Borrowing it
Nothing to install: this file belongs to Synerise/synerise-design. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/Synerise/synerise-design/master/.claude/skills/package-audit/SKILL.mdgit clone --depth 1 https://github.com/Synerise/synerise-designWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/synerise/synerise-design/package-audit)<a href="https://agentmods.dev/skills/synerise/synerise-design/package-audit"><img src="https://agentmods.dev/badge/skills/synerise/synerise-design/package-audit/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/synerise/synerise-design/package-audit"><img src="https://agentmods.dev/badge/skills/synerise/synerise-design/package-audit.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00041 | $0.03647 |
| Opus 5 | $0.00020 | $0.01824 |
| Sonnet 5 | $0.00008 | $0.00729 |
| Haiku 4.5 | $0.00004 | $0.00365 |
Grade A, and why
package-audit scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 280 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Overview
Perform a thorough quality audit of a single component package in the design system. The audit covers dead code, unit tests, Storybook stories, interactive tests, console logs, suppression comments, code organisation, README completeness, and package.json dependency hygiene. Output is a structured report grouped by severity, followed by a prioritised fix plan for critical and important findings.
Arguments
The user must provide:
- Package name — e.g.,
modal,button,popover(kebab-case directory name underpackages/components/)
If the package name was not provided, ask: "Which package would you like to audit? (e.g. modal, button, popover)"
Workflow
Step 1 — Locate the package
Find and read all source files for the package:
packages/components/<package-name>/src/ ← component source
packages/storybook/stories/components/<PascalName>/ ← stories
If the stories directory uses a different casing or name, search with:
packages/storybook/stories/components/**/<PascalName>*.stories.tsx
Read all relevant files before forming any judgements. Typical structure to read:
package.json— declared dependencies, peerDependencies, devDependencies<Name>.tsx— main component<Name>.types.ts/<Name>.types.tsx— prop types<Name>.styles.tsx/style/— styled-componentsindex.ts/index.tsx— public exports- Sub-component files in nested directories
- Custom hooks:
use*.ts/use*.tsx - Utility/helper files:
*utils*,*helpers*,*constants* __specs__/or*.test.tsx— unit tests*.stories.tsx— regular stories*.test.stories.tsx/*.tests.stories.tsx— interactive/play storiesREADME.md— package documentation
Step 2 — Run automated checks
Run these commands and capture the output; use findings to support manual analysis:
# Check for console.log / console.error / console.warn
grep -rn "console\." packages/components/<package-name>/src/ --include="*.ts" --include="*.tsx"
# Check for ts-ignore / ts-expect-error / @ts-nocheck
grep -rn "@ts-ignore\|@ts-expect-error\|@ts-nocheck" packages/components/<package-name>/src/
# Check for eslint-disable comments
grep -rn "eslint-disable" packages/components/<package-name>/src/
# List exported symbols from index
cat packages/components/<package-name>/src/index.ts 2>/dev/null || cat packages/components/<package-name>/src/index.tsx
# Count test files
find packages/components/<package-name>/src -name "*.test.tsx" -o -name "*.spec.tsx" | wc -l
# Count story files
find packages/storybook/stories/components/<PascalName> -name "*.stories.tsx" 2>/dev/null | wc -l
# Check README exists and get its size
wc -l packages/components/<package-name>/README.md 2>/dev/null || echo "MISSING"
# List all import statements in source files (to cross-reference against package.json)
grep -rh "^import" packages/components/<package-name>/src/ --include="*.ts" --include="*.tsx" | grep "from '" | sed "s/.*from '\\([^']*\\)'.*/\\1/" | grep -v '^\.' | sort -u
# Check for MDX overview
ls packages/storybook/stories/components/<PascalName>/Overview.mdx 2>/dev/null || echo "MISSING"
# List argTypes from stories
grep -A 1 "argTypes:" packages/storybook/stories/components/<PascalName>/<PascalName>.stories.tsx | head -30
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 280 lines · 41 tokens per session scan A aa005e8f6ac3
package-audit is a skill published in the GitHub repository Synerise/synerise-design (96 stars, last pushed yesterday), licensed MIT. It adds 41 tokens to every session and 3,647 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-04.
Other skills, from other repositories
compiler-commit
Use when you want to verify compiler changes and commit with the correct convention. Runs tests, lint, and format, then commits with the [compiler] or [rust-compiler] prefix.
compiler-verify
Use when you need to run all compiler checks (tests, lint, format) before committing. Detects whether TS or Rust code changed and runs the appropriate checks.
testing-react
Writes React/TypeScript tests using Vitest and React Testing Library. Use when "write react tests", "vitest", "component test", "hook test", "RTL", "testing library", "snapshot test", or testing React components, hooks, and utilities.
next-application-structure
Establishes or reviews directory layout, server/client boundaries, routing, data-fetching strategy, and testing structure for Next.js 14+ App Router TypeScript applications. Invoked when the user asks to structure a Next app, set App Router conventions, or review architecture for React parity.
Component Test Scaffold (Next.js)
Generate React/Next.js component test skeletons (RTL) from specifications.
Component Test Scaffold (React)
Generate generic React component test skeletons (RTL) from specifications.