Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add orlando-japan/claude-code-setting --skill governance-link-drift-auditgit clone --depth 1 https://github.com/orlando-japan/claude-code-settingWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/orlando-japan/claude-code-setting/governance-link-drift-audit)<a href="https://agentmods.dev/skills/orlando-japan/claude-code-setting/governance-link-drift-audit"><img src="https://agentmods.dev/badge/skills/orlando-japan/claude-code-setting/governance-link-drift-audit/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/orlando-japan/claude-code-setting/governance-link-drift-audit"><img src="https://agentmods.dev/badge/skills/orlando-japan/claude-code-setting/governance-link-drift-audit.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00048 | $0.00533 |
| Opus 5 | $0.00024 | $0.00267 |
| Sonnet 5 | $0.00010 | $0.00107 |
| Haiku 4.5 | $0.00005 | $0.00053 |
Grade A, and why
governance-link-drift-audit scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 69 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Governance link drift audit
A repository can have the right canonical document and still fail operationally if every entrypoint keeps pointing somewhere old. This skill checks the reference chain around governance documents, runtime instructions, and onboarding entrypoints.
When drift is present
Common symptoms:
- README points to a retired path
- skill docs still reference an old whitelist or patch index
- runtime instructions mention files that were moved or renamed
- governance docs were updated, but operational entrypoints were not
Audit target set
Check these first:
- README / navigation / whitelist documents
- Agent instruction files (
AGENTS.md,CLAUDE.md, similar) - Skills and rules that name authoritative docs explicitly
- Operational checklists that still assume old locations
Audit workflow
- Identify the current authority
- What is the active canonical doc or canonical doc set now?
- Trace all direct references
- Search for old filenames, retired paths, and old aliases
- Separate content drift from link drift
- If the content is wrong, that is a governance change
- If the content is right but references are stale, that is link drift
- Classify impact
- High: runtime or onboarding path leads to wrong authority
- Medium: supporting docs still reference retired material
- Low: historical or low-traffic docs have stale links
- Default to audit-only unless explicitly told to edit
- The safest default is to report the stale edges first
Preferred output
Current authority:
- <file/path>
Drift findings:
- High: <stale runtime/onboarding link>
- Medium: <supporting doc drift>
- Low: <historical drift>
Recommended smallest fix:
- <patch the entrypoint>
- <patch the secondary references>
Anti-patterns
- Assuming moved docs are harmless if the main doc is correct — users often enter through secondary paths.
- Fixing links without checking authority first — you can make drift more durable by wiring everything to the wrong file.
- Auto-editing everything at once — prioritize entrypoints, then supporting references.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago First seen · 69 lines · 48 tokens per session scan A bf3134a96789
governance-link-drift-audit is a skill published in the GitHub repository orlando-japan/claude-code-setting (2 stars, last pushed 3mo ago), licensed MIT. It adds 48 tokens to every session and 533 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
Agent Instruction Drift Check
Procedure for comparing an agent-facing instruction doc (AGENTS.md/CLAUDE.md-style) against the actual current code and configuration to find and flag mismatches.
rubber-duck
Adversarial "rubber duck" review that turns explaining-out-loud into a hallucination check. The main session is the PRESENTER (it did the work — a design doc, investigation, or analysis — and holds the real reasoning) and reconstructs the topic to a LISTENER — a spawned subagent pinned to a DIFFERENT-vendor model that…
military-discipline
A strict review and debugging procedure based on checking work, asking for reasons, correcting problems, accepting only verified results, and recording lessons. It is designed as a quality-control process.
write-a-postmortem
Write a blameless incident postmortem under postmortems/ following the Google SRE shape — evidence-based timeline, trigger vs root cause vs symptom, contributing factors, what went well, and owned+dated+verifiable action items. Read when asked to write a postmortem, do an incident review, run a root cause analysis…
fable-operator
Use when a substantive request needs verified, calibrated reasoning — analysis, diagnosis, review, advice, or a draft the user will act on — even when rigor is not asked for, and most of all when being wrong is expensive or irreversible. NOT casual chat (rigor theater), NOT the SDD gates verify, debug, review; this is…
hatch3r-perf-audit
Profiles and optimizes application performance against defined budgets. Use when investigating performance issues, auditing performance budgets, or optimizing hot paths.