Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/senavictors/bootstrap-agent-architecture-plugin/bootstrap-auditnpx skills add Senavictors/bootstrap-agent-architecture-plugin --skill bootstrap-auditgit clone --depth 1 https://github.com/Senavictors/bootstrap-agent-architecture-pluginWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/senavictors/bootstrap-agent-architecture-plugin/bootstrap-audit)<a href="https://agentmods.dev/skills/senavictors/bootstrap-agent-architecture-plugin/bootstrap-audit"><img src="https://agentmods.dev/badge/skills/senavictors/bootstrap-agent-architecture-plugin/bootstrap-audit.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00111 | $0.01516 |
| Opus 5 | $0.00056 | $0.00758 |
| Sonnet 5 | $0.00022 | $0.00303 |
| Haiku 4.5 | $0.00011 | $0.00152 |
Grade A, and why
bootstrap-audit scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 67 lines — stays where its author put it; the contents beside it link to each section on GitHub.
bootstrap-audit — auditoria local
Esta skill não precisa de CI nem de ferramenta nova — é uma varredura mecânica (grep/leitura de frontmatter) mais uma releitura de contexto pela própria sessão. Rode as quatro checagens nesta ordem e produza um relatório único ao final, no formato da seção "Relatório final" abaixo.
Checagem 1 — Teste de sanidade
- Leia
.agents/test-onboarding.mdinteiro — as duas seções, Constituição e Perguntas de sanidade. - Releia o que foi feito na sessão atual (ou, se invocado no início de uma sessão nova, o
CONTEXT.mde a task ativa). - Para cada item da Constituição, confirme mentalmente que nada no trabalho recente o contradiz. Para cada pergunta de sanidade, confirme que a resposta certa ainda é verdadeira dado o estado atual do código (não é um exame para o usuário — é uma autochecagem sua).
- Se encontrar uma contradição: não corrija silenciosamente. Reporte como falha nesta checagem e proponha, como a seção de Governança da spec v2.0 descreve ("Shadow ADR"), documentar um ADR novo justificando a mudança — ou reverter, se a mudança não foi intencional.
Checagem 2 — Compliance de formato
Varra mecanicamente (Grep/leitura direta, sem exigir ferramenta nova):
- Todo arquivo em
.claude/agents/*.mde.claude/skills/*/SKILL.mdtemdescriptionpreenchida no frontmatter? - Todo arquivo em
.cursor/rules/*.mdctemdescriptionpreenchida? - Todo arquivo em
.codex/agents/*.tomltemdescriptionpreenchida? - Para cada papel que existe nos três adaptadores, o conteúdo (corpo, não frontmatter) é idêntico entre eles? Sinalize qualquer divergência de texto encontrada — isso é o único "bug estrutural" que esta arquitetura pode ter por não ter sincronização automática.
- Algum link relativo dentro de
.agents/**/*.mdoudocs/**/*.mdaponta para um arquivo que não existe? - Docs viva (se o projeto tem
docs/desta arquitetura): todo doc dedocs/fora os READMEs de índice tem o frontmatterestado/fonte/ultima-revisaopreenchido? Liste os docs marcadosestado: divergente(são pendências abertas, não erros — mas não podem ficar esquecidos). Para docsestado: real, quando for barato verificar (ex.:git log -1 --format=%ci -- <fonte>), sinalize como suspeito de defasagem qualquer doc cujafontemudou no Git depois daultima-revisao— apenas sinalize; quem atualiza é uma task viabootstrap-complete, não esta auditoria.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 67 lines · 111 tokens per session scan A e9b3d4b7915b
bootstrap-audit is a skill published in the GitHub repository Senavictors/bootstrap-agent-architecture-plugin (3 stars, last pushed 5d ago), licensed MIT. It adds 111 tokens to every session and 1,516 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
peekaboo
Provides runtime observation and interaction for native macOS interfaces through accessibility state and screenshots. Use when the task depends on visible or interactive state in a running SwiftUI/AppKit app: what is rendered, focused, selected, enabled, reachable through menus/windows/dialogs, or experienced across a…
improving-tests
Improve test design, speed, and coverage with behavior-focused tests, useful seams, characterization tests, TDD, and test refactoring. Use when improving tests, optimizing slow suites, adding coverage, refactoring brittle tests, removing test waste, or working test-first. NOT for fixing production bugs (use…
seam-probe
This skill should be used when testing or debugging an embedded-runtime boundary exposed through a dynamically loaded C-ABI library or Unix-domain socket, including requests to inspect exports, exercise FFI callbacks, send framed messages, reproduce seam crashes or hangs, fuzz a boundary, or correlate probe output…
fixing-code
Fix code defects with a reproducible feedback loop, root-cause diagnosis, minimal patch, regression test, and clean verification. Use when debugging, diagnosing, or resolving lint/test/build failures. NOT for behavior-preserving refactors (use refactoring-code), test-suite cleanup without a production bug (use…
reviewing-code
Use when reviewing changed code, PRs, diffs, or specific files. Finds evidence-backed defects in security, correctness, tests, reliability, performance, maintainability, and docs. Supports quick, standard, deep, team, and external-review modes. NOT for repo-wide architecture review, general codebase exploration…
reviewing-instructions
Use when asked to lint, audit, review, or score AI-facing instruction files such as SKILL.md, AGENT.md, AGENTS.md, CLAUDE.md, platform body.md files, prompt files, rules, policies, and agent-facing references. NOT for plugin manifests, application code review, harness configuration review, ordinary docs, tests, or…