompting doctrine, tiers it by how confident the evidence can be, and packages proposed removals or rewrites as a human-gated diff, so instruction surfaces shrink as models get better instead of only ever growing.
The check catalog, covering the checks I1–I29, their evidence tier, authority tag, severity,
per-surface applicability, and the OPINION-tier enablement policy, lives in
reference/criteria.md; the deterministic pre-scan is
${CLAUDE_PLUGIN_ROOT}/skills/audit-instructions/scripts/instruction-scan.sh.
One check has a different unit of judgment, do two surfaces contradict each other, and Phase B2
answers it against reference/conflict-criteria.md.
Read-only contract
This skill is report-only. There is no --fix: instruction files are the operator's voice, so
every change is applied by the human (or explicitly delegated afterward), never by this skill.
Diffs are proposed artifacts. A clean audit is a valid outcome.
disallowed-tools: Edit, NotebookEdit narrows the surface; it does not make the contract
mechanical. Write stays for the Phase D persist and Bash for the pre-scans, and either can mutate
a file this skill has already read, so this is an instruction-held contract with a narrowed accident
surface, not an enforced one. Never describe it to an operator as a guarantee. The restriction clears
on their next message (https://code.claude.com/docs/en/skills, frontmatter reference, fetched
2026-08-12), so whoever accepts a diff can apply it. audit-prompting-postures carries the identical
declaration and the identical caveat, because the two state the same contract and drifting on it is
the shape of defect this pair keeps producing.
What ships with it
22 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- context/persist-findings.md 9.2 KB
- context/phase-a-inventory.md 13 KB
- context/report-keying.md 2.1 KB
- evals/evals.json 28 KB
- evals/fixtures/description-restatement.md 277 B
- evals/fixtures/frontmatter-emphasis.md 256 B
- evals/fixtures/inline-fence-not-section.md 325 B
- evals/fixtures/partial-overlap.md 316 B
- evals/fixtures/protected-content.md 1.1 KB
- evals/fixtures/quoted-trigger-restatement.md 367 B
- evals/fixtures/quoted-trigger.md 298 B
- evals/fixtures/sibling-restatement.md 582 B
- reference/conflict-criteria.md 47 KB
- reference/criteria.md 141 KB
- scripts/conflict-scan.sh 15 KB runs code
- scripts/conflict-scan.test.sh 18 KB runs code
- scripts/emit-findings.sh 23 KB runs code
- scripts/emit-findings.test.sh 36 KB runs code
- scripts/instruction-scan.sh 14 KB runs code
- scripts/instruction-scan.test.sh 16 KB runs code
- scripts/restatement-scan.py 11 KB runs code
- scripts/restatement-scan.test.sh 4.2 KB runs code
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 337 lines · 201 tokens per session scan A fefcbb0a6d3b
audit-instructions is a skill published in the GitHub repository melodic-software/claude-code-plugins (13 stars, last pushed today), licensed MIT. It adds 201 tokens to every session and 5,492 once invoked, about $0.0010 per session on Opus 5. A static security scan graded it A with 1 finding (asks the agent to reveal its instructions). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
deep-research
Conducts iterative deep research on any topic using web search, progressive exploration, and structured synthesis. Use when asked for comprehensive research, deep investigation, thorough analysis, or multi-source exploration of any topic. Triggers: research, investigate, deep dive, comprehensive analysis, explore…
error-ux
Principles and patterns for writing error messages that help users recover. Use when auditing, writing, or improving error messages in code. Triggers: error messages, user experience, error handling, exception messages, validation errors.
adversarial-patterns
Library of realistic adversarial attack vectors and anti-patterns to avoid. Contains examples of valid attacks and subtle gaming patterns to reject.
documentation-testing
Provides heuristics for identifying incomplete or broken documentation. Use when validating README setup instructions, testing onboarding flows, or auditing documentation quality. Triggers: docs, readme, onboarding, setup validation, documentation audit.
adversarial-analysis
Analyze code to identify explicit contracts, implicit usage patterns, and realistic boundary conditions. Contains concrete formulas for calculating input realism limits. Use before generating adversarial tests.
match-stable-pairs
For two-sided matching: hospital-resident, stable marriage, college admissions. Gale-Shapley algorithm for stable matching with preferences.