Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add n24q02m/claude-plugins --skill impact-auditgit clone --depth 1 https://github.com/n24q02m/claude-pluginsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/n24q02m/claude-plugins/impact-audit)<a href="https://agentmods.dev/skills/n24q02m/claude-plugins/impact-audit"><img src="https://agentmods.dev/badge/skills/n24q02m/claude-plugins/impact-audit/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/n24q02m/claude-plugins/impact-audit"><img src="https://agentmods.dev/badge/skills/n24q02m/claude-plugins/impact-audit.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00035 | $0.01493 |
| Opus 5.5 | $0.00014 | $0.00597 |
| Sonnet 5.5 | $0.00007 | $0.00299 |
| Haiku 4.5 | $0.00003 | $0.00149 |
Grade A, and why
impact-audit scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 18d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
This is a copy
100% identical to impact-audit — 18 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.
How it starts
The opening of the file, as written. The whole thing — 108 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Impact Audit
Scope a planned change before writing it. Answers "if I change this, what else has to change, and in which repositories" -- across a federation of repositories, not just the one you have open.
Run this while the change is still a proposal. Once code is written, review-delta and review-pr review what actually changed.
Command surface: run the local CLI through the coding harness shell. Examples
use the installed crg command; from a source checkout,
prefix it with uv run. No MCP mapping is required. Use
crg query --help for the actions reference.
Steps
-
State the change under audit in one line before querying anything -- for example "add a required
tenant_idparameter tocreate_session". The audit is only meaningful against a specific proposed edit, because the risky part differs: adding a required parameter breaks callers, changing a return type breaks consumers, renaming breaks both plus anything resolving the name dynamically. -
Make sure every repository that could be affected is in the graph. A blast radius is only as wide as the graph:
crg graph stats --repo-root "<path-a>"-- confirm the graph exists and notefiles_count.crg graph build --full-rebuild --repo-root "<path-a>" --roots "<path-b>"-- federate the additional repositories into the same graph. Each root is registered and its files tagged with arepo_id.- Without federation, a cross-repo audit will report a clean radius simply because the consumers were never indexed. Say so in the report rather than implying the change is contained.
-
Locate every definition of the symbol with
crg query search --search-query "<name>" --repo-root "<path-a>", leaving--repounset so the search spans all federated repositories. Two repositories may define the same name for unrelated purposes -- resolve which definition is actually the target before tracing, and note any same-named decoys so a later reader does not re-open the question.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 18d ago Changed ee6dfe8f2dcb
- 1mo ago First seen · 108 lines · 35 tokens per session scan A 37453831c172
impact-audit is a skill published in the GitHub repository n24q02m/claude-plugins (4 stars, last pushed yesterday), licensed Apache-2.0. It adds 35 tokens to every session and 1,493 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. It is 100% identical to impact-audit, differing in 18 lines, and is treated as a copy.
Other skills, from other repositories
phpunit-test-team-reviewing
Use this skill when the user asks for a team-based, consensus, multi-reviewer, or red-team review of Shopware PHPUnit tests — trigger phrases like "team review these tests", "consensus review the tests in PR.
phpunit-test-reconciling
Internal sub-skill. Do not auto-activate. Use only when explicitly invoked by name by another skill or agent.
code-review-helper
A safe skill that helps with code review tasks.
issue-analyzing
Use this skill when the user asks to analyze a specific GitHub issue, understand what area of code an issue affects, assess an issue's scope, or research the code context around an issue — example triggers like "analyze issue.
pr-analyzing
Use this skill when the user asks to analyze a specific GitHub pull request, review a PR's architectural impact, assess what changed in a PR and why it matters, or research the code relationships affected by a PR — example triggers like "analyze PR.
pr-triage
4-phase PR backlog management with audit, deep code review, validated comments, and optional worktree setup. Use when triaging pull requests, catching up on pending code reviews, or managing a backlog of open PRs. Args: 'all' to review all, PR numbers to focus (e.g. '42 57'), 'en'/'fr' for language, no arg = audit…