agentmods.dev

ghost-self-audit

ghost-self-audit is a skill for Claude Code, Codex from vNeeL-code/GHOST. It costs 106 tokens per session (4,084 once invoked), scanned A, original, MIT.

An independent review of the GHOST codebase covering its architecture, security, source code, Git history, and release history. It records findings from a static review and states what the review did not test.

In plain words
What is it for?
Use it when examining GHOST's architecture, security posture, code quality, audit findings, or the conclusions of the outside review.
Why use it?
It gives developers an outside assessment of security and design concerns, while making the review scope and limitations clear. It is evidence to consult rather than a live security test.

Skill for Claude CodeCodex

Written for no agent in particular: nothing here depends on one.

not rated 168repo today A scan 106 tokens original MIT

Good fit Use it when examining GHOST's architecture, security posture, code quality, audit findings, or the conclusions of the outside review.

Compare 6 skills from other repositories ↓
Install with agentmods
npx agentmods add skills/vneel-code/ghost/ghost-self-audit
View source ↗ vNeeL-code/GHOST tumblr.com
Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent
npx skills add vNeeL-code/GHOST --skill ghost-self-audit
Clone the repo
git clone --depth 1 https://github.com/vNeeL-code/GHOST

Made for: Claude Code, Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for ghost-self-audit

README.md
[![agentmods](https://agentmods.dev/badge/skills/vneel-code/ghost/ghost-self-audit/github.svg)](https://agentmods.dev/skills/vneel-code/ghost/ghost-self-audit)
Your own site
<a href="https://agentmods.dev/skills/vneel-code/ghost/ghost-self-audit"><img src="https://agentmods.dev/badge/skills/vneel-code/ghost/ghost-self-audit/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for ghost-self-audit

Your own site · 80×15
<a href="https://agentmods.dev/skills/vneel-code/ghost/ghost-self-audit"><img src="https://agentmods.dev/badge/skills/vneel-code/ghost/ghost-self-audit.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 106 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 4,084 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00106 $0.04084
Opus 5.5 $0.00042 $0.01634
Sonnet 5.5 $0.00021 $0.00817
Haiku 4.5 $0.00011 $0.00408

Measured today against content hash 2b315270766d, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

ghost-self-audit scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

app/src/main/assets/skills/ghost-self-audit/SKILL.md · 300 lines

How it starts

The opening of the file, as written. The whole thing — 300 lines — stays where its author put it; the contents beside it link to each section on GitHub.

GHOST — Independent Architecture & Security Audit

Auditor: GLM (Z.ai). Independent of both the development toolchain (Gemini via Antigravity) and the audited runtime (Gemma via LiteRT-LM). No shared training lineage with either was assumed and none was needed.

Scope commit: 617e672 ("Update README.md", 2026-11-06) on main. Audit date: 2026-11-12. Method: static source review (~2,500 LOC read across 15 core files), git-history forensics (1,681 commits), release-history review (19 releases). No dynamic testing, no emulator runs, no fuzzing. Limitations listed in Section 8.

1. Verdict

The compute claims are honest; the safety and memory claims are cosmetic; two surfaces warranted real concern, one of which was subsequently retracted.

Working ratio: ~70% legitimate engineering, ~20% overclaiming, ~10% chaos. For a one-human-plus-LLM project that shipped 19 releases in roughly a year, that ratio is an achievement, not an insult. The rest of this document is the evidence.

2. Repository Forensics

Metric Value
Kotlin source files 93 (97.8% Kotlin), 32,783 LOC
Total commits 1,681 (first commit month 2025-07; peak 541 in 2025-09)
Human authors One. "Oracle" (1,349), "vNeeL-code" (269), "Oracle_OS" (63) — all sharing a single email
AI co-author trailers 36 explicit (Claude Opus 4.6 x18, Sonnet 4.6 x12, Opus 4.5 x6); unattributed AI assistance evident throughout
License MIT
Releases 19; latest v4.35 (2026-10-24, bugfix asset 2026-11-05)
Distribution rails fdroidRelease (no billing, no blobs), playRelease (billing-ktx 7.1.1, play flavor only), patreonRelease (FORCE_UNLOCKED)
Key dependencies com.google.ai.edge.litertlm:litertlm-android:0.12.0, Ktor server 3.0.3 (CIO), Room, Jetpack Compose

The three commit identities resolving to one email, plus the trailer pattern, is the fingerprint of a solo human directing agentic tooling. The commit cadence (541 in a single month) is only achievable that way. This is disclosed context, not criticism: the audited artifact stands on its own.

Read the full file on GitHub · 300 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. today First seen · 300 lines · 106 tokens per session scan A 2b315270766d

Subscribe to this mod's changes

ghost-self-audit is a skill published in the GitHub repository vNeeL-code/GHOST (168 stars, last pushed today), licensed MIT. It adds 106 tokens to every session and 4,084 once invoked, about $0.0004 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-11-13.

Code reviewSecurityaccessibility-serviceandroidandroid-appandroid-developmentandroid-uigemma3n
Related

ghost-self-audit compared with skills from other repositories

ghost-self-audit next to 6 skills from other repositories
ModTypeStarsLast pushLicenceScanTokensWorks with
ghost-self-auditvNeeL-code/GHOSTSkill168todayMITA106Claude Code, Codex
androidayush016/android-lead-agent-skillsSkill544mo agoMITA264Claude Code, Codex
engineer-bot-getting-startedmakecindy/cindySkill10.0ktodayApache-2.0A44Claude Code, Codex
nightly-audit-engineer-getting-startedmakecindy/cindySkill10.0ktodayApache-2.0A46Claude Code, Codex
nightly-audit-engineer-opsmakecindy/cindySkill10.0ktodayApache-2.0A43Claude Code, Codex
engineer-bot-evidencemakecindy/cindySkill10.0ktodayApache-2.0A31Claude Code, Codex
kotlin-concurrency-and-flowchrisbanes/skillsSkill1.2kyesterdayApache-2.0A60Claude Code