Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add mhenke/john-ousterhout-skills --skill aposd-auditgit clone --depth 1 https://github.com/mhenke/john-ousterhout-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/mhenke/john-ousterhout-skills/aposd-audit)<a href="https://agentmods.dev/skills/mhenke/john-ousterhout-skills/aposd-audit"><img src="https://agentmods.dev/badge/skills/mhenke/john-ousterhout-skills/aposd-audit/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/mhenke/john-ousterhout-skills/aposd-audit"><img src="https://agentmods.dev/badge/skills/mhenke/john-ousterhout-skills/aposd-audit.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00036 | $0.04352 |
| Opus 5 | $0.00018 | $0.02176 |
| Sonnet 5 | $0.00007 | $0.00870 |
| Haiku 4.5 | $0.00004 | $0.00435 |
Grade A, and why
aposd-audit scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 368 lines — stays where its author put it; the contents beside it link to each section on GitHub.
aposd audit — Design Quality Audit
Run systematic design quality checks and generate a comprehensive report. Don't fix issues; document them for review.
This is a code-level design audit — check what's measurable and verifiable in the implementation. Every dimension is scored by counting concrete, observable constructs. Fix the count → score goes up, every time.
Follows the impeccable audit convention: measure what's objectively countable, not what's interpretive.
Scoring rubric: Score each dimension 0-4. Total /20. Rating bands: 18-20 Excellent, 14-17 Good, 10-13 Acceptable, 6-9 Poor, 0-5 Critical.
Quick Start
aposd audit src/ # audit a directory
aposd audit src/services/order-service.js # audit a single file
aposd audit # defaults to workspace root
The report is printed to stdout.
Scope
This skill audits a single codebase target per invocation. It measures 5 design dimensions by counting observable constructs — pass-throughs, duplication, documentation gaps, naming issues, and exception patterns. It does not evaluate functional correctness, runtime performance, or test coverage. Each dimension is scored 0-4 from concrete evidence only.
What this skill does NOT cover:
- Functional correctness — does the code produce the right output?
- Runtime performance — how fast does it execute?
- Test coverage — are there enough tests?
- Security vulnerabilities — are there injection flaws or auth gaps?
- Code style / formatting — does it follow lint rules?
- Architectural fitness — are you using the right pattern for the job?
- Business logic completeness — are all requirements implemented?
Setup
Resolve the target to a concrete file path, directory, or module name. If no target is specified, default to the current workspace root directory.
Full scan: Scan all files in the target — no sampling. For large targets (>50 files), use sub-agents to parallelize the scan across directory groups.
Input / Output
What ships with it
6 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago First seen · 368 lines · 36 tokens per session scan A bd0c326c7c5e
aposd-audit is a skill published in the GitHub repository mhenke/john-ousterhout-skills (6 stars, last pushed 3mo ago), licensed MIT. It adds 36 tokens to every session and 4,352 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
Tech Debt Auditor
Identifies and prioritizes technical debt in a codebase with an effort/impact matrix.
refactor-agent
Safe, systematic code refactoring — extract functions, reduce complexity, eliminate duplication, improve naming. Use when improving code structure without changing behavior.
RubyCritic Code Quality Analysis
Analyze Ruby and Rails code quality with RubyCritic. Identifies code smells, complexity issues, and refactoring opportunities. Provides detailed metrics, scores files A-F, compares branches, and prioritizes high-churn problem areas. Use when analyzing Ruby code quality, reviewing PRs, or identifying technical debt.
code-refactoring-advisor
Enterprise code refactoring advisor that detects code smells, anti-patterns, and complexity issues with specific refactoring recommendations, test generation, and maintainability metrics.
software-code-refactoring
Improve production code quality while preserving all existing test behavior. Commonly used for the Refactor phase of TDD red-green-refactor, but applicable to any codebase with tests. Use when production code works but needs cleanup — reducing duplication, improving naming, simplifying complexity, aligning with…
simplify-codebase
Simplification audit or authorized codebase simplification whose stated objective is to remove accidental complexity. Use for evidence-backed deletion or consolidation of dead code, duplicate state, redundant APIs or layers, ownerless abstractions, obsolete compatibility or design records, and over-engineering in any…