Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add NITISH-R-G/hackerrank-orchestrate-skills --skill orchestrate-multimodal-auditorgit clone --depth 1 https://github.com/NITISH-R-G/hackerrank-orchestrate-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/nitish-r-g/hackerrank-orchestrate-skills/orchestrate-multimodal-auditor)<a href="https://agentmods.dev/skills/nitish-r-g/hackerrank-orchestrate-skills/orchestrate-multimodal-auditor"><img src="https://agentmods.dev/badge/skills/nitish-r-g/hackerrank-orchestrate-skills/orchestrate-multimodal-auditor/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/nitish-r-g/hackerrank-orchestrate-skills/orchestrate-multimodal-auditor"><img src="https://agentmods.dev/badge/skills/nitish-r-g/hackerrank-orchestrate-skills/orchestrate-multimodal-auditor.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00055 | $0.00701 |
| Opus 5 | $0.00028 | $0.00351 |
| Sonnet 5 | $0.00011 | $0.00140 |
| Haiku 4.5 | $0.00006 | $0.00070 |
Grade A, and why
orchestrate-multimodal-auditor scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 68 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Orchestrate: Multimodal Auditor
Evidence tier: first-hand build (August 2026). Grounded in a completed Orchestrate submission that was audited to destruction — 48 logged defects, 9 measured-and-rejected optimisations, 17 certification scripts. Every number below was measured on that system. Nothing here claims access to HackerRank's internal scoring.
The rule
Calling an OCR or ASR API is not multimodal reasoning. Media must materially change the final decision, and you prove it by turning the modality OFF.
To claim modality X drives outcome Y, show both:
- with X enabled, Y happens, and
- with X disabled, Y stops happening.
Only (1) is compatible with X being decorative.
What this caught in a real build
Two findings, opposite directions:
The pipeline was dark. Hosted vision returned 0 characters on 15/15 image rows, and that was written down as "the images carry no signal". Wrong — it was a statement about two remote services, not the corpus. A local engine extracted 10,104 characters from 19 of 20 images.
The proof it was live. Generated posters whose scam text existed only in pixels, with innocuous accompanying message text:
OCR ON OCR OFF
otp harvest mute/scam digest/unknown
wallet + shortlink mute/scam digest/unknown
...
7/7 caught 7/7 escaped
Both halves hold, so image content determines the verdict.
Do not let media reclassify intent
Measured: feeding OCR text into intent lexicons regressed two rows — an unrelated
calendar screenshot and a generic brochure flipped them from urgent to event.
The scoping rule that fixed it, derived from the spec itself: message_text is empty on 8/8 voice rows (so the transcript is the message and participates fully) and non-empty on 15/15 image rows (so the poster is a supplementary artifact — it may escalate a safety signal, but must not redefine what the sender meant).
The checklist
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago First seen · 68 lines · 0 tokens per session scan A 3c6a3a41a16f
orchestrate-multimodal-auditor is a skill published in the GitHub repository NITISH-R-G/hackerrank-orchestrate-skills (3 stars, last pushed 1mo ago), licensed MIT. It adds 55 tokens to every session and 701 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
test-router
A testing skill that chooses which checks to run based on the type, scope, and risk of a change.
dev-testing
A testing guide that defines when to use unit, integration, API, and end-to-end tests. Unit tests check small pieces of code, while end-to-end tests check a full user flow.
release-verification
A release-verification checklist for software versions and packages. It covers changelogs, tests, packaging, installation smoke checks, version-control actions, publishing, and checks after release.
host-contract-verification
A verification procedure for the rules between a host system and its hooks, command-line tools, startup scripts, workspace checks, visible responses, and fallback connections to MCP servers.
consumer-validation-engineering
A validation workflow for checking a software package across separate repositories. It covers SDKs, command-line tools, frameworks, and shared packages using both linked source code and the packaged artifact users install.
api-verification
An API verification workflow that creates both an .http request file and a .cjs JavaScript file, then runs an automation script to test them. An API is an interface through which software exchanges requests and responses.