Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/sd0xdev/sd0x-harnessnpx agentmods add skills/sd0xdev/sd0x-harness/project-auditWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/sd0xdev/sd0x-harness/project-audit)<a href="https://agentmods.dev/skills/sd0xdev/sd0x-harness/project-audit"><img src="https://agentmods.dev/badge/skills/sd0xdev/sd0x-harness/project-audit/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/sd0xdev/sd0x-harness/project-audit"><img src="https://agentmods.dev/badge/skills/sd0xdev/sd0x-harness/project-audit.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00056 | $0.00704 |
| Opus 5.5 | $0.00022 | $0.00282 |
| Sonnet 5.5 | $0.00011 | $0.00141 |
| Haiku 4.5 | $0.00006 | $0.00070 |
Grade A, and why
project-audit scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
Copies of this mod
1 near-identical copy found in the catalogue:
- dhpk-project-audit — 89% identical, 22 lines differ
How it starts
The opening of the file, as written. The whole thing — 92 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Project Audit
When NOT to Use
- Security-specific review (use
/codex-security) - Runtime performance profiling
- Mid-development review (use
/codex-review-fast)
Procedure
- Run
bash scripts/run-skill.sh project-audit audit.js --jsonto collect deterministic scores - Parse the JSON output — overall_score, status, dimensions, checks, findings, next_actions
- If status = Blocked (P0 findings) — highlight critical gaps, suggest immediate fixes
- If status = Needs Work (P1 findings) — format improvement roadmap by dimension
- If status = Healthy — summarize strengths, note any P2 improvements
- Add qualitative interpretation beyond the scores (e.g., "test ratio is good but concentrated in unit tests")
Script Integration
The audit script runs 12 deterministic checks across 5 dimensions:
| Dimension | Checks | What It Measures |
|---|---|---|
| oss | 2 | LICENSE, README quality |
| robustness | 3 | CI config, lint/typecheck, test ratio |
| scope | 2 | Declared features vs implementation, AC completion |
| runnability | 3 | Package manifest, scripts, env/Docker setup |
| stability | 2 | Lock file + audit, type configuration |
Scoring Model
- Each check:
1(pass) /0.5(partial) /0(fail) /N/A(skipped) - Dimension score:
applicable_sum / applicable_count * 100 - Overall score: average of dimension scores
- Confidence:
applicable_checks / total_checksper dimension
Status Determination
| Status | Condition | Exit Code |
|---|---|---|
| Blocked | Any P0 finding | 2 |
| Needs Work | No P0, has P1 | 1 |
| Healthy | No P0/P1 | 0 |
Script Failure Fallback
If the script fails, report the error and suggest running manually:
bash scripts/run-skill.sh project-audit audit.js --json
Output Format
## Project Audit Report
| Field | Value |
|-------|-------|
| Repo | [name] |
| Score | **[N]/100** |
| Status | [icon] [status] |
### Dimensions
[table of dimension scores]
### Checks
[list of check results with suggestions]
### Next Actions
[prioritized action items]
## Gate: ✅/⛔
What ships with it
3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 92 lines · 56 tokens per session scan A 466ba5ceb263
project-audit is a skill published in the GitHub repository sd0xdev/sd0x-harness (193 stars, last pushed 9d ago), licensed MIT. It adds 56 tokens to every session and 704 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
comet-build
A Comet workflow step for turning an approved design into an implementation plan and completed code changes. Comet is the project workflow system described by the add-on.
comet-classic
A Chinese-language workflow guide for starting or resuming a structured software change using OpenSpec and Superpowers.
comet-native
A workflow for managing Native changes in Comet, where requirements, progress, and acceptance results are saved in project files. It uses the Comet command-line runtime to move through defined work stages.
comet-github-idea-to-issue
A workflow for turning a local idea, bug observation, or improvement proposal into a focused GitHub Issue draft. GitHub Issues are shared records for bugs, features, questions, and maintenance work.
exploration
Two-mode exploration skill: (1) design dialogue — turn rough ideas into validated designs through collaborative interview before planning; (2) spike — throwaway code answering ONE design question, deleted or absorbed, never shipped. Router invokes mode via dispatch context.
building
Use when writing production code test-first: the RED-GREEN-REFACTOR cycle, false-RED detection, vertical slicing, scope escalation, test process discipline, and code generation patterns.