Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/melodic-software/claude-code-plugins/audit-native-overlapnpx skills add melodic-software/claude-code-plugins --skill audit-native-overlapgit clone --depth 1 https://github.com/melodic-software/claude-code-pluginsWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00260 | $0.04217 |
| Opus 5 | $0.00130 | $0.02108 |
| Sonnet 5 | $0.00052 | $0.00843 |
| Haiku 4.5 | $0.00026 | $0.00422 |
Grade A, and why
audit-native-overlap scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
Any claim about what Claude Code itself ships must come from the raw markdown endpoint. `curl -sSL` How it starts
The opening of the file, as written. The whole thing — 296 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Purpose
Answers one question: which of this repository's components now overlap something Claude Code ships itself, and what should each one do about it?
Claude Code's own surface moves every week. A skill written when no bundled equivalent existed can wake up duplicating one, and nothing in the product says so. Plugin skills are namespaced, so a native surface never shadows ours and the collision is silent. The model then picks between two overlapping capabilities from descriptions alone.
This skill makes the overlap visible, records a human verdict per pair in a committed store, and, only when asked, bakes the resulting routing guidance into the components themselves.
Three things it is not: it is not an availability oracle (nothing here asserts a native surface is present in anyone's session), it is not a verdict engine (every verdict is a human's), and it is not a fleet editor (bare invocation mutates nothing at all).
Scope boundary
| Question | Owner |
|---|---|
| Which of our components overlap a native surface, and what should they say about it? | this skill |
| What can this machine actually invoke, and where did each thing come from? | /claude-ops:inventory |
| Is this machine's install directory healthy? | /claude-ops:audit-install-state |
| Is the plugin fleet current, and at what scope? | /claude-ops:plugins audit |
| What changed in the last CLI release? | /claude-ops:changelog |
| Do our MCP tools duplicate each other or the built-ins? | /mcp-tools:audit |
| Is this SKILL.md structurally sound, and is the listing over budget? | /skill-quality:check |
| Is each installed skill actually VISIBLE to the model right now, and why not? | /claude-ops:audit-skill-visibility |
The line that matters most: inventory enumerates what resolves; this skill compares that
surface against what we ship and produces a routing verdict. Inventory never judges; this skill
never enumerates for its own sake.
The two substrates, named
What ships with it
5 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- today Changed · +2 lines 29970cbb010d
- 2d ago First seen · 294 lines · 260 tokens per session scan A fbe76fdf7998
audit-native-overlap is a skill published in the GitHub repository melodic-software/claude-code-plugins (13 stars, last pushed today), licensed MIT. It adds 260 tokens to every session and 4,217 once invoked, about $0.0013 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
deep-research
Conducts iterative deep research on any topic using web search, progressive exploration, and structured synthesis. Use when asked for comprehensive research, deep investigation, thorough analysis, or multi-source exploration of any topic. Triggers: research, investigate, deep dive, comprehensive analysis, explore…
error-ux
Principles and patterns for writing error messages that help users recover. Use when auditing, writing, or improving error messages in code. Triggers: error messages, user experience, error handling, exception messages, validation errors.
adversarial-patterns
Library of realistic adversarial attack vectors and anti-patterns to avoid. Contains examples of valid attacks and subtle gaming patterns to reject.
documentation-testing
Provides heuristics for identifying incomplete or broken documentation. Use when validating README setup instructions, testing onboarding flows, or auditing documentation quality. Triggers: docs, readme, onboarding, setup validation, documentation audit.
adversarial-analysis
Analyze code to identify explicit contracts, implicit usage patterns, and realistic boundary conditions. Contains concrete formulas for calculating input realism limits. Use before generating adversarial tests.
build-expression-tree
For symbolic computation: ASTs, mathematical expressions, code that manipulates code structure, expression transformations.