Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/robcsaszar/ai-forge/ai-forge-auditnpx skills add robcsaszar/ai-forge --skill ai-forge-auditgit clone --depth 1 https://github.com/robcsaszar/ai-forgeWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/robcsaszar/ai-forge/ai-forge-audit)<a href="https://agentmods.dev/skills/robcsaszar/ai-forge/ai-forge-audit"><img src="https://agentmods.dev/badge/skills/robcsaszar/ai-forge/ai-forge-audit.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00099 | $0.01851 |
| Opus 5 | $0.00049 | $0.00925 |
| Sonnet 5 | $0.00020 | $0.00370 |
| Haiku 4.5 | $0.00010 | $0.00185 |
Grade A, and why
ai-forge-audit scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 166 lines — stays where its author put it; the contents beside it link to each section on GitHub.
AI Forge Audit
Batch-run ai-forge-judge across every skill and agent in the repo. One consolidated report — grades, top issues, priority order. Read-only: no fixes applied.
Requires the ai-forge-judge skill. If it is not available in this environment (no ai-forge-judge under any platform's skills/ root, and invoking it fails), stop: "ai-forge-judge skill not found — install it before running audit."
Workflow
Phase 0 — Coherence
Run before grading anything:
node scripts/check-ecosystem.cjs --roots <comma-separated roots>
check-ecosystem.cjs is local and read-only: it only reads files under the given roots and writes a JSON report to stdout — no network access, no subprocess spawning, no writes outside stdout.
It returns JSON with errors and warnings across six roster-level checks that no per-artifact grade can see: trigger collisions (description keyword overlap), duplicate and shadowed names, name/directory mismatches, stale reference links, orphaned reference files, dated model pins, and body word budgets.
These are properties of the roster, not of any single artifact. Eight skills can each score an A while two of them compete for every trigger and a third points at a file someone deleted.
Render the findings as an ## Ecosystem section above the grade summary. If the script is missing or errors, head the section with ⚠ roster-level checks skipped — validator unavailable: <reason> and continue to Phase 1 — coherence is additive, not a gate, but its absence must be visible, since these checks are exactly what per-artifact grades cannot see.
Phase 1 — Discover
Discovery is platform-agnostic — scan every platform's roots, not just Claude's. Two constraints shape how:
- Glob excludes hidden directories. A pattern naming
.claude/…from the repo root matches nothing; you MUST passpathpointing inside each root. - Agent extensions differ by platform. Skills are always
SKILL.md; agents are.md,.agent.md, or.toml.
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 166 lines · 99 tokens per session scan A bdaa999dd22c
ai-forge-audit is a skill published in the GitHub repository robcsaszar/ai-forge (0 stars, last pushed 3d ago), licensed MIT. It adds 99 tokens to every session and 1,851 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
dspy
Build complex AI systems with declarative programming, optimize prompts automatically, create modular RAG systems and agents with DSPy - Stanford NLP's framework for systematic LM programming.
guidance
Control LLM output with regex and grammars, guarantee valid JSON/XML/code generation, enforce structured formats, and build multi-step workflows with Guidance - Microsoft Research's constrained generation framework.
instructor
Extract structured data from LLM responses with Pydantic validation, retry failed extractions automatically, parse complex JSON with type safety, and stream partial results with Instructor - battle-tested structured output library.
iron-system
Meta-skill for reverse loop engineering that transforms an AI agent's approach to any complex task. Combines systematic deconstruction (reverse engineering) and iterative construction (loop engineering) in an EXTRACT→SYNTHESIZE→BUILD→AUDIT cycle. Includes 7 named tactical loops (FORGE, SIEGE, PRISM, RAZOR, MIRROR…
outlines
Guarantee valid JSON/XML/code structure during generation, use Pydantic models for type-safe outputs, support local models (Transformers, vLLM), and maximize inference speed with Outlines - dottxt.ai's structured generation library.
skill-creator
Create or optimize Claude Code skills with best-practice structure, bundled resources, and prompt engineering patterns.