Borrowing it
Nothing to install: this file belongs to vlad-ryzhkov/ai-context-engineering-for-qa. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/vlad-ryzhkov/ai-context-engineering-for-qa/main/.claude/skills/skill-audit/SKILL.mdgit clone --depth 1 https://github.com/vlad-ryzhkov/ai-context-engineering-for-qaWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/vlad-ryzhkov/ai-context-engineering-for-qa/skill-audit)<a href="https://agentmods.dev/skills/vlad-ryzhkov/ai-context-engineering-for-qa/skill-audit"><img src="https://agentmods.dev/badge/skills/vlad-ryzhkov/ai-context-engineering-for-qa/skill-audit/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/vlad-ryzhkov/ai-context-engineering-for-qa/skill-audit"><img src="https://agentmods.dev/badge/skills/vlad-ryzhkov/ai-context-engineering-for-qa/skill-audit.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00053 | $0.04034 |
| Opus 5 | $0.00026 | $0.02017 |
| Sonnet 5 | $0.00011 | $0.00807 |
| Haiku 4.5 | $0.00005 | $0.00403 |
Grade A, and why
skill-audit scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 355 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Skill Audit
Status: private successor. This version works and is maintained enough to use, but the author runs a non-public variant that scores each finding against a graded rubric with a pass threshold instead of emitting an unweighted list. Fixes land there first. For a public alternative that grades a whole harness, see vigiles. Status vocabulary:
SKILLS.md.
Audit AI instructions for efficiency: detect bloat, duplication, harmful patterns.
Before You Start
Read:
.claude/qa_agent.md.claude/skills/init-skill/references/validation-checklist.md— line thresholds and required sections.claude/skills/init-skill/references/yaml-reference.md— YAML frontmatter rules
When to Use
- After creating a new skill via
/init-skill - When a skill is suspected of excessive token usage
- Periodically (once per sprint) for all skills
- After updating CLAUDE.md or qa_agent.md
Input
| Parameter | Required | Description |
|---|---|---|
| Scope | Optional | Path to a specific skill or "all". Defaults to all skills |
Algorithm (11 Checks)
Verbosity Protocol
Structured Output Priority: All analysis goes into the artifact (MD/HTML), not into chat.
Chat output (constraints):
- Brief Summary: max 5 lines (what was found, count, verdict)
- Full report:
📊 Full report: {path}+ open file
Iterative steps: Do not output progress per file. Checkpoint only on:
- Phase transition (Phase N → Phase N+1)
- Blocker detected
- Completion (SKILL COMPLETE)
Tools first:
- Grep → table → report, no "Now I will grep..."
- Read → analyze → report, no "The file shows..."
Post-Check: Inline before SKILL COMPLETE (5–7 line checklist), not a separate file.
Check 0: Standards Drift
Verify that thresholds in this SKILL.md match init-skill/references/validation-checklist.md:
- SKILL.md line limit (current checklist value: ≤500)
- Required YAML frontmatter fields
- Required content sections
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday Changed · +334 lines · +35 tokens per session eacb6174daa7
- 10d ago First seen · 21 lines · 18 tokens per session scan A 1962f3336722
skill-audit is a skill published in the GitHub repository vlad-ryzhkov/ai-context-engineering-for-qa (6 stars, last pushed yesterday), licensed Unlicense. It adds 53 tokens to every session and 4,034 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
effective-kotlin
Apply Effective Kotlin best practices (Marcin Moskała, 2nd Ed). Covers Safety (Items 1-10: mutability, scope, nulls, types, expectations, errors, resources, tests), Readability (Items 11-18: operators, receivers, properties, naming), Reusability (Items 19-25: DRY, generics, delegation, variance), Abstraction (Items…
cat:stakeholder-review
Multi-perspective quality review gate with architect, security, quality, tester, and performance stakeholders.
render-diff
MANDATORY: Use BEFORE showing ANY diff to user - transforms git diff into 4-column table with box characters (╭╮╰╯│). Required for approval gates, code reviews, change summaries.
debriefing-code-changes
Debriefs a developer after an AI-assisted coding session by inspecting git diffs or commits, explaining the actual architecture decisions, design patterns, tradeoffs, caveats, and learning concepts with file/function references, then generating a practical quiz and follow-up study notes. Use when the user says they…
swarm-pr-review
Run a graph-guided, tool-augmented PR review using context packing, parallel exploration, mandatory repository-agnostic risk-family coverage with dispatch scaled to diff size and risk, independent reviewer validation, critic challenge, and metrics writeback. Use for deep pull request review with low false-positive…
review
Validate plans, execution, or PRs against wish criteria — returns SHIP / FIX-FIRST / BLOCKED with severity-tagged gaps.