Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/xiaomimimo/mimo-code/auditnpx skills add XiaomiMiMo/MiMo-Code --skill auditgit clone --depth 1 https://github.com/XiaomiMiMo/MiMo-CodeWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00091 | $0.01773 |
| Opus 5 | $0.00046 | $0.00886 |
| Sonnet 5 | $0.00018 | $0.00355 |
| Haiku 4.5 | $0.00009 | $0.00177 |
Grade A, and why
audit scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
Copies of this mod
1 near-identical copy found in the catalogue:
- product-design-audit — 88% identical, 59 lines differ
How it starts
The opening of the file, as written. The whole thing — 161 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Audit
Use this skill when the user wants to audit, review, critique, inspect, assess, analyze, evaluate, or give feedback on a product flow, journey, funnel, onboarding path, checkout path, settings path, screen, or other product experience.
The output is not a loose opinion. The output is:
- Screenshots of the flow
- Those screenshots rendered inline in the report
- A numbered step list
- UX and design findings tied to steps or screenshots
- Accessibility risks tied to steps or screenshots
- Clear limits on what could not be checked from screenshots alone
Critical Overrides
- Refer to the Plugin router $index before proceeding.
- Follow $critical-overrides.
User Context
Before starting, load $user-context and run its preflight script when local shell access is available.
Use saved product URLs, Figma files, screenshots, reference images, codebase paths, Storybook, tokens, design systems, brand assets, component refs, browser preferences, and share targets as grounding material when relevant.
Do not inspect every saved reference. Inspect only what the current task needs.
Route
Before auditing:
- Identify the product or surface.
- Identify the flow or task.
- Choose the capture tool.
- Capture the flow.
- Save and inspect each screenshot.
- Return the audit inline with the accepted screenshots.
Output rules:
- Default to a concise inline report with screenshots rendered in the chat.
- Saving screenshots and notes in the workspace is an internal implementation detail. Do not ask the user to choose a local folder.
- If the user explicitly asks for Figma, create the Figma audit board in addition to the inline report.
- After the inline report, ask once:
Want me to plot this out in Figma with the screenshots and notes?
Capture rules:
- Follow the Browser Choice rule in $index.
- If none of those can capture valid screenshots or control the flow, stop and report the blocker.
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 161 lines · 91 tokens per session scan A 616e74f59da2
audit is a skill published in the GitHub repository XiaomiMiMo/MiMo-Code (12,904 stars, last pushed 2d ago), licensed MIT. It adds 91 tokens to every session and 1,773 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
nemoclaw-contributor-implement-issue
Implement an accepted NemoClaw GitHub issue in the current checkout. Use when a user asks to pick up an issue for implementation, implement or fix a named issue, or add the issue's tests. Confirm accepted scope, deliver the smallest independently valuable capability slice, and record validation and remaining gates…
amazon-reviews-api-skill
This skill helps users automatically extract Amazon product reviews via the Amazon Reviews API. Agent should proactively apply this skill when users express needs like getting reviews for Amazon product with ASIN B07TS6R1SF, analyzing customer feedback for a specific Amazon item, getting ratings and comments for a…
cabloy-worktree-environment
This skill must be used only when the user explicitly invokes /cabloy-worktree-environment or explicitly asks to perform the named Cabloy worktree-environment setup. It prepares a confirmation-gated, worktree-local Vona and Zova runtime environment for a linked Cabloy Basic or Cabloy Start Git worktree using Git…
amazon-price-tracker
Amazon price monitoring and competitive pricing intelligence. Real-time price tracking, Buy Box analysis, promotion detection, and dynamic pricing strategy optimization. Use when the user asks about price monitoring, competitor pricing, Buy Box tracking, or pricing strategy.
shopify-functions
Shopify Functions allow developers to customize the backend logic that powers parts of Shopify. Available APIs: Discount, Cart and Checkout Validation, Cart Transform, Pickup Point Delivery Option Generator, Delivery Customization, Fulfillment Constraints, Local Pickup Delivery Option Generator, Order Routing Location…
amazon-repricing-strategy
Amazon repricing strategy and Buy Box optimization. Competitive pricing analysis, dynamic pricing rules, margin protection strategies, repricing tool selection, and automated pricing workflows. Use when the user asks about Amazon repricing, pricing strategy, Buy Box optimization, competitive pricing, or dynamic…