Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add NITISH-R-G/hackerrank-orchestrate-skills --skill orchestrate-spec-auditorgit clone --depth 1 https://github.com/NITISH-R-G/hackerrank-orchestrate-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/nitish-r-g/hackerrank-orchestrate-skills/orchestrate-spec-auditor)<a href="https://agentmods.dev/skills/nitish-r-g/hackerrank-orchestrate-skills/orchestrate-spec-auditor"><img src="https://agentmods.dev/badge/skills/nitish-r-g/hackerrank-orchestrate-skills/orchestrate-spec-auditor/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/nitish-r-g/hackerrank-orchestrate-skills/orchestrate-spec-auditor"><img src="https://agentmods.dev/badge/skills/nitish-r-g/hackerrank-orchestrate-skills/orchestrate-spec-auditor.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00071 | $0.00612 |
| Opus 5 | $0.00036 | $0.00306 |
| Sonnet 5 | $0.00014 | $0.00122 |
| Haiku 4.5 | $0.00007 | $0.00061 |
Grade A, and why
orchestrate-spec-auditor scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 53 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Orchestrate: Spec Auditor
Evidence tier: first-hand build (August 2026). Grounded in a completed Orchestrate submission that was audited to destruction — 48 logged defects, 9 measured-and-rejected optimisations, 17 certification scripts. Every number below was measured on that system. Nothing here claims access to HackerRank's internal scoring.
The rule
Transcribe the spec's constants into your checker. Never import them from your own code.
If your validator does from router.schema import OUTPUT_COLUMNS, it proves only
that your code agrees with itself. A checker built from constants typed out of
problem_statement.md is an independent witness.
What this caught in a real build
The spec says evidence ids are semicolon-separated. Ground truth showed
message_0013;message_0014. An early audit script joined with commas for display
and the discrepancy was briefly mistaken for a defect in the submission. Reading the
spec line rather than the code settled it in one command.
Separately: message_type has exactly 11 legal values. A checker built from the
spec confirms all 11 were used and none illegal. A checker built from the code cannot
tell you that.
The checklist
- Column names and order match the spec exactly — compare against a literal list
- One output row per input row, same ids, same order, no duplicates
- Every
actionvalue is in the spec's allowed set - Every
message_typevalue is in the spec's allowed set — and log how many of the legal values you actually use - Numeric fields parse and sit inside the stated range
- Separators are exactly what the spec says (semicolon is not a comma)
- The "no evidence" sentinel is the exact string the spec names
- Every cited id exists in the history file
- Every required submission artifact is present — including the transcript
Failure modes
- Checking against your schema module. Circular; proves nothing.
- Assuming a separator. Read the line. It costs ten seconds.
- Forgetting the third artifact. Most participants remember code and CSV and forget the chat transcript is explicitly listed as a must-have.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 10d ago First seen · 53 lines · 71 tokens per session scan A 782a52715833
orchestrate-spec-auditor is a skill published in the GitHub repository NITISH-R-G/hackerrank-orchestrate-skills (3 stars, last pushed 29d ago), licensed MIT. It adds 71 tokens to every session and 612 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
test-router
A testing skill that chooses which checks to run based on the type, scope, and risk of a change.
dev-testing
A testing guide that defines when to use unit, integration, API, and end-to-end tests. Unit tests check small pieces of code, while end-to-end tests check a full user flow.
release-verification
A release-verification checklist for software versions and packages. It covers changelogs, tests, packaging, installation smoke checks, version-control actions, publishing, and checks after release.
host-contract-verification
A verification procedure for the rules between a host system and its hooks, command-line tools, startup scripts, workspace checks, visible responses, and fallback connections to MCP servers.
api-verification
An API verification workflow that creates both an .http request file and a .cjs JavaScript file, then runs an automation script to test them. An API is an interface through which software exchanges requests and responses.
consumer-validation-engineering
A validation workflow for checking a software package across separate repositories. It covers SDKs, command-line tools, frameworks, and shared packages using both linked source code and the packaged artifact users install.