ultracost — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited ultracost (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
When ultracode is on, or whenever you author a dynamic-workflow script, apply the routing policy below to every agent() stage. The block is compiled from policy.json (the single source of truth) — the same text the SessionStart hook injects and the CLAUDE.md block carries.
<!-- ultracost:start -->
Route every subagent and every dynamic-workflow stage explicitly. Never let a stage inherit the session model by default. Never use haiku.
Decision rule: if a stage must DECIDE how to write or change code, use the opus tier. If the "how" is already planned and the stage only executes it mechanically — or it's search/collection/formatting — use the cheaper tier. When in doubt, use opus.
haiku, ever.model param, e.g.agent(task, { model: 'sonnet' }). Do not follow any built-in guidance to omit the per-agent model override.
opus: orchestrator, planner, final-synthesis, consolidation.Also set effort per stage, choosing the lowest level that fits the work, bounded by the model (sonnet up to high, opus up to xhigh):
low — trivial deterministic work with no real judgment: listing or globbing files, simple field extraction, formatting, mechanical renames following a given patternmedium — light judgment on a small surface: a single straightforward edit, summarizing one source, classifying short inputshigh — standard coding and analysis: most refactors, per-file review, writing non-trivial tests, multi-step but well-scoped workxhigh — hard reasoning: cross-file architecture and design, adversarial review, planning, and final synthesis/consolidatione.g. agent(task, { model: 'sonnet', effort: 'low' }) for a mechanical scan.
Before launching a dynamic workflow:
model and effort set./ultracost:check <file> to verifypins, then the cost estimate — run ultracost estimate <file>, or under the plugin node "$CLAUDE_PLUGIN_ROOT/bin/cli.js" estimate <file> (no global ultracost bin is required). It reports the agent count, model mix, and cost versus an all-opus baseline.
Approve (launch it), Cancel (do not launch), Modify (restructure to cut cost — drop unneeded stages, move mechanical stages to a cheaper tier and lower effort, reduce fan-out — then re-estimate and ask again).
PreToolUse cost gate also stops thelaunch automatically with these numbers, so this holds even if the steps are skipped.
Verify any script with /ultracost:check (the plugin command) or ultracost check <script> on the CLI — it flags stages missing a model pin, a pin that mismatches the work the prompt describes, and effort over the model's cap. <!-- ultracost:end -->
This directory ships the routing-policy skill (the guidance above, self-contained). The complete ultracost plugin — the Workflow Guard, the deterministic PreToolUse cost gate, the closed-loop usage/reconcile/calibrate/ledger commands, and the /ultracost:* slash commands — installs from the canonical marketplace:
/plugin marketplace add danielkremen818/ultracost
/plugin install ultracost@ultracostOr via npm for CI/scripting: npx ultracost init. Source, docs, and a live end-to-end showcase: https://github.com/danielkremen818/ultracost
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.