Borrowing it
Nothing to install: this file belongs to Txpple/fvtt-mcp-molten5e. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/Txpple/fvtt-mcp-molten5e/main/.claude/skills/session-audit/SKILL.mdgit clone --depth 1 https://github.com/Txpple/fvtt-mcp-molten5eWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/txpple/fvtt-mcp-molten5e/session-audit)<a href="https://agentmods.dev/skills/txpple/fvtt-mcp-molten5e/session-audit"><img src="https://agentmods.dev/badge/skills/txpple/fvtt-mcp-molten5e/session-audit/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/txpple/fvtt-mcp-molten5e/session-audit"><img src="https://agentmods.dev/badge/skills/txpple/fvtt-mcp-molten5e/session-audit.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00258 | $0.03299 |
| Opus 5 | $0.00129 | $0.01649 |
| Sonnet 5 | $0.00052 | $0.00660 |
| Haiku 4.5 | $0.00026 | $0.00330 |
Grade A, and why
session-audit scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 212 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Session and campaign audit
A DM who has just finished building a dungeon cannot see it. They know every room, so they cannot feel the fourth hour of it, and they have never once added up how many hit points they placed. This skill is the outside reader: it reads what is actually on the maps, does the arithmetic the DM never does, and reports what will really happen on the night. The tools own the reads; this skill owns the judgment — which axis is off, what the numbers mean, and which changes are worth making.
Numbers before opinions, and read-only throughout. Every claim in the report traces to a live read or to a stated formula. An audit that guesses is worse than no audit, because it reads as authoritative. Change nothing in the world unless the user says go.
Step 0 — ultracode, then the brief
An audit is a wide read: every PC sheet, every placed token, every magic item, the plot doc, the session history. At ordinary effort a model samples instead of sweeping, and a sampled audit is the dangerous kind — confident, tidy, and blind to the one room that breaks the night.
Ultracode state arrives in a system reminder. If it says on, say so in one line and proceed. If it says off — or nothing says either way — tell the user audits run best with it on and ask whether to enable it or go ahead anyway, then honor the answer without arguing it twice. Never guess: claiming a mode you cannot actually see is the same failure the rest of this skill exists to prevent.
Then take the brief. Ask only what you cannot read: which session, which site, the play date, and how many hours the table actually has. Assumptions the user hands you are binding — "assume Morgash takes the maul, Gren the pearl" is an instruction, not a hypothesis. If a stated assumption is factually off (they say axe, the sheet says maul), correct it in one line and carry on with their intent; do not stop to litigate it.
Step 1 — read wide, in this order
| Surface | Tools | What you are actually after |
|---|---|---|
| PC sheets | get-actor per PC |
AC, HP, saves, and whether they have Extra Attack yet |
| Magic items | get-actor-entity on every attuned/equipped magic item |
the item's real mechanics |
| The stash | get-group |
loot nobody is carrying — that is a finding, not background |
| The site | list-scenes then list-tokens per scene |
the roster as actually placed |
| The monsters | get-actor on the placed token id |
that instance's delta, not the library actor |
| Signature abilities | get-actor-entity on multiattack + the gimmick |
the activity, not the name |
| Intent | list-journals (the GM key), plot/, newest gm-notes.md |
what the build was supposed to be |
| The ground | screenshot-scene on combat maps only |
chokepoints, approach length, sightlines |
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 212 lines · 258 tokens per session scan A 6469c7c7ee6e
session-audit is a skill published in the GitHub repository Txpple/fvtt-mcp-molten5e (0 stars, last pushed today), licensed MIT. It adds 258 tokens to every session and 3,299 once invoked, about $0.0013 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
gameobject-component-destroy
Destroy one or more Components from a target GameObject. Missing (null) components are skipped — they cannot be destroyed. Use 'gameobject-find' and 'gameobject-component-get' to identify the components first.
unity-version-split
Split a C# file into Unity 6.5+ and pre-Unity 6.5 variants. Use when a file needs different implementations for different Unity versions due to API changes (e.g., EntityId vs int, GetEntityId vs GetInstanceID).
godot-signals-groups
Build event-driven, decoupled Godot 4.7 gameplay with signals and node groups: declare and emit custom signals, connect with Callables (incl. bind/one-shot), and broadcast to many nodes via groups and callgroup. Use when wiring node communication in a Godot project, replacing tight references with signals…
unity-addressables
Manage Addressables groups, entries, profiles and content builds (com.unity.addressables, reflection-based).
motion
How an agent turns a character mesh into a usable animated FBX — and how to judge whether the result is shippable.
playtest-report
Generates a structured playtest report template or analyzes existing playtest notes into a structured format. Use this to standardize playtest feedback collection and analysis.