Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add stuartshields/claude-setup --skill audit-vs-fix-disciplinegit clone --depth 1 https://github.com/stuartshields/claude-setupWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/stuartshields/claude-setup/audit-vs-fix-discipline)<a href="https://agentmods.dev/skills/stuartshields/claude-setup/audit-vs-fix-discipline"><img src="https://agentmods.dev/badge/skills/stuartshields/claude-setup/audit-vs-fix-discipline.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00079 | $0.02146 |
| Opus 5 | $0.00039 | $0.01073 |
| Sonnet 5 | $0.00016 | $0.00429 |
| Haiku 4.5 | $0.00008 | $0.00215 |
Grade A, and why
audit-vs-fix-discipline scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 145 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Audit vs fix discipline
Audits produce findings. Fixes happen separately, on explicit user request.
Violating the letter of this rule violates the spirit. "Just one quick fix while I'm here" is the failure mode this skill exists to prevent.
Triggers — apply this skill when the user says
audit, review, investigate, check, scan, look at, look over, go through, inspect, find issues in, what's wrong with, how's the X looking, is the X any good, tell me about the X.
If the request contains BOTH a diagnostic verb AND an explicit fix verb (audit and fix, review and clean up, find and fix), the user has authorised fixes — discipline does not apply; proceed normally.
The discipline
While in audit mode you MUST:
- Use read-only tools only. Read, Grep, Glob, Bash for read-only commands. NO Edit, Write, or mutating Bash. Sub-agents you dispatch inherit this constraint — say so in the prompt.
- Produce tiered findings. Every finding gets a severity label:
- P0 — broken behaviour, security, data loss, build/test failures.
- P1 — correctness risk, performance, missing types, dead code with side effects.
- P2 — style, naming, nits, harmless dead code.
- Cite
file:linefor every finding. No findings without locations. - Separate findings from suggestions. Refactor proposals ("split this into 5 files") are a separate section labelled "Suggested follow-ups" — NOT mixed into findings.
- End with an explicit ask.
Want me to fix any of these? Specify by number, severity tier, or "fix all P0".Then stop.
Calibration
A clean audit is a valid outcome. Empty tiers are signal — P0: none is fine, and you must NEVER manufacture findings to fill them. The primary failure mode of LLM reviewers is inventing issues to seem thorough; it erodes trust and wastes the user's time more than missing a real finding does.
Confidence gate: ≥80% sure it's a real problem, or drop it. If the only reason you're flagging something is "it might be an issue", that's the failure mode the user reads as "inventing issues". Speculation belongs in Suggested follow-ups, not in a tiered finding.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 145 lines · 79 tokens per session scan A 6431fb2e3d45
audit-vs-fix-discipline is a skill published in the GitHub repository stuartshields/claude-setup (2 stars, last pushed 3mo ago), licensed MIT. It adds 79 tokens to every session and 2,146 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
code-review
Perform thorough code reviews focusing on unused code, duplications, coding patterns, bugs, and optimizations. Use when user wants code reviewed or audited. Read-only - outputs findings without making changes.
security-audit
Use this skill to perform a security audit, scan for vulnerabilities, check OWASP Top 10 issues, or review code for security problems. Triggered by "security audit", "check security", "find vulnerabilities".
review-pr
Use this skill when the user wants to review a pull request, check a PR for issues, or get feedback on a GitHub PR. Triggered by "review PR", "check PR", "review pull request", or "/review-pr ".
code-remediate
Apply selected review fixes; bare PR targets use current online items, while PR +review adds the latest matching artifact.
code-review
Close PRs at an evidence gate or review local diffs/PRs with specialists and JSON artifacts.
audit-pr
Audit a whole PR against the delivery contract and return MERGE-READY or evidenced blockers with the full URL. Consumes the current review-change REVIEW-PASS receipt instead of re-running review axes; posts a SHA-bound ready comment; never edits or merges. Triggers: "audit-pr", "is this PR ready", "merge gate".