Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add wardawgmalvicious/agent-config --skill drift-auditgit clone --depth 1 https://github.com/wardawgmalvicious/agent-configWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/wardawgmalvicious/agent-config/drift-audit)<a href="https://agentmods.dev/skills/wardawgmalvicious/agent-config/drift-audit"><img src="https://agentmods.dev/badge/skills/wardawgmalvicious/agent-config/drift-audit/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/wardawgmalvicious/agent-config/drift-audit"><img src="https://agentmods.dev/badge/skills/wardawgmalvicious/agent-config/drift-audit.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00217 | $0.11114 |
| Opus 5.5 | $0.00087 | $0.04446 |
| Sonnet 5.5 | $0.00043 | $0.02223 |
| Haiku 4.5 | $0.00022 | $0.01111 |
Grade A, and why
drift-audit scanned grade A with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Reads agent configuration directorieslowAgent snooping
.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.
- **Harness match** — `Read ~/.claude/settings.json` for the hook event wiring, permissions, and env keys currently in use; `Glob ~/.claude/hooks/*` and `Grep` them for event names and hook JSON fields; `Grep` skill / su Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
**Bash has one sanctioned use: upstream bytes in the session scratchpad.** `git clone` or `curl` a registered source into a new directory there, then list, show, diff and extract inside it (§ 4a), writing any script or t How it starts
The opening of the file, as written. The whole thing — 277 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Drift audit
Audit the source markdown of registered upstream docs pages against the local Claude config — skills, rules, CLAUDE.md, MCP templates — and emit a structured findings report. Inline execution; the report stays in the conversation so the user can iterate on follow-up actions.
Read-only — never modify any artifact this turn. Rewriting a skill / rule / CLAUDE.md / MCP template based on the findings is a separate, per-artifact task initiated after this audit completes.
1. Sources
The audit input is a registry, not a fixed pair of pages. At the start of every run, Read references/sources.md, which holds the schema and the shape contracts, then each selected source's own file, references/sources/<id>.md: the ids --sources names, or with no --sources every file there. List them with Glob, pattern *.md, path this skill's references/sources/ directory. A pattern carrying a / is matched from the working directory, not from path, whenever path sits inside it: references/sources/*.md under the skill's own directory answers No files found with every file present, while the same files spelled from the repo root, .claude/skills/drift-audit/references/sources/*.md, list them all under that same path, and Grep's glob behaves the same (2026-10-08, CLI 2.1.292; first seen 2026-10-06, 2.1.291). Only under a path outside the working directory is such a pattern matched from path. A pattern with no / matches at any depth under path, inside the working directory or out, which is why this lookup uses one. A lookup that finds no file has failed; it never means an empty registry — stop and say so. Drive the pipeline from them. Never hardcode a repo, path, section heading, or doc host into the run — if something needed for a source isn't in its registry entry, the entry is incomplete and that is the finding.
Each entry carries an id (what --sources matches), its GitHub repo / branch / path (plus files, when that path is a directory) or plain url, a shape (table / prose / changelog) that drives extraction, sections for the WebFetch fallback, a drill block (host, mechanism, anchor-strip patterns) for Phase 3, and the artifacts classes it can produce findings against. The registry's Shape contracts section defines what "an entry" means per shape; its Adding a source checklist is the procedure for widening the audit.
What ships with it
6 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 6d ago Changed · +12 lines · -7 tokens per session 4cba7f9c7c30
- 9d ago Changed · +21 lines · +7 tokens per session b01c78dbb6f9
- 10d ago Changed · +23 lines 5d0b2d190910
- 12d ago Changed 7f2f8ae5d198
- 15d ago Changed fa8b00065daa
- 18d ago Changed 7fbc493b03a5
- 19d ago Changed a39844237225
- 20d ago Changed bd3654df8a99
- 1mo ago Changed 3e21d497993b
- 1mo ago First seen · 221 lines · 217 tokens per session scan A 50af4785c175
drift-audit is a skill published in the GitHub repository wardawgmalvicious/agent-config (1 stars, last pushed 7d ago), licensed MIT. It adds 217 tokens to every session and 11,114 once invoked, about $0.0009 per session on Opus 5.5. A static security scan graded it A with 2 findings (reads agent configuration directories, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
fabric-cli
Expert guidance for the Fabric CLI (fab) and the Fabric and Power BI REST APIs: workspaces, items, lakehouses, notebooks, pipelines, semantic models, reports, capacities, OneLake, deployment and admin. Also estimates the capacity units (CU) an operation will consume and its impact on the capacity before running it.…
connect-pbid
TOM and ADOMD.NET guidance via PowerShell for connecting to Power BI Desktop's local Analysis Services instance. Covers model enumeration, DAX queries, metadata modification, annotations, calendar definitions, field parameters, query tracing, DAX library package management (daxlib.org), and the Desktop Bridge for…
pbir-cli
This skill should be used whenever the user mentions "pbir", "pbir-cli", "Power BI reports", or "PBI reports", works with .pbir, .pbip, or .pbix files, or wants to refresh, screenshot, or visually verify a report that is open in Power BI Desktop. Covers creating, exploring, formatting, validating, and publishing Power…
tmdl
Direct TMDL file authoring and BIM-to-TMDL conversion for semantic models in PBIP projects. Automatically invoke when the user asks to "edit TMDL", "add a measure in TMDL", "TMDL syntax", "fix formatString", "fix summarizeBy", "TMDL indentation", "convert BIM to TMDL", "add a column description", "create a calculated…
pbi-report-design
The Power BI report design canon covering design identity, visual hierarchy and the 3-30-300 rule, layout/spacing/alignment, color discipline, chart selection, KPI and card design, tables and matrices, accessibility, and the closing design gate. The shared reference home for report design judgment, routed to by the…
te-cli
Expert guidance for the cross-platform Tabular Editor CLI (the te binary, currently in preview) that manages Power BI / Analysis Services semantic models from the terminal on macOS, Linux, and Windows. Use when the user mentions the te CLI or "Tabular Editor CLI" (not the "2"), or runs a te to scaffold, inspect, edit…