Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add rp1-run/rp1 --skill code-auditgit clone --depth 1 https://github.com/rp1-run/rp1Wrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/rp1-run/rp1/code-audit)<a href="https://agentmods.dev/skills/rp1-run/rp1/code-audit"><img src="https://agentmods.dev/badge/skills/rp1-run/rp1/code-audit/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/rp1-run/rp1/code-audit"><img src="https://agentmods.dev/badge/skills/rp1-run/rp1/code-audit.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00025 | $0.00407 |
| Opus 5.5 | $0.00010 | $0.00163 |
| Sonnet 5.5 | $0.00005 | $0.00081 |
| Haiku 4.5 | $0.00003 | $0.00041 |
Grade A, and why
code-audit scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
Code Quality Auditor
This command invokes the code-auditor sub-agent for pattern and quality analysis.
Invoke the code-auditor agent:
{% dispatch_agent "rp1-dev:code-auditor" %} FEATURE_ID: {FEATURE_ID} AUDIT_SCOPE: {AUDIT_SCOPE} PATTERN_STRICTNESS: {PATTERN_STRICTNESS} KB_ROOT: {kbRoot} {% enddispatch_agent %} The agent will:
- Discover existing project patterns and conventions
- Detect pattern violations and inconsistencies
- Scan for invalid or leaked information in comments
- Identify code duplication
- Check documentation drift
- Generate comprehensive audit report
- Report back with quality metrics and recommended fixes
The agent has access to all necessary tools and will handle the entire code audit workflow autonomously.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 62 lines · 25 tokens per session scan A 1c52daf26a0f
code-audit is a skill published in the GitHub repository rp1-run/rp1 (38 stars, last pushed 16d ago), licensed Apache-2.0. It adds 25 tokens to every session and 407 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-07.
Other skills, from other repositories
spec-brainstorm
Conversational design workshop for substantial work. Interviews the human one question at a time, explores 2-3 approaches with trade-offs, and presents the design section by section for approval before writing only design.md, then stops. Combines requirements discovery with codebase research and architecture design.…
spec-plan
Write approved implementation plans in one of two modes. Explicit Inline mode creates a conversational plan for bounded work. Spec-backed Plan converts an approved design.md into plan.json. Both modes stop after producing their plan output. Trigger after atelier-orchestrator selects a mode, when the user asks to plan…
oracle-debug
Disciplined debugging methodology. Triggers on bug reports, test failures, "debug this", "diagnose this", unexpected behavior, build failures, integration issues, or performance regressions. Find root cause before a permanent corrective fix; contain urgent harm safely first.
spec-implement
Continue an approved Spec-backed workflow when the user says "implement", "go", "start", or "do it". After Codex Plan Mode, persist the next missing design.md or plan.json artifact and stop. When both artifacts exist, execute plan.json with TDD and report between batches.
atelier-orchestrator
Skill routing and workflow orchestration. Selects Inline Plan or Spec-backed Plan, routes to the correct workflow skill, and manages transitions between phases. Use when starting any conversation or task to determine which planning mode and skill apply.
oracle-codebase-design
Shared vocabulary and principles for designing deep modules. Use when designing or changing a module's interface, deciding where a seam goes, handling untrusted input at the edges, choosing the level to test at, naming modules, or making code more testable. Also use when another skill needs the deep-module vocabulary.