inspecting-app

inspecting-app is a skill for Claude Code from wayne930242/straw-boss. It costs 86 tokens per session (460 once invoked), scanned A, original, MIT.

A skill for auditing one of a project's managed apps against its existing rules and conventions. It first identifies the app, then checks the requested area using the relevant rule sources.

In plain words
What is it for?
Checking whether a module or other app-specific work follows the project's documented rules.
Why use it?
It prevents an audit from being performed on the wrong app or against guessed standards.

Skill for Claude Code

Written for Claude Code: shipped in a Claude Code plugin.

Part of the straw-boss plugin — 16 skills, 2 hooks shipped together

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add skills/wayne930242/straw-boss/inspecting-app
Any agent
npx skills add wayne930242/straw-boss --skill inspecting-app
Clone the repo
git clone --depth 1 https://github.com/wayne930242/straw-boss

Made for: Claude Code.

Or install straw-boss, the plugin that ships this one along with the rest of its 16 skills, 2 hooks.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for inspecting-app

README.md
[![agentmods](https://agentmods.dev/badge/skills/wayne930242/straw-boss/inspecting-app.svg)](https://agentmods.dev/skills/wayne930242/straw-boss/inspecting-app)
Your own site
<a href="https://agentmods.dev/skills/wayne930242/straw-boss/inspecting-app"><img src="https://agentmods.dev/badge/skills/wayne930242/straw-boss/inspecting-app.svg" alt="Measured on agentmods" height="20"></a>
Per session 86 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 460 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00086 $0.00460
Opus 5 $0.00043 $0.00230
Sonnet 5 $0.00017 $0.00092
Haiku 4.5 $0.00009 $0.00046

Measured 6d ago against content hash 229f32c3fd75, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-06, from the pricing page.

Security

Grade A, and why

inspecting-app scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

skills/inspecting-app/SKILL.md · 28 lines

What it actually says

Overview

See docs/roles.md for the cast of characters and the authority framework this skill operates under — not redefined here.

Resolve the app, choose the smallest sufficient loop through choosing-graph, and assess it against real rule sources. This skill supplies the app boundary; the selected audit skill supplies the method.

Task 1: Resolve the app

Invoke work-on now. Do not proceed without the target app.

  • If work-on asked a clarifying question (an ambiguous name matching more than one app's match phrases) or found the request out of the project's managed-app scope, stop here and surface that to the user — don't guess an app to keep moving.
  • If work-on named more than one app, treat Task 2 as running once per app rather than picking one arbitrarily; each app's audit is independent.

Verification: the target app(s) are established before Task 2, or you've surfaced work-on's clarifying question / out-of-scope result instead of proceeding.

Task 2: Run an evidence-bearing audit

For a bounded single-loop, continue in the current agent with the app's instructions loaded. Use fan-out for clear independent branches, or dispatching-work when the audit benefits from a separate durable workroom. A confirmed lower-tier work route may carry a bounded audit.

Frame the audit around the applicable rule, observed behavior, and consequence. Require evidence references to the exact rule and implementation, test, log, or artifact. These references are what this work's anchor attacks; with no operable artifact, adversarial-review is the reality anchor for the finished assessment.

Verification: the evidence-backed assessment explains the result, cites both rule and observed evidence, and records its anchor disposition.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 6d ago First seen · 28 lines · 86 tokens per session scan A 229f32c3fd75

Subscribe to this mod's changes

inspecting-app is a skill published in the GitHub repository wayne930242/straw-boss (3 stars, last pushed 2d ago), licensed MIT. It adds 86 tokens to every session and 460 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Related

Other skills, from other repositories

issue-analyze

GitHub Issue and PR review thread deep analysis with Codex blind verdict. Use when: analyzing issue root cause, classifying problems, investigation planning, triaging PR review comments for actionability. Not for: fixing bugs (use bug-fix), code exploration (use code-explore). Output: classified analysis + verdict…

sd0xdev/sd0x-harness · 73 tokens

load-pr-review

Load GitHub PR review comments into AI session — analyze, triage, plan. Default: analysis-only (no auto-fix). Use when: reviewing PR feedback, planning fixes, addressing review comments, replying to reviewers. Not for: creating reviews (use codex-review-fast), creating PRs (use create-pr), viewing PR status (use…

sd0xdev/sd0x-harness · 77 tokens

refactor

Multi-target refactoring orchestrator. Use when: cleaning up messy code/docs, simplifying code, restructuring documents, batch cleanup. Not for: new features (use feature-dev), bug fixes (use bug-fix), code understanding (use code-explore). Output: refactored code/docs + review gate.

sd0xdev/sd0x-harness · 65 tokens

best-practices

Industry best practices conformance audit with mandatory adversarial debate. Produces audit artifact: verdict (OK/WARN/FAIL) + gap roadmap + debate proof. Use when: auditing current implementation against industry standards, checking compliance with best practices, benchmarking implementation quality, verifying a…

sd0xdev/sd0x-harness · 101 tokens

review-spec

Review technical spec documents from completeness, feasibility, risk, and code consistency perspectives.

sd0xdev/sd0x-harness · 19 tokens

pre-pr-audit

Pre-PR confidence audit with 5-dimension scoring. Use when: final check before commit/push/PR, evaluating PR readiness, assessing test quality + risk + coverage holistically. Triggers: pre-pr, readiness check, confidence audit, final verification, ready to PR, how confident. Not for: code review (use…

sd0xdev/sd0x-harness · 95 tokens