Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/spair/task-pipeline/self-auditnpx skills add SpaiR/task-pipeline --skill self-auditgit clone --depth 1 https://github.com/SpaiR/task-pipelineWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/spair/task-pipeline/self-audit)<a href="https://agentmods.dev/skills/spair/task-pipeline/self-audit"><img src="https://agentmods.dev/badge/skills/spair/task-pipeline/self-audit.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00052 | $0.02663 |
| Opus 5 | $0.00026 | $0.01332 |
| Sonnet 5 | $0.00010 | $0.00533 |
| Haiku 4.5 | $0.00005 | $0.00266 |
Grade A, and why
self-audit scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 168 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Audit this repository (the task-pipeline skills repo itself) for drift between skills, the artifact contract, and the user-facing docs. Three lenses run in parallel as named subagents: Invariants, Contract, Docs-sync.
This is a meta-skill. It operates on the repo's own files (skills/*/SKILL.md, skills/_lib/*.sh, skills/validate/validate.sh, CLAUDE.md, README.md, docs/contract.md), not on .task/* artifacts. The pipeline it audits is the chat-first capture protocol — grill in chat, then to-task / to-plan / to-roadmap / to-spec fix the discussion into a .task/ artifact that a plain session (or roadmap-to-workflow) executes directly, handing the diff to task:code-reviewer. The repo-level agents/ directory holds exactly one file, agents/code-reviewer.md. The skill can be invoked at any time.
Input: Optional scope hint: $ARGUMENTS (e.g. a single skill name to focus on; default: full repo).
Precondition (hard-stop): This skill is local to the task-pipeline repo. Verify the working directory contains skills/to-task/, skills/validate/, and CLAUDE.md at the repo root. If not, stop with: "This skill is local and only works inside the task-pipeline repository."
Communication language: Russian (per global user instructions). Findings text stays in English (it grounds in English source files and matches the existing auditor convention).
Why a separate set of agents? The global audit-{reuse,simplicity,clarity}-auditor are tuned for code diffs (DRY, dead code, naming). This repo's content is markdown-as-prompt plus a thin skills/_lib/ bash layer. The meaningful failure modes here are different — invariant drift, producer↔consumer mismatch, README↔code drift. Hence three repo-specific lenses.
Architecture
| Lens | Local agent | What it checks |
|---|---|---|
| Invariants | self-invariants-auditor |
Skills don't violate any bullet in CLAUDE.md § "Invariants — don't break these when editing skills". |
| Contract | self-contract-auditor |
Producer↔consumer artifact protocol is symmetric (templates ↔ validate.sh/roadmap.sh parsers ↔ consumer rules), per docs/contract.md. |
| Docs-sync | self-docs-sync-auditor |
README.md, CLAUDE.md, and docs/contract.md reflect the actual skills/ directory (six user skills + validate), plus CONTRIBUTING.md and the website/ pages. |
All three are read-only named agents at .claude/agents/self-{invariants,contract,docs-sync}-auditor.md, with tools: Read, Grep, Glob, Bash (no Edit/Write — read-only is runtime-enforced). Fixes happen only in the main thread (Step 4).
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 168 lines · 52 tokens per session scan A 7d3bd67b47cc
self-audit is a skill published in the GitHub repository SpaiR/task-pipeline (7 stars, last pushed 3d ago), licensed MIT. It adds 52 tokens to every session and 2,663 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
architect
Answer build-or-adopt honestly, then design one committed architecture from your own understanding of the problem — driven by ranked quality attributes, stress-tested against the field and against change, proven by a walking skeleton, its consequences confirmed by the user, committed to ARCHITECTURE.md. A command the…
designer
Settle the look before the pixels — audience and context first, then the base and the delta, taste settled by looking at real states, accessibility as the floor, one design language committed to DESIGN.md as tokens with roles. A command the user types, for work with an interface someone will see; standalone, no other…
setup-working-genius
Per-repo configuration — pin the work-file directory, verify commands, and issue tracking, seed the project docs, and leave the pointer that tells every future session this project works this way.
errata
Correct what was written wrong — the binding line rewritten in place, the record it came from appended to and never touched, both carrying the evidence that overturned it. Use when a run, a file, or the user contradicts something already written in a work file, a plan's contract, the glossary, or the decision index…
domain-glossary
Maintain the project's shared vocabulary in CONTEXT.md — challenge conflicting terms, sharpen fuzzy language, record resolutions inline. Use when a term conflicts with or is missing from the glossary, when a decision names a new concept, or when another skill needs the glossary discipline.
decision-record
Keep the index of the project's settled decisions in .genius/DECIDED.md — one line per decision, pointing at the fight that settled it, earned by one test: would a future stranger re-fight this? Use when such a decision lands, when a design might contradict a settled one, or when another skill needs the index…