Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/thesyart/emperor-agent/code-auditnpx skills add TheSyart/emperor-agent --skill code-auditgit clone --depth 1 https://github.com/TheSyart/emperor-agentWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/thesyart/emperor-agent/code-audit)<a href="https://agentmods.dev/skills/thesyart/emperor-agent/code-audit"><img src="https://agentmods.dev/badge/skills/thesyart/emperor-agent/code-audit.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00072 | $0.01967 |
| Opus 5 | $0.00036 | $0.00983 |
| Sonnet 5 | $0.00014 | $0.00393 |
| Haiku 4.5 | $0.00007 | $0.00197 |
Grade A, and why
code-audit scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Runs shell commandslowCapability
Expected in a hook, worth knowing in a rule or an instructions file.
1. `subprocess.run(..., shell=True)` 无 `timeout` / 无 `cwd` 限制 → RCE How it starts
The opening of the file, as written. The whole thing — 133 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Code Audit
按"先证据、后判断、再路线图"的顺序产出一份能落地的审计报告。
工作铁律
- 不要凭印象填表。每次开工先跑
scripts/recon.sh拿硬数据，所有评分必须有命令输出 / 文件:行号兜底。 - 每个问题三件套：
file:line+ 代码片段（≤ 6 行）+ 修复 patch（伪代码或具体 diff）。少一件就不算合格。 - 风险 = 缺陷 × 部署上下文。同一个
shell=True，CLI 个人脚本 = 低；暴露端口的 WebUI = 极高。审计前先问清楚"打算给谁用 / 怎么部署"。 - 三段式路线图，不开扁平 todo：P0 止血（安全 / 数据正确性） → P1 提质（测试 / 日志 / 工程化） → P2 升级（架构 / 商业化）。
- 诚实打分，不调和。0 测试给 0/10；后面写"作为个人项目可接受"的语境注脚就行。
- 节省 round-trip。Bash 调用尽量串多条命令；同一个文件优先 outline（grep
def/class）再按行号 sed。
五阶段流程
阶段 0 · 定调（≤ 30 秒，一次到位）
跟用户或当前上下文确认三件事，三件都不知道就先问再做：
- 项目类型：Web 前端 / 后端 / 全栈 / Agent / 库 / CLI 工具
- 部署上下文：纯本地脚本？SaaS？多租户？开源给极客？
- 审计目的：拿来评 PR / 准备发版 / 决定是否商业化 / 接手二开
定调决定后续每个评分的语义。没有部署上下文就给安全打分是没意义的。
阶段 1 · 侦察（≤ 5 分钟，跑脚本）
调用 scripts/recon.sh。它一次性产出：
- 顶层目录 + 工程化文件存在性（pyproject、Dockerfile、CI、lint 配置 …）
- LoC 排序前 15 文件（god class 嫌疑）
- 总代码量
- 测试文件计数
- print / logger / except 计数
- 依赖文件原文（requirements / package.json / go.mod 等）
- git 基本信息（提交数、贡献者、热点文件、最近 90 天 churn）
- 危险代码 pattern grep（
shell=True、eval(、exec(、pickle.loads、明文密钥模式）
把脚本输出整段贴到草稿区，全部审计结论从这里取证。脚本输出本身不直接进最终报告，是工作底稿。
阶段 2 · 定向探查（按发现深入）
根据侦察结果挑 ≤ 5 个最可疑点深读，每点用 Read/grep -n 拿到精确 file:line。常见入口：
- 最大文件 → outline 是否单一职责
- 安全敏感文件（auth/security/shell/filesystem/upload）→ 围栏检查
- 配置回传路径（config payload / bootstrap API）→ 密钥脱敏检查
- 异常处理热区 → 是否吞 traceback
- 公网入口（HTTP/WS handler）→ 鉴权 + 输入校验
每点产出一段笔记：现状代码片段 + 问题机制 + 影响 + 修复 sketch。
阶段 3 · 填表（按用户提供模板或 templates/audit-report.md）
把第 1–2 阶段的笔记填进模板。规矩：
- 每个"分析"段落 ≤ 5 行；超 5 行说明在塞水。
- 每个评分给一行依据：
X/10 —— 因为 [证据]。 - "解决方案"必须给具体 patch（10–30 行内），不写"建议加日志"这种废话。
- 最后"下一步最优先 3 件事"按工时估算（4h / 半天 / 1 天），让用户能立即排期。
阶段 4 · 自检（提交前）
读自己的报告一遍，碰到这些信号就退回去补：
- 出现"建议提高 / 加强 / 优化"等动词无宾语 → 改成具体动作
- 出现整段没有
file:line或代码块 → 加证据 - 评分跨度 < 4 分（全 6/10）→ 多半在和稀泥，重新盘
- 路线图扁平没分阶段 → 拆 P0/P1/P2
- 安全章节没"如果在公网会怎样"的反例 → 补
红旗目录（按出现频率排）
详见 references/red-flags.md。最常见 10 项：
What ships with it
5 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 133 lines · 72 tokens per session scan A 6b9b3f6a3a72
code-audit is a skill published in the GitHub repository TheSyart/emperor-agent (182 stars, last pushed 23d ago), licensed MIT. It adds 72 tokens to every session and 1,967 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 1 finding (runs shell commands). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
skill-creator
Create, install, or update skills in the workspace. Use when (1) installing a skill from a URL or remote source, (2) creating a new skill from scratch, (3) updating or restructuring existing skills. Always use this skill for any skill installation or creation task.
image-generation
Generate or edit images from text prompts. Use when the user asks to create, draw, design, or edit an image, illustration, photo, icon, poster, or any visual content.
knowledge-wiki
Manage the personal knowledge wiki. Use when the user shares articles, documents, or asks to organize knowledge; when a conversation produces insights worth preserving as structured knowledge; or when the user asks about the knowledge base.
smart-docs
AI-powered comprehensive codebase documentation generator. Analyzes project structure, identifies architecture patterns, creates C4 model diagrams, and generates professional technical documentation. Use when users need to document codebases, understand software architecture, create technical specs, or generate…
litho-document-skill
This skill should be used when the user asks to "generate project documentation", "analyze codebase architecture", "create C4 architecture diagrams", "document a repository", "generate technical docs", "使用 Litho 生成文档", "分析代码库架构", "生成架构文档", "为项目生成技术文档", "生成 C4 模型文档", "为这个项目写文档", "自动生成文档", "帮我分析这个代码库", or any request…
ai-context-generator
Generates .ai-context knowledge base for coding agents. Activate when: (1) setting up a new project for AI-assisted development, (2) user asks to "create project knowledge" or "setup ai-context", (3) existing .ai-context needs regeneration. Creates tiered documentation structure optimized for agent comprehension and…