Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/slowdoctor-dev/workspace-md/auditnpx skills add slowdoctor-dev/workspace-md --skill auditgit clone --depth 1 https://github.com/slowdoctor-dev/workspace-mdWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/slowdoctor-dev/workspace-md/audit)<a href="https://agentmods.dev/skills/slowdoctor-dev/workspace-md/audit"><img src="https://agentmods.dev/badge/skills/slowdoctor-dev/workspace-md/audit.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00098 | $0.03199 |
| Opus 5 | $0.00049 | $0.01599 |
| Sonnet 5 | $0.00020 | $0.00640 |
| Haiku 4.5 | $0.00010 | $0.00320 |
Grade A, and why
audit scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 264 lines — stays where its author put it; the contents beside it link to each section on GitHub.
audit
When to use
- Monthly by default (or every N sessions, per workspace cadence)
- On size-limit breach (R1 cap exceeded; primary R1 enforcement
is
dreamconsolidate-on-error —auditis the backstop) - After bulk additions (post-migration, post-research-heavy)
- Explicit
/auditOwner invocation
audit is the workspace's janitor — it doesn't accumulate, it keeps
things tidy. Each scan class serves a specific value or rule (see
Quick reference). Companion to dream: dream accumulates +
consolidates at write-time; audit verifies + prunes periodically.
Requires
Requires 3-control/foundation/SOUL.md,
3-control/foundation/PRINCIPLE.md, and 2-mind/garden/essential/
to exist. If any are missing, run init instead of continuing.
Quick reference
Each scan class enforces a specific value or rule:
| # | Issue class | What to look for | Action | Serves |
|---|---|---|---|---|
| 1 | Stale | broken paths; old last_verified; broken symlinks; profile.md staleness/completeness |
update or prune | One canonical home + R3 + schema integrity |
| 2 | Duplicates | two files on same topic; rule in multiple places; convenience-summary drift | merge to canonical home | One canonical home |
| 3 | Contradictions | rules/principles in tension; old vs new claims | resolve (keep newer; annotate older) | One canonical home + internal consistency |
| 4 | Over-grown | files exceeding their cap | split or consolidate | R1 backstop (× R2 tier) |
| 5 | Orphans | dead links; broken cross-refs | fix paths or remove refs | One canonical home (link integrity) |
| 6 | Citation gaps | synthesized entries missing (journal …) citation |
flag for dream to fix |
R3 backstop (source-trail integrity) |
| 7 | Low-utility | skills never invoked; rules never fired | archive or prune | Use-driven evolution (pruning) |
Plus two mechanical steps that serve R3 source-trail integrity:
- Journal archival pass (entries >3 months → archive)
- Audit-log write (records what changed when)
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 264 lines · 98 tokens per session scan A ca25d5af3c53
audit is a skill published in the GitHub repository slowdoctor-dev/workspace-md (1 stars, last pushed 3mo ago), licensed Apache-2.0. It adds 98 tokens to every session and 3,199 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
talk-like-scarletkc
按 scarletkc 本人的自然表达习惯撰写、改写、润色和翻译文本，覆盖推文、微博、评论、聊天消息、技术观点、项目介绍、GitHub 文本（README、issue、PR、发布说明）和正式通信。当用户要求用自己的口吻写东西、把 AI 腔文字改自然、发推、回评论、点评模型或开发工具、写项目公告、写礼貌但直接的客服或正式邮件，或要求翻译时保留语气和立场，都使用本 skill，即使用户没有点名 scarletkc 或提出风格要求。.
marketing-copy
Write outbound promotional copy for a product or project: launch and update posts for community platforms and social media, store page descriptions and short blurbs, landing page headlines and calls to action, press-style announcements, and the naming of a product for another language or market. Covers what may be…
scoped-change
Judgment rules for locating the correct boundary of a requested change: staying inert outside it while completing every required site inside it. Use when scope is ambiguous, a diff touches neighboring surfaces, required dependent edits are unclear, or a proposed compatibility layer, migration, fallback, flag…
codex-memory-trim
Manage Codex's native global memory (/.codex/memories) with three sub-procedures - trim (audit + dedupe + three-layer cleanup), compress (rewrite verbose memories into concise form), and add-global (add a custom global rule/preference). Use when the user asks to 精简/清理/整理/压缩 Codex 记忆, 去重, 简化冗长记忆, 添加/写入/修改全局记忆 or a…
npm-security-best-practices
Apply npm/pnpm supply-chain hardening when adding a dependency, editing package.json/.npmrc/pnpm-workspace.yaml, reviewing a lockfile change, or configuring CI install steps. Covers the 17 practices from lirantal/npm-security-best-practices.
codex-cli
When handing work to the Codex CLI earns its cost, and how to size the run: second-model review, bounded implementation hand-offs, sandbox permissions, model and reasoning effort. Use when the user asks for Codex or codex exec, when a change is complex or high-stakes enough that an independent reviewer would change…