Borrowing it
Nothing to install: this file belongs to VasiHemanth/tokentelemetry. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/VasiHemanth/tokentelemetry/main/.claude/skills/bug-audit/SKILL.mdgit clone --depth 1 https://github.com/VasiHemanth/tokentelemetryWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/vasihemanth/tokentelemetry/bug-audit)<a href="https://agentmods.dev/skills/vasihemanth/tokentelemetry/bug-audit"><img src="https://agentmods.dev/badge/skills/vasihemanth/tokentelemetry/bug-audit/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/vasihemanth/tokentelemetry/bug-audit"><img src="https://agentmods.dev/badge/skills/vasihemanth/tokentelemetry/bug-audit.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00000 | $0.01018 |
| Opus 5.5 | $0.00000 | $0.00407 |
| Sonnet 5.5 | $0.00000 | $0.00204 |
| Haiku 4.5 | $0.00000 | $0.00102 |
Grade A, and why
bug-audit scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 81 lines — stays where its author put it; the contents beside it link to each section on GitHub.
bug-audit — weekly serious-bug sweep
Multi-agent audit of the TokenTelemetry backend/frontend for the bug class that motivated it (PR #131: a silent 100-session cap plus stub rows crushing real persisted data). Optimized for bugs that corrupt data, lose data, or silently report wrong numbers — not style or hypotheticals.
Scope selection (do this first)
- Find the last audit marker: the most recent GitHub issue labeled
bug-audit(gh issue list --label bug-audit --state all --limit 1), whose body records the commit it audited up to. - Primary scope =
git diff <last-audited-commit>..HEADplus any file those diffs touch. If no marker exists (first run), scope =backend/*.pyandfrontend/src/lib+frontend/src/app. - Always include the standing hot-spots regardless of diff:
backend/main.pyscan loops,backend/history_store.py,backend/scan_cache.py(if present), anything matchingbackend/*cache*/backend/*store*.
Fan-out (Agent tool; run each wave's spawns in parallel)
Wave 1 — breadth, audit-scanner (Sonnet), one per dimension:
- silent caps & truncation (slices, LIMIT, early breaks,
[:N]) - persisted-state integrity (upserts that overwrite, absent-vs-zero confusion, stub/partial rows)
- cache & staleness (mtime keys, missing version fields, invalidation gaps)
- timestamp/timezone math (naive datetimes, mtime-as-date, day bucketing)
- trust boundaries (on-disk ids/paths/cwd used in paths, SQL, shell)
- token/cost arithmetic (double counting, high-water-mark vs sum, unit slips)
Give each scanner the scope file list and its dimension. Prompt them to return the FINDING-block format their agent definition specifies.
Wave 2 — depth, audit-deep (Opus), in the same parallel batch as wave 1:
one per risky subsystem actually present in scope, typically 2-4 of:
- scan → cache → history-upsert pipeline (the PR #131 path)
- one agent-store parser that changed recently (Claude, Codex, Copilot…)
- any new persisted format introduced since the last audit
- the analytics aggregation path (
/analytics, ecosystem rollups)
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 81 lines · 0 tokens per session scan A f5c43c088ec8
bug-audit is a skill published in the GitHub repository VasiHemanth/tokentelemetry (386 stars, last pushed yesterday), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 1,018 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
code-review
Performs structured code review on a file or directory.
gini-bug-report
File a locally-captured, already-redacted Gini crash report as a GitHub issue, with the user's consent. Reads the pending crash queue and delegates the actual filing to the github-issues skill.
systematic-debugging
Four-phase root cause investigation for bugs and unexpected behavior.
network-diagnostics
Windows net diag: ping, traceroute, DNS, port scan (PowerShell).
webapp-testing
Toolkit for interacting with and testing local web applications using Playwright. Supports verifying frontend functionality, debugging UI behavior, capturing browser screenshots, and viewing browser logs.
bug-report-triage
Turn a customer's description of a problem into a bug report an engineer can reproduce.