Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/vasihemanth/tokentelemetry/bug-auditnpx skills add VasiHemanth/tokentelemetry --skill bug-auditgit clone --depth 1 https://github.com/VasiHemanth/tokentelemetryWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00000 | $0.01018 |
| Opus 5 | $0.00000 | $0.00509 |
| Sonnet 5 | $0.00000 | $0.00204 |
| Haiku 4.5 | $0.00000 | $0.00102 |
Grade A, and why
bug-audit scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 81 lines — stays where its author put it; the contents beside it link to each section on GitHub.
bug-audit — weekly serious-bug sweep
Multi-agent audit of the TokenTelemetry backend/frontend for the bug class that motivated it (PR #131: a silent 100-session cap plus stub rows crushing real persisted data). Optimized for bugs that corrupt data, lose data, or silently report wrong numbers — not style or hypotheticals.
Scope selection (do this first)
- Find the last audit marker: the most recent GitHub issue labeled
bug-audit(gh issue list --label bug-audit --state all --limit 1), whose body records the commit it audited up to. - Primary scope =
git diff <last-audited-commit>..HEADplus any file those diffs touch. If no marker exists (first run), scope =backend/*.pyandfrontend/src/lib+frontend/src/app. - Always include the standing hot-spots regardless of diff:
backend/main.pyscan loops,backend/history_store.py,backend/scan_cache.py(if present), anything matchingbackend/*cache*/backend/*store*.
Fan-out (Agent tool; run each wave's spawns in parallel)
Wave 1 — breadth, audit-scanner (Sonnet), one per dimension:
- silent caps & truncation (slices, LIMIT, early breaks,
[:N]) - persisted-state integrity (upserts that overwrite, absent-vs-zero confusion, stub/partial rows)
- cache & staleness (mtime keys, missing version fields, invalidation gaps)
- timestamp/timezone math (naive datetimes, mtime-as-date, day bucketing)
- trust boundaries (on-disk ids/paths/cwd used in paths, SQL, shell)
- token/cost arithmetic (double counting, high-water-mark vs sum, unit slips)
Give each scanner the scope file list and its dimension. Prompt them to return the FINDING-block format their agent definition specifies.
Wave 2 — depth, audit-deep (Opus), in the same parallel batch as wave 1:
one per risky subsystem actually present in scope, typically 2-4 of:
- scan → cache → history-upsert pipeline (the PR #131 path)
- one agent-store parser that changed recently (Claude, Codex, Copilot…)
- any new persisted format introduced since the last audit
- the analytics aggregation path (
/analytics, ecosystem rollups)
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 81 lines · 0 tokens per session scan A f5c43c088ec8
bug-audit is a skill published in the GitHub repository VasiHemanth/tokentelemetry (340 stars, last pushed today), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 1,018 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
browser-use
Drive agentglass's built-in browser — the one already signed in to the sites this project uses. Use when a task needs a page behind a login (a dashboard, a ticket, a staging app), when a URL fetched with curl comes back signed out or JavaScript-rendered, or when the user asks you to look at, click through, or…
go-rig
Use this skill when building, reviewing, or refactoring Go code that must follow strict design discipline — ATDD/TDD workflow, explicit dependency injection, package-boundary discipline, and structured code review. Complements CLAUDE.md by focusing on process and design judgment rather than version-specific Go…
frontend-dashboard
Use this skill when editing the embedded dashboard frontend in this repository. It focuses on preserving the single-file embedded SPA model, keeping the UI lightweight, and avoiding unnecessary frontend tooling or dependencies.
go-review
Use this skill when the task is to review Go code in this repository. Focus on bugs, regressions, API compatibility, test gaps, concurrency risks, and violations of the zero-dependency and root-facade constraints.
project-ops
Use this skill when working on repository operations in this project, including build, test, lint, release, CI alignment, Makefile-driven checks, and operational packaging constraints.
git-commit-helper
Generates meaningful git commit messages for Spec-Driven Development workflows. Use when creating commits, suggesting commit messages, or helping with task-based version control. Automatically links commits to work packages.