Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add rijuvashisht/Magneto --skill auditgit clone --depth 1 https://github.com/rijuvashisht/MagnetoWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/rijuvashisht/magneto/audit)<a href="https://agentmods.dev/skills/rijuvashisht/magneto/audit"><img src="https://agentmods.dev/badge/skills/rijuvashisht/magneto/audit/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/rijuvashisht/magneto/audit"><img src="https://agentmods.dev/badge/skills/rijuvashisht/magneto/audit.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00000 | $0.00655 |
| Opus 5.5 | $0.00000 | $0.00262 |
| Sonnet 5.5 | $0.00000 | $0.00131 |
| Haiku 4.5 | $0.00000 | $0.00065 |
Grade A, and why
audit scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 90 lines — stays where its author put it; the contents beside it link to each section on GitHub.
/audit — Read the Tamper-Evident Audit Log
Role: Audit Log Reader
Inputs: filters (sprint, skill, time range)
Outputs: human-readable log or JSON
Audit actions: audit.read, audit.verified
Why This Skill Exists — The Moat
Every Magneto skill invocation emits hash-chained events to .magneto/audit.jsonl. /audit lets humans read the log, verify its integrity, and replay sprint state.
Enterprise feature: every AI action is traceable, reversible, governable.
Subcommands
Tail
magneto audit tail # last 20 events
magneto audit tail --sprint <id> # filter by sprint
magneto audit tail --skill review # filter by skill
magneto audit tail --since 1h # time filter
magneto audit tail --follow # live stream
Verify hash chain
magneto audit verify
Walks the chain and confirms:
- Each event's
prevHashmatches the previous event'shash - Each event's
hashis reproducible from its fields - No gaps in
seqnumbers
Exit code 0 = intact. Non-zero = tampered or corrupted.
Replay sprint state
magneto audit replay --sprint <id>
Reconstructs the sprint state by walking events:
- Sprint started at
<ts>by<actor> - /think drafted design with approach A
- /plan drafted plan; 5 files modify, 2 create
- /plan-eng-review scored: arch=8, tests=6
- /review found 2 block, 3 ask findings
- /ship opened PR #42
- ...
Search
magneto audit search --action "*.fail*"
magneto audit search --actor [email protected] --since 7d
magneto audit search --payload 'req=REQ-042'
Event Format
{
"seq": 42,
"ts": "2026-05-12T18:34:52.123Z",
"actor": "[email protected]",
"skill": "review",
"action": "review.findings_recorded",
"sprintId": "s-20260512-1800",
"payload": { "block": 2, "autoFixed": 3, "ask": 1, "note": 5 },
"prevHash": "abc123...",
"hash": "def456..."
}
Compliance Export
magneto audit export --format json --since 30d > audit-export.json
magneto audit export --format csv --sprint s-... > sprint-audit.csv
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2mo ago First seen · 90 lines · 0 tokens per session scan A 5f6dc4d0e750
audit is a skill published in the GitHub repository rijuvashisht/Magneto (6 stars, last pushed 4mo ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 655 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
expense-review-policy
Review invoices and contracts against accounts-payable policy before human approval.
skill-creator
Create, install, or update skills in the workspace. Use when (1) installing a skill from a URL or remote source, (2) creating a new skill from scratch, (3) updating or restructuring existing skills. Always use this skill for any skill installation or creation task.
image-generation
Generate or edit images from text prompts. Use when the user asks to create, draw, design, or edit an image, illustration, photo, icon, poster, or any visual content.
baby-sit
Monitor a GitHub pull request until CI is green, diagnose failures, and rerun only evidence-backed flaky GitHub Actions jobs.
new-app
Scaffold a new Atomic Agents project from scratch — create the directory, pyproject.toml, env file, first agent, and a runnable entry point. Use when the user asks to start a new atomic-agents project from scratch, says "scaffold" / "new project" / "start from zero", or runs /atomic-agents:new-app.
powerpoint
Create designed, editable PowerPoint .pptx presentations with PptxGenJS. Use when the user asks to create, generate, update, or inspect a deck, slide deck, presentation, or .pptx file.