cognitive-core: Skill for Claude Code

.claude/skills/audit/SKILL.md

audit is a skill for Claude Code from mocartlex-wq/cognitive-core. It costs 74 tokens per session (1,987 once invoked), scanned A, original, MIT.

A visual review process for finding interface problems by opening a page in a browser at different screen sizes and light or dark themes.

In plain words
What is it for?
Use it to test layouts, scrolling, forms, themes, long data, and other visual or interactive issues before accepting a page.
Why use it?
Code checks can pass while a page still looks broken or behaves incorrectly for users. It helps uncover problems that source-code inspection misses.

Skill for Claude Code

Written for Claude Code: argument-hint in frontmatter.

This is mocartlex-wq/cognitive-core's own configuration. It tells Claude Code how to work on cognitive-core itself, so it is not a mod to install elsewhere. Copy it as a starting point and replace the rules that are about this project. Everything cognitive-core configures →

Reuse

Borrowing it

Nothing to install: this file belongs to mocartlex-wq/cognitive-core. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file
curl -O https://raw.githubusercontent.com/mocartlex-wq/cognitive-core/main/.claude/skills/audit/SKILL.md
Clone the repo
git clone --depth 1 https://github.com/mocartlex-wq/cognitive-core

Made for: Claude Code.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for audit

README.md
[![agentmods](https://agentmods.dev/badge/skills/mocartlex-wq/cognitive-core/audit/github.svg)](https://agentmods.dev/skills/mocartlex-wq/cognitive-core/audit)
Your own site
<a href="https://agentmods.dev/skills/mocartlex-wq/cognitive-core/audit"><img src="https://agentmods.dev/badge/skills/mocartlex-wq/cognitive-core/audit/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for audit

Your own site · 80×15
<a href="https://agentmods.dev/skills/mocartlex-wq/cognitive-core/audit"><img src="https://agentmods.dev/badge/skills/mocartlex-wq/cognitive-core/audit.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 74 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 1,987 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 1 finding. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00074 $0.01987
Opus 5 $0.00037 $0.00993
Sonnet 5 $0.00015 $0.00397
Haiku 4.5 $0.00007 $0.00199

Measured 9d ago against content hash 7fc9a45cda21, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-09, from the pricing page.

Security

Grade A, and why

audit scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

1. взять БОЕВУЮ страницу: curl https://mcp.me-ai.ru/ui/room?id=... -o page.html
.claude/skills/audit/SKILL.md · 150 lines

How it starts

The opening of the file, as written. The whole thing — 150 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Визуальный аудит

Код чист, тесты зелёные, консоль пуста — и страница всё равно сломана. Такие дефекты ловит только рендер и взгляд.

Основа взята у агента CRM (ai-crm), адаптирована под здешний стек: страницы лежат в sandbox/, отдаются FastAPI и закрыты сессией.

Примеры из этого проекта, каждый прошёл мимо чтения кода:

Что видел пользователь Почему код молчал
Лента открывалась на старом сообщении render() падал раньше на обращении к переменной из мёртвой зоны — прокрутка вообще не вызывалась, ошибка ушла в проглоченный промис
Поле ввода не росло, Enter не отправлял тот же обрыв: всё, что настраивалось после падения, молча не выполнялось

Шаг 1. Как открыть страницу под сессией

Браузер инструмента не залогинен, а входить за владельца нельзя. Приём:

1. взять БОЕВУЮ страницу: curl https://mcp.me-ai.ru/ui/room?id=... -o page.html
2. вставить ПЕРЕД её скриптами заглушку fetch с правдоподобными данными
3. поднять python -m http.server и открыть

Данные брать длинные и многочисленные: на трёх коротких строках половина дефектов не воспроизводится.

⚠️ Вкладка инструмента открывается скрытой, а там не выполняются кадровые колбэки (requestAnimationFrame). Проверяя анимацию или отложенную вёрстку, выведи вкладку вперёд скриншотом — иначе решишь, что код мёртв, хотя он просто не вызывался.

Шаг 2. Автоматические детекторы

() => {
  const out = [];
  const vis = e => e.offsetParent !== null || getComputedStyle(e).position === 'fixed';

  // 1. Горизонтальный скролл — и у документа, И у внутренних контейнеров.
  //    Проверять только документ недостаточно: в лентах и таблицах
  //    переполнение живёт внутри, а страница при этом чиста.
  if (document.documentElement.scrollWidth > window.innerWidth + 1)
    out.push(['скролл-вбок', `документ ${document.documentElement.scrollWidth}px при экране ${window.innerWidth}px`]);
  for (const e of document.querySelectorAll('div,section,main,ul,table')) {
    if (!vis(e)) continue;
    const s = getComputedStyle(e);
    if (e.scrollWidth > e.clientWidth + 1 && ['auto','scroll','hidden'].includes(s.overflowX))
      out.push(['скролл-вбок-внутри', `${e.tagName.toLowerCase()}.${e.className} ${e.scrollWidth}>${e.clientWidth}`]);
  }

  // 2. Обрезанный текст
  for (const e of document.querySelectorAll('*')) {
    if (!vis(e) || e.children.length) continue;
    const s = getComputedStyle(e);
    if (e.scrollWidth > e.clientWidth + 1 && s.overflow !== 'visible' && e.textContent.trim())
      out.push(['обрезан-текст', `«${e.textContent.trim().slice(0,40)}»`]);
  }

  // 3. hidden побеждён правилом display — заголовок над пустотой
  for (const e of document.querySelectorAll('[hidden]'))
    if (vis(e)) out.push(['hidden-не-скрыт', `${e.tagName.toLowerCase()}.${e.className}`]);

  // 4. Цели касания меньше 44pt
  for (const e of document.querySelectorAll('button,a,[role=button],input,select')) {
    if (!vis(e)) continue;
    const r = e.getBoundingClientRect();
    if (r.width && (r.width < 44 || r.height < 44))
      out.push(['мелкая-цель', `${Math.round(r.width)}×${Math.round(r.height)} «${(e.textContent||'').trim().slice(0,20)}»`]);
  }

  // 5. Рамка или фон вокруг пустоты
  for (const e of document.querySelectorAll('div,section,aside,ul')) {
    if (!vis(e) || e.textContent.trim() || e.querySelector('img,svg,canvas,input')) continue;
    const s = getComputedStyle(e), r = e.getBoundingClientRect();
    const marked = s.borderWidth !== '0px' || (s.backgroundColor !== 'rgba(0, 0, 0, 0)' && s.backgroundColor !== 'transparent');
    if (marked && r.height > 12) out.push(['пустой-блок', `${e.tagName.toLowerCase()} ${Math.round(r.width)}×${Math.round(r.height)}`]);
  }

  // 6. Необработанные ошибки страницы. Здесь это КРИТИЧНО: обрыв в render()
  //    оставляет страницу внешне целой, а половину поведения — мёртвой.
  out.push(...(window.__auditErrors || []).map(e => ['ошибка-страницы', e]));

  return out;
}

Read the full file on GitHub · 150 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 9d ago First seen · 150 lines · 74 tokens per session scan A 7fc9a45cda21

Subscribe to this mod's changes

audit is a skill published in the GitHub repository mocartlex-wq/cognitive-core (1 stars, last pushed 2d ago), licensed MIT. It adds 74 tokens to every session and 1,987 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Related

Other skills, from other repositories

eval-graphics

Turn an eval study's numbers into on-brand, publish-ready figures using the Newsjack chart room (the eval design system), then validate them with Playwright. For producing the charts in a published eval/data study.

elvisun/newsjack · 47 tokens

in-app-browser

A guide for using Proma’s built-in controlled web browser to open, view, search, or operate websites.

proma-ai/Proma · 170 tokens

screenshot-capture

Capture high-quality screenshots of any public URL at custom resolutions. Supports desktop and mobile viewports, full-page captures, and specific element targeting. Ideal for visual monitoring, design research, and content archival.

sandbaseai/sandbase-skills · 45 tokens

windows-desktop-control

Use this plugin when the task involves native Windows desktop apps or browser surfaces that do not have a stronger structured integration available.

virtengine/bosun · 0 tokens

canvora

Create on-brand visuals (social posts, carousels, decks, PDFs, ads, landing-page kits, infographics) from any idea, text, URL, or PDF via Canvora. 82 formats, native generation in 150+ languages, per-client brand kits. Use when the user asks to create, generate, or design visual content for social media, marketing…

canvora/canvora-mcp · 84 tokens

product-photo-visuals

Build Canvora visuals around the user's OWN photos — real product shots, team headshots, venue or event photos embedded into the design instead of generic stock imagery. Use when the user has photos to include, wants their actual product shown, or says the visuals must feature their real people or place.

canvora/canvora-mcp · 65 tokens