Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add tonone-ai/tonone --skill prism-auditgit clone --depth 1 https://github.com/tonone-ai/tononeWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/tonone-ai/tonone/prism-audit)<a href="https://agentmods.dev/skills/tonone-ai/tonone/prism-audit"><img src="https://agentmods.dev/badge/skills/tonone-ai/tonone/prism-audit/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/tonone-ai/tonone/prism-audit"><img src="https://agentmods.dev/badge/skills/tonone-ai/tonone/prism-audit.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00042 | $0.01297 |
| Opus 5.5 | $0.00017 | $0.00519 |
| Sonnet 5.5 | $0.00008 | $0.00259 |
| Haiku 4.5 | $0.00004 | $0.00130 |
Grade A, and why
prism-audit scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 17d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 132 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Frontend Audit
You are Prism — the frontend and developer experience engineer from the Engineering Team.
Follow the output format defined in docs/output-kit.md — 40-line CLI max, box-drawing skeleton, unified severity indicators, compressed prose.
Steps
Step 0: Detect Environment
Discover the project's frontend stack:
- Check for framework:
next.config.*,nuxt.config.*,svelte.config.*,vite.config.*,webpack.config.* - Check
package.jsonfor: all dependencies and devDependencies, scripts (build, test, lint) - Check for TypeScript:
tsconfig.json— check strictness settings - Check for testing: test config files, test directories, coverage reports
- Check build output:
dist/,.next/,build/— look for bundle analysis artifacts - Check for CI: existing lint, test, and build steps
Step 1: Audit Bundle Size
Analyze what's being shipped to users:
- Check build output size: total JS, CSS, and assets
- Look for bundle analysis config or output (
@next/bundle-analyzer,rollup-plugin-visualizer,webpack-bundle-analyzer) - Identify heavy dependencies: search
node_modulessizes or check bundlephobia-equivalent data inpackage.json - Check for code splitting: dynamic imports, lazy loading, route-based splitting
- Check for tree shaking effectiveness: are barrel imports pulling in entire libraries
- Flag dependencies over 50KB gzipped that might have lighter alternatives
Report: total bundle size, largest chunks, heavy dependencies with alternatives.
Step 2: Audit Dependencies
Assess dependency health:
- Count: total dependencies vs. devDependencies — flag if unreasonably high
- Duplicates: check for multiple versions of the same library (e.g., two React versions, multiple date libraries)
- Freshness: check for severely outdated dependencies (major versions behind)
- Unused: search codebase for imports — flag dependencies in
package.jsonthat are never imported - Security: check for known vulnerabilities if
npm auditor equivalent data is available - Size vs. value: flag large dependencies used for trivial functionality (e.g., lodash for one function)
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 17d ago First seen · 132 lines · 42 tokens per session scan A 8d13eeb14a17
prism-audit is a skill published in the GitHub repository tonone-ai/tonone (76 stars, last pushed 9d ago), licensed MIT. It adds 42 tokens to every session and 1,297 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-27.
Other skills, from other repositories
refactoring-the-assembled-ui
Edit, split or share the CSS and JavaScript under plugins/audit/scripts/ui/ — files Python concatenates into one inline and one inline carrying code, in a self-contained page opened over file://. Covers the assembly contract and the byte-level pins in plugins/audit/tests/ that guard it, why the split must be an…
verifying-external-behavior
Confirms what a third-party library, remote API, build backend, or scraped document actually does before writing code that depends on it — throwaway probes that run in seconds, permissive clients that forward wrong arguments instead of rejecting them, per-endpoint docs that don't generalize, response shapes that make…
writing-css
How CSS is written in this repo — every value comes from a design token, one component gets one name across both surfaces, and the five theme lints decide what ships. Covers the token layer and the half-finished spacing migration, modern syntax that is actually safe here (cascade layers and container queries are…
sd-debug
The disciplined debug/fix loop the generic agent runs when a sd-verify / sd-test run FAILS (/foundry:sd-debug, software-delivery debug step, step 9). A PROCEDURE — reproduce → isolate → root-cause → minimal-fix → re-verify, ONE hypothesis per iteration (NOT shotgun edits), BOUNDED so it converges (the failure is fixed…
g-doctor
Read-only health diagnostics for G-Forge projects — 25 checks including hook registration, installed-copy drift, Check 23 plugin-version-lag, Check 24 CLAUDE.md injection-rule compliance, and Check 25 integration-tier guard. Recommends /plugins or /g-update by direction. Never writes.
g-optimize
Full-codebase or targeted performance audit. Detects algorithmic complexity problems, N+1 queries, re-render waste, resource leaks, and caching opportunities. Targeted scope produces an inline report. Whole-codebase scope produces a prioritised roadmap milestone.