Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add shimo4228/claude-harness --skill repo-asset-stocktakegit clone --depth 1 https://github.com/shimo4228/claude-harnessWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/shimo4228/claude-harness/repo-asset-stocktake)<a href="https://agentmods.dev/skills/shimo4228/claude-harness/repo-asset-stocktake"><img src="https://agentmods.dev/badge/skills/shimo4228/claude-harness/repo-asset-stocktake/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/shimo4228/claude-harness/repo-asset-stocktake"><img src="https://agentmods.dev/badge/skills/shimo4228/claude-harness/repo-asset-stocktake.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00156 | $0.03650 |
| Opus 5 | $0.00078 | $0.01825 |
| Sonnet 5 | $0.00031 | $0.00730 |
| Haiku 4.5 | $0.00016 | $0.00365 |
Grade A, and why
repo-asset-stocktake scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 151 lines — stays where its author put it; the contents beside it link to each section on GitHub.
repo-asset-stocktake — Non-Code Asset Value Stocktake
Audit a project repository's non-code assets — configs, CI workflows, runbooks, and other files that tooling or humans consume — and assign each a holistic Keep / Update / Retire / Merge verdict. Evaluation is single-context and holistic; there is no runtime script and no numeric score.
Design note 1 — every asset has a consumer. A non-code asset is not alive because it exists; it is alive because something consumes it — a tool invoked from a build script, a CI runner fired by an event, a human who reaches it through a link. When the consumer vanishes, or the asset stops serving the consumer it was written for, the asset becomes a review candidate. The config / workflow / runbook classes below are three seed consumer-classes, not the closed set — add a row whenever you meet a new consumer.
Design note 2 — two tiers, code then judgment. Reachability is structural (decidable by grep/find) so tier-1 enumerates it as code. Value is semantic ("does this still mean anything?") so tier-2 leaves it to holistic LLM judgment. The deterministic scan narrows the gray zone, and the LLM judges only what survives. An asset can be perfectly reachable and still be dead (a workflow that fires but runs a no-op, a runbook that is linked but describes a retired process); tier-1 cannot see that, which is exactly why tier-2 exists.
Modes ($ARGUMENTS)
$ARGUMENTS is [full|changed] [REPO_DIR] — mode first (default full), optional repo path (default the current working directory).
| Mode | When | Scope |
|---|---|---|
full (default) |
First audit, or a periodic sweep | Every non-code asset in REPO_DIR |
changed |
Re-audit after edits | tier-1 reachability always runs over the full asset set — a reference edge breaks when a referenced target is deleted elsewhere, and the referencing asset's own mtime never changes, so an mtime filter would miss it (the failure rules-stocktake already guards against). Only the tier-2 holistic re-evaluation is scoped: re-judge assets modified since the last evaluated_at (detect via git diff / mtime comparison — see the results.json note) plus any asset whose reachability changed vs the prior ledger; carry prior verdicts forward only for assets that are both unmodified and reachability-unchanged. |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 6d ago Changed bb32c34a6f84
- 12d ago First seen · 151 lines · 156 tokens per session scan A 2c730b08b9ef
repo-asset-stocktake is a skill published in the GitHub repository shimo4228/claude-harness (3 stars, last pushed 6d ago), licensed MIT. It adds 156 tokens to every session and 3,650 once invoked, about $0.0008 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
pi-parity-review
Adversarially verify that a ported change is faithful to the original pi implementation (TS source + published npm build). Use after porting upstream pi changes, or standalone on any area of this repo ("is X faithful to pi?").
pi-go-review
Review ported Go code for idiomatic quality — that the port maximizes Go rather than transliterating TypeScript. Use after porting upstream pi changes, or standalone on any diff in this repo.
clean
Pre-commit anti-slop audit — checks staged/dirty files for code slop (debug artifacts, single-use helpers, dead imports) AND documentation slop (stale claims, broken internal links, new .md files, redundant sections). Writes a sentinel so the pre-commit-gate hook lets the commit through. MUST be invoked before git…
coding-quality-loop
Use when a coding agent must turn a software goal, bug, issue, or refactor into a small, verified, independently reviewed code change.
agent-adoption-triage
Five-question triage for routing AI work to the right architecture — script, algorithmic search, LLM workflow, or autonomous agentic loop — before any agent is built. Use when someone says "let's build an agent for X", when deciding whether a use case actually needs an autonomous agent, when reviewing an agent…
self-critic
This agent's own internal adversarial critic loop. Hardens every deliverable with a fresh no-memory domain critic until it passes twice consecutively with zero CRITICALs before return.