mk:context-audit — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited mk:context-audit (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Read-only audit of .claude/ structural overhead. Surfaces what is loaded into every host-runtime session and how much of the context window it consumes, then recommends the highest-leverage trims.
Three concrete triggers:
confirm the project is below the 25% structural-overhead threshold.
over-compacted, audit to see if structural overhead has grown past 10%.
the always-on bundle still pays its keep (paired with the dead-weight audit in harness-rules.md Rule 7).
| Concern | Mechanism | Unit |
|---|---|---|
| Monetary cost | /mk:budget + harness/scripts/budget-tracker.sh | USD |
| Window utilization (this skill) | /mk:context-audit + scripts/inventory-context.sh | tokens / % |
The three concerns are deliberately separate. This skill measures only what is statically loaded into every session — the always-on bundle. Conversation history, tool output, and active edits live elsewhere.
The slash command runs the pipeline:
SCAN_ROOT="${1:-$PWD}"
bash .claude/skills/context-audit/scripts/inventory-context.sh "$SCAN_ROOT" \
| bash .claude/skills/context-audit/scripts/estimate-tokens.sh \
| bash .claude/skills/context-audit/scripts/format-audit-report.shOutput is markdown, printed to terminal. The skill does NOT write any files.
Steps:
inventory-context.sh walks .claude/ and emits rawbyte/line counts per category (CLAUDE.md chain, agents, skills, rules, commands, MCP) as JSON.
estimate-tokens.sh enriches the inventory withestimated_tokens (chars/4 heuristic, mirrors budget-tracker.cjs) and computes totals including structural_overhead_pct against a 200K window.
format-audit-report.sh emits a 5-section markdown report:header, summary table, top consumers, recommendations, footer.
structural_overhead_pct:
< 10% → Healthy10–25% → Watch≥ 25% → Action recommended# Context Audit — <scan_root>
*Scanned at <timestamp> · model window 200K tokens · banner: <Healthy|Watch|Action>*
## Summary
| Category | Components | Bytes | Tokens | % of Window |
| ... | ... | ... | ... | ... |
## Top Consumers
1. <component> ~<tokens> (<path>)
... (top 10)
## Recommendations
1. <priority finding> — saves ~<tokens>
... (sorted by token impact, descending)
## How to Act
- Cost: see `/mk:budget`
- Runtime trim: see `mk:lazy-agent-loader`The 10% / 25% thresholds are the canonical source of truth for token-overhead banners — see references/token-cost-model.md. They are NOT linked to MEOWKIT_BUDGET_* env vars (those are USD amounts, not token percentages).
packages/cli/src/orchviz/token-estimator.tsis the canonical chars/4 source. Shell scripts inline the same heuristic with a citation comment, avoiding a Node bridge that would require dist/.
.claude/memory/cost-log.json,.claude/, .mcp.json. No file writes anywhere.
until a real 1M-context use case appears.
keywords: frontmatter and a cross-reference from/mk:budget. There is no separate routing rule.
(none yet — grow from observed failures)
.claude/rules/skill-authoring-rules.md — discovery + Gotchas section requirements.claude/rules/injection-rules.md Rule 11 — Skill Rule of Two; this skillscores 2 of 3 (untrusted SCAN_ROOT input + filename inventory may surface sensitive paths) so paths are canonicalized via realpath and never executed.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.