frag-cost — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited frag-cost (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
node .skills/frag-cost/scripts/frag_cost.mjs <instance.ARM.ndjson> [more.ndjson ...]
Pass the per-instance turn-logs (e.g. runs/<dir>/instance.A0.ndjson, instance.A5.ndjson), NOT the tee outputs (A0.ndjson/A5.ndjson) — only the per-instance logs carry systemStableKey alongside sessionKey and Anthropic usage. The tee body is pre-clawback and has no stable key.
.skills/bench's prefix-fragmentation table shows how badly the per-request cch rotation split one logical context into many clawback SESSION KEYs (A0 often 100s → A5 1). That is clawback-layer fragmentation. The trap is assuming distinct SESSION KEYs ⇒ Anthropic cold-starts. On build v2.1.145.20b they do NOT: a fully fragmented A0 (336/336 distinct keys) still read ~92.7k tokens warm on its fresh-key turns vs ~968 created (95.8×), 98.6% hit. Anthropic serves the prefix warm despite cch rotation, so de-fragmentation buys only the tiny creation delta (~1.8% on a tight loop), not rescued cold-starts. This skill makes that fresh-vs-repeat cut explicit so the fragmentation count is never mis-sold as token cost.
cut. read >> creation on fresh keys ⇒ served WARM ⇒ fragmentation is not a cold-start proxy on this build. creation >> read ⇒ fragmentation really is cold-starting ⇒ strip-ephemeral has token value in that regime.
nature (high creation), reported separately so they don't contaminate the fresh-vs-repeat comparison. Watch for old analyses that sampled these and mislabeled their natural cold-start as cch poisoning.
Static, post-hoc, zero new tokens. Run it after any .skills/paired or .skills/ab block. Pair it with the zero-token .skills/inspect (static breakpoint structure — the theoretical upper bound) to contrast prediction (inspect) against ground truth (this).
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.