Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add oliver-kriska/claude-elixir-phoenix --skill auditgit clone --depth 1 https://github.com/oliver-kriska/claude-elixir-phoenixWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/oliver-kriska/claude-elixir-phoenix/audit)<a href="https://agentmods.dev/skills/oliver-kriska/claude-elixir-phoenix/audit"><img src="https://agentmods.dev/badge/skills/oliver-kriska/claude-elixir-phoenix/audit/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/oliver-kriska/claude-elixir-phoenix/audit"><img src="https://agentmods.dev/badge/skills/oliver-kriska/claude-elixir-phoenix/audit.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00035 | $0.01957 |
| Opus 5.5 | $0.00014 | $0.00783 |
| Sonnet 5.5 | $0.00007 | $0.00391 |
| Haiku 4.5 | $0.00003 | $0.00196 |
Grade A, and why
audit scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 24d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 178 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Project Health Audit
Comprehensive project-wide health assessment using 5 parallel specialist subagents.
Usage
/phx:audit # Full audit (default)
/phx:audit --quick # 2-3 minute pulse check
/phx:audit --focus=security # Deep dive single area
/phx:audit --focus=performance
/phx:audit --since abc123 # Incremental audit since commit
/phx:audit --since HEAD~10 # Audit last 10 commits
When to Use
- Quarterly health checks
- Before major releases
- After large refactors
- New team member onboarding (understand codebase health)
Iron Laws
- Wait for ALL agents before synthesizing — Partial results create misleading health scores because cross-category correlations get missed
- Scope agent prompts to specific directories — Vague prompts like "analyze the codebase" produce generic findings that waste tokens and miss real issues
- Never compare scores across projects — Scoring methodology depends on project size and maturity; only track trends within the same project
- Quick mode before full mode — Run
--quickfirst to catch compile/test failures before spending tokens on 5 parallel agents
Subagent Architecture
Spawn 5 specialists in parallel using Agent tool. Three route to plugin
specialists with a declared model; the two categories without a specialist use
general-purpose pinned to model: "sonnet" — unpinned, they inherit the
session model (Opus by default):
| Subagent | Focus | Output File | Routes to |
|---|---|---|---|
| Architecture Reviewer | Structure quality, coupling, cohesion | arch-review.md |
phoenix-patterns-analyst (sonnet) |
| Performance Auditor | N+1, indexes, bottlenecks, scalability | perf-audit.md |
general-purpose, model: "sonnet" (no perf specialist yet) |
| Security Auditor | OWASP scan, auth patterns, secrets | security-audit.md |
security-analyzer (opus) |
| Test Health Auditor | Coverage, quality, flaky tests | test-audit.md |
testing-reviewer (sonnet) |
| Dependency Auditor | Vulnerabilities, outdated, unused | deps-audit.md |
general-purpose, model: "sonnet" (hex-deps-triager is per-package only) |
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 24d ago Changed · +3 lines 2e4794498c4a
- 1mo ago First seen · 175 lines · 35 tokens per session scan A 5d2468fb9696
audit is a skill published in the GitHub repository oliver-kriska/claude-elixir-phoenix (569 stars, last pushed 2d ago), licensed MIT. It adds 35 tokens to every session and 1,957 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
skeptical-triage
Reusable 3-round self-challenge + arbiter pattern for filtering false positives from findings/verdicts. Use when the cost of a false-positive gate block exceeds the cost of 4 extra LLM turns.
anti-patterns
Catalogue of known SDLC anti-patterns that greatcto agents must actively reject when reviewing architecture, plans, code, or post-mortems. Used by architect (pre-impl), pm (planning), senior-dev (impl), l3-support (post-incident).
observability-baseline
Scaffold-time observability so a shipped product is not blind in prod from day one — error capture (Sentry), request-id structured logging, and /healthz + /readyz endpoints. stack-baseline pins Sentry but nothing wires it; this is the wiring. Loaded by app-scaffolder (bake into the scaffold), infra-provisioner (prod…
rubber-ducky
Use when you've planned a non-trivial change and are about to implement it, finished a complex or multi-file piece of work, just wrote tests, or are stuck on repeated failures or unexpected results — and any time the user says "rubber duck this", "rubber ducky", "get a second opinion", "sanity-check my plan", "poke…
deadeye-sweep
Applies the findings from /deadeye-review, /deadeye-pr, and /deadeye-guard, verifies the build, and re-scans on a loop until nothing (critical/high, or every severity with --all) survives. In --pr mode also answers the PR's own open review comments, replying and resolving.
bug-hunting
Use when fixing bugs, debugging failures, or proactively reviewing code for hidden bugs. Reactive mode: fix known bugs. Proactive mode: hunt for bugs in code. Enforces confirmed root cause before any fix.