trace-audit

Local deterministic pattern bridge for new file content. Not the official Claude Security plugin and not a data-flow scanner.

Appends architecture rules as Claude-only context on every prompt, and drops prompts that explicitly tell Claude to ignore or bypass security rules.

Default-closed eval gate. External Promptfoo runs in CI are the real gate; this mod is defence in depth only.

Short-lived credential gate. Fetches a token from a configured broker only; it never invents a token and never falls back to a long-lived credential.

Redacts secret patterns from prompts, shell commands and shell output, blocks writes that contain secrets, and denies reads and mentions of secret files.

Per-session token tally. Records usage totals in the store and prints the turn total; it is not a token stream or a server-side audit chain.

Plugin analytics: hooks $.telemetry's two events, so a plugin logs an event or marks a feature's use as a first-party row, sent in batches with the session's own credential.

Design fluency for frontend development. 1 skill with 24 commands (/impeccable polish, /impeccable audit, /impeccable critique, etc.) and curated anti-pattern detection.

1 skill · 4 agents · hooks

Agent teams, swarm coordination, Monitor streams, and worktree isolation

2 skills · 2 commands · 2 agents

Skill: add headroom-ai compress() to a Python or TypeScript app to cut LLM input tokens (tool outputs, logs, JSON, chat history). No API key.

1 skill

5 skills + 35 modes + Material Passport pipeline. Includes v3.6.7 cross-model audit gate and v3.6.8 generator-evaluator contract.

5 skills · 16 commands · 4 agents · hooks

Query Trackio projects, runs, and metrics using the `trackio` CLI. Use when the user needs to list projects/runs/metrics, get summaries, or retrieve metric values from local Trackio databases. Supports both human-readable and JSON output formats. Covers project discovery, run inspection, metric querying, and system metrics. Designed for LLM agents and automation scripts.

1 skill