Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add metraton/gaia --skill gaia-auditgit clone --depth 1 https://github.com/metraton/gaiaWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/metraton/gaia/gaia-audit)<a href="https://agentmods.dev/skills/metraton/gaia/gaia-audit"><img src="https://agentmods.dev/badge/skills/metraton/gaia/gaia-audit/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/metraton/gaia/gaia-audit"><img src="https://agentmods.dev/badge/skills/metraton/gaia/gaia-audit.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00067 | $0.01562 |
| Opus 5 | $0.00034 | $0.00781 |
| Sonnet 5 | $0.00013 | $0.00312 |
| Haiku 4.5 | $0.00007 | $0.00156 |
Grade A, and why
gaia-audit scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 124 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Gaia Audit
The discipline for auditing one Gaia component -- an agent or a skill -- against its type standard AND the live implementation it describes, and returning an enumerated proposal to discuss. The user reaches for this when they point at a single component and ask "how do I improve this? is it still right with the implementation?". The audit reads; it proposes; it does not mutate. The orchestrator enumerates the proposal back to the user, who decides what lands.
Core principle
An audit is worthless if it grades the component against its own claims. The component is a declaration; the value of the audit is anchoring every claim to the implementation -- the actual files and symbols the component describes -- and surfacing where the two have drifted apart. Three forces shape it:
- The standard is owned by the creator, not by this skill. What a
good agent or skill looks like lives in
agent-creation(for agents) andskill-creation(for skills). Load the creator for the component's type before judging it; this skill carries the audit cycle, not the type standard. - Claims anchor to symbols, or they are unverified. A reference to a
field, module, table, or function is real only if it exists by that
name in code (
hooks/modules/security/approval_grants.py::activate_db_pending_by_id,hooks/modules/security/protected_paths.py::is_protected_hook_path), not by a line number that drifts on every edit. Hunt phantom references, dead instructions, and schema/contract drift by opening the implementation and matching symbol-for-symbol. Cover both single refs (the component to its own implementation) and cross refs (the component to its siblings). - Factual drift is a fix; judgment trim is a discussion. When the code rejects what the component claims, that is factual drift -- propose the correction. When the component is merely verbose, redundant, or could be tighter, that is a judgment call -- propose it as a discussion item, not a foregone fix. Keeping the two apart lets the user approve fast on facts and deliberate on taste.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday Changed · +5 lines ba9446fcd2b8
- 12d ago First seen · 119 lines · 67 tokens per session scan A fdb307fb95b9
gaia-audit is a skill published in the GitHub repository metraton/gaia (3 stars, last pushed yesterday), licensed MIT. It adds 67 tokens to every session and 1,562 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
recipe-front-review
Reviews completed frontend implementation for governing-source compliance, scope economy, repository quality, and security, then applies user-approved React corrections.
component-api-validator
Audit component APIs for consistency, breaking changes, TypeScript coverage, and contract compliance across a component library. Trigger when someone says: component prop review, verify component types are exported, component API audit, check our component interfaces, are our props consistent, API consistency check…
react-frontend
React, TypeScript, and Next.js patterns for frontend development. Use when building React components, managing state, fetching data, optimizing performance, or working with Next.js App Router. Covers React 18-19, hooks, Server Components, and type-safe patterns.
tailwind-css
Tailwind CSS v4 patterns: CSS-first config, utility classes, component variants, v3 migration. Use when styling with Tailwind, configuring @theme tokens, using tailwind-variants/CVA, migrating v3 to v4, or fixing Tailwind styles and dark mode.
testing-react
Writes React/TypeScript tests using Vitest and React Testing Library. Use when "write react tests", "vitest", "component test", "hook test", "RTL", "testing library", "snapshot test", or testing React components, hooks, and utilities.
react-effects-audit
Use when auditing React or Next.js components for unnecessary or unsafe useEffect usage -- detects 9 anti-patterns from "You Might Not Need an Effect".