Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add slowdoctor-dev/workspace-md --skill auditgit clone --depth 1 https://github.com/slowdoctor-dev/workspace-mdWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/slowdoctor-dev/workspace-md/audit)<a href="https://agentmods.dev/skills/slowdoctor-dev/workspace-md/audit"><img src="https://agentmods.dev/badge/skills/slowdoctor-dev/workspace-md/audit/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/slowdoctor-dev/workspace-md/audit"><img src="https://agentmods.dev/badge/skills/slowdoctor-dev/workspace-md/audit.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00098 | $0.03199 |
| Opus 5.5 | $0.00039 | $0.01280 |
| Sonnet 5.5 | $0.00020 | $0.00640 |
| Haiku 4.5 | $0.00010 | $0.00320 |
Grade A, and why
audit scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 264 lines — stays where its author put it; the contents beside it link to each section on GitHub.
audit
When to use
- Monthly by default (or every N sessions, per workspace cadence)
- On size-limit breach (R1 cap exceeded; primary R1 enforcement
is
dreamconsolidate-on-error —auditis the backstop) - After bulk additions (post-migration, post-research-heavy)
- Explicit
/auditOwner invocation
audit is the workspace's janitor — it doesn't accumulate, it keeps
things tidy. Each scan class serves a specific value or rule (see
Quick reference). Companion to dream: dream accumulates +
consolidates at write-time; audit verifies + prunes periodically.
Requires
Requires 3-control/foundation/SOUL.md,
3-control/foundation/PRINCIPLE.md, and 2-mind/garden/essential/
to exist. If any are missing, run init instead of continuing.
Quick reference
Each scan class enforces a specific value or rule:
| # | Issue class | What to look for | Action | Serves |
|---|---|---|---|---|
| 1 | Stale | broken paths; old last_verified; broken symlinks; profile.md staleness/completeness |
update or prune | One canonical home + R3 + schema integrity |
| 2 | Duplicates | two files on same topic; rule in multiple places; convenience-summary drift | merge to canonical home | One canonical home |
| 3 | Contradictions | rules/principles in tension; old vs new claims | resolve (keep newer; annotate older) | One canonical home + internal consistency |
| 4 | Over-grown | files exceeding their cap | split or consolidate | R1 backstop (× R2 tier) |
| 5 | Orphans | dead links; broken cross-refs | fix paths or remove refs | One canonical home (link integrity) |
| 6 | Citation gaps | synthesized entries missing (journal …) citation |
flag for dream to fix |
R3 backstop (source-trail integrity) |
| 7 | Low-utility | skills never invoked; rules never fired | archive or prune | Use-driven evolution (pruning) |
Plus two mechanical steps that serve R3 source-trail integrity:
- Journal archival pass (entries >3 months → archive)
- Audit-log write (records what changed when)
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 264 lines · 98 tokens per session scan A ca25d5af3c53
audit is a skill published in the GitHub repository slowdoctor-dev/workspace-md (1 stars, last pushed 4mo ago), licensed Apache-2.0. It adds 98 tokens to every session and 3,199 once invoked, about $0.0004 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
cmux
Optional, only for cmux users: tabs, splits, parallel agents, workplace driver, restoring lost workspaces from layout snapshots. Trigger: "new tab", "split pane", "parallel agent", "workspaces lost", "restore cmux layout". Trap: "tab" = surface, not workspace.
bridge-greeting
Context-aware terminal greeting (MOTD) for Bridge instances: renders a per-instance logo, palette, today's calendar and the "Doing" board, resolved from which org folder the terminal opened in. Includes gen-logo.py (ANSI-Shadow generator). Trigger: "/bridge-greeting", "terminal greeting", "motd", "startup logo"…
briefing
Daily briefing from your own profile (workflow/briefings/ .yaml: sections, trackers incl. GitHub/Jira/GitLab/ADO/Linear, inbox rules): inbox first, then steer the day (approve, defer, drop, open agent tabs). /briefing picks a profile. Trigger: "/briefing", "briefing", "good morning", "daily standup", "what needs me"…
mail-draft
Drafts outgoing email and never sends: Markdown to mail-safe HTML themed from DESIGN.md, footers from identity/mail-footers/, occasions from workflow/mail-profiles/, recipients from mandants, preflight checks; Apple Mail, Outlook or .eml. Trigger: "draft an email", "mail to", "email draft", "mail footer", "email…
bootstrap
Onboarding conversation to generate a user profile.
tmux
Optional, only for tmux users: the workplace driver that lets scripts/workplace.py and the cockpit steer agent tabs in tmux, inside any terminal app (iTerm, Terminal, Ghostty, VS Code). Trigger: "tmux driver", "workplace with tmux", "agent tabs in tmux", "cockpit without cmux".