Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add sonature-lab/timsquad --skill tsq-product-auditgit clone --depth 1 https://github.com/sonature-lab/timsquadWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/sonature-lab/timsquad/tsq-product-audit)<a href="https://agentmods.dev/skills/sonature-lab/timsquad/tsq-product-audit"><img src="https://agentmods.dev/badge/skills/sonature-lab/timsquad/tsq-product-audit/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/sonature-lab/timsquad/tsq-product-audit"><img src="https://agentmods.dev/badge/skills/sonature-lab/timsquad/tsq-product-audit.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00108 | $0.01600 |
| Opus 5 | $0.00054 | $0.00800 |
| Sonnet 5 | $0.00022 | $0.00320 |
| Haiku 4.5 | $0.00011 | $0.00160 |
Grade A, and why
tsq-product-audit scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 114 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Product Audit
7개 영역을 체계적으로 평가하고, 정량 스코어와 개선 사이클로 품질을 추적한다.
Philosophy
- 정량 70% + 정성 30% 가중 평균으로 객관적 평가
- 모든 항목에
source: estimated | measured명시 - False Positive는 FP Registry로 관리하여 재감사 시 노이즈 제거
- Closed-loop: 감사 → 개선 → 재감사 사이클로 품질 수렴
Contract
- Trigger: 감사 태스크, Phase gate 전, 릴리스 전 검증
- Input: 감사 범위 + FP Registry + 이전 리포트 (재감사 시)
- Output: 정량 스코어 보고서 + severity 분류 + 개선 계획
- Error: Critical 항목 존재 시 gate 차단
- Dependencies: coding, testing
Protocol — 6단계 사이클
Phase 1: Plan (감사 계획)
감사 범위, 대상 영역, 기준을 결정하고 계획을 저장한다.
- 프로젝트 타입에 따라 영역별 가중치 조정
- FP Registry 로딩, baseline(이전 감사 결과) 확인
- 계획을 문서로 저장 → 유저 컨펌 후 진행
Phase 2: Audit (감사 실행)
계획에 따라 7개 영역을 순회하며 체크리스트 기반 평가.
- 각 항목: pass / fail / warning / skip + source 명시
- 자동화 가능 항목은 도구 실행 (Lighthouse, axe-core, eslint 등)
- 수동 항목은 코드 리뷰로 판정
Phase 3: Report (보고)
감사 결과를 정량 스코어로 집계하고 개선점을 보고한다.
- 영역별 점수 + 가중 평균 종합 점수 산출
- severity별 finding 분류 (Critical/High/Medium/Low)
- 이전 감사 대비 diff (개선/악화 추적)
Phase 4: Remediation Plan (개선 계획)
보고서를 토대로 개선 계획을 수립한다.
- severity 기준 우선순위 정렬
- 개선 계획 문서 작성 → 유저 컨펌 → 저장
- 컨펌 없이 개선 실시하지 않음
Phase 5: Fix (개선 실시)
컨펌된 계획에 따라 개선을 실행하고 테스트한다.
- 개선 완료 후 관련 테스트 실행 (unit + integration)
- E2E 테스트까지 통과 확인
- 테스트 실패 시 수정 반복
Phase 6: Re-audit (재감사)
개선 완료 후 동일 기준으로 재감사를 실시한다.
- Phase 2와 동일 절차, 이전 결과와 diff 비교
- Gate 기준 충족 시 완료, 미충족 시 Phase 4로 복귀
Verification
| Check | Method | Pass Criteria |
|---|---|---|
| 종합 점수 | 가중 평균 | >= 60점 (gate) |
| Critical 항목 | severity 확인 | 0건 |
| source 필드 | 리포트 확인 | 모든 항목 존재 |
| 재감사 diff | 이전 대비 비교 | PASS→FAIL 전환 0건 |
7개 감사 영역
| # | 영역 | 핵심 기준 | 체크리스트 |
|---|---|---|---|
| 01 | Security | OWASP Top 10:2025, ASVS v5, CWE Top 25, CVSS 4.0 | 01-security |
| 02 | Performance | Core Web Vitals (LCP/INP/CLS), Lighthouse v12 | 02-performance |
| 03 | SEO | E-E-A-T, AI Overview, Schema.org, Mobile-first | 03-seo |
| 04 | Accessibility | WCAG 2.2 AA, EAA 2025, WAI-ARIA APG | 04-accessibility |
| 05 | UI/UX | Nielsen 10 Heuristics, 반응형, 디자인 시스템 | 05-ui-ux |
| 06 | Architecture & DB | ISO 25010:2023, 데이터 아키텍처, API 설계 | 06-architecture |
| 07 | Functional & Requirements | RTM, 테스트 커버리지, 요구사항 추적 | 07-functional-requirements |
What ships with it
12 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- checklists/01-security.md 5.1 KB
- checklists/02-performance.md 2.9 KB
- checklists/03-seo.md 2.3 KB
- checklists/04-accessibility.md 3.4 KB
- checklists/05-ui-ux.md 2.9 KB
- checklists/06-architecture.md 2.9 KB
- checklists/07-functional-requirements.md 2.6 KB
- rules/audit-protocol.md 4.0 KB
- rules/false-positive-guard.md 2.8 KB
- rules/scoring-criteria.md 2.6 KB
- templates/improvement-plan-template.md 1.3 KB
- templates/report-template.md 2.3 KB
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago First seen · 114 lines · 108 tokens per session scan A ee9ef23b0cf5
tsq-product-audit is a skill published in the GitHub repository sonature-lab/timsquad (11 stars, last pushed 11d ago), licensed MIT. It adds 108 tokens to every session and 1,600 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
Website Audit
Comprehensive website auditing skill using Lighthouse, PageSpeed Insights, and web performance APIs to audit performance, accessibility, SEO, best practices, and security.
goshipit
Pre-launch codebase audit skill. Use this whenever someone is about to ship, deploy, launch, push to main/prod, or merge a release - even without "goshipit" explicitly. Trigger on: "is my app ready?", "can I deploy now?", "pre-deploy check", "review before launch", "is this production-ready?", "check my codebase"…
squirrelscan
Skill "squirrelscan" from squirrelscan/squirrelscan, covering squirrelscan cli, links, install, command overview and quickstart.
audit-website
Audit a website with the squirrelscan CLI and fix the findings in code. Runs SEO, performance, security, technical, content, accessibility, and 15 other rule categories (260+ rules), returns an LLM-optimized report, then drives an iterative fix loop, mapping issues to source files, applying fixes, and re-auditing…
ttb-skill-audit
Code audits for TTBaseUIKit apps: performance, accessibility, localization. FCR compliance scoring.
cocotrace
Build and query the SHA-256 requirements-to-implementation traceability graph across lifecycle artifacts.