Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/sigistry/marketplaceWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/commands/sigistry/marketplace/hidden-dependencies)<a href="https://agentmods.dev/commands/sigistry/marketplace/hidden-dependencies"><img src="https://agentmods.dev/badge/commands/sigistry/marketplace/hidden-dependencies.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00017 | $0.03994 |
| Opus 5 | $0.00009 | $0.01997 |
| Sonnet 5 | $0.00003 | $0.00799 |
| Haiku 4.5 | $0.00002 | $0.00399 |
Grade A, and why
hidden-dependencies scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 655 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Hidden Dependencies Discovery Command
Uncover hidden dependencies, implicit contracts, and non-obvious couplings that aren't immediately apparent from the code structure. These are the things that make changes risky and break unexpectedly.
Objective
Identify all the non-obvious ways different parts of the codebase depend on each other, including:
- Implicit data contracts
- Shared global state
- Ordering dependencies
- Temporal coupling
- Hidden assumptions
- Magic values and configurations
Step 1: Global State Analysis
Find all shared mutable state:
Types of Global State
- Global variables and singletons
- Static class fields
- Module-level state
- Environment variables that affect behavior
- Database connection pools
- Caches and memoization
- Feature flags
Output Format
## Global State Dependencies
### Global: [Name]
**Location**: `file_path:line_number`
**Type**: [Variable/Singleton/Cache/etc.]
**Mutability**: Read-only / Mutable
**What It Stores**: [Description of the data]
**Written By**:
- `file_path:line_number` - [Context]
- `file_path:line_number` - [Context]
**Read By**:
- `file_path:line_number` - [Usage context]
- `file_path:line_number` - [Usage context]
- [X more locations]
**Risk Assessment**:
- **Concurrency Issues**: [Thread-safety concerns]
- **Testing Difficulty**: [Hard to test because...]
- **Change Impact**: [What breaks if this changes]
**Hidden Assumptions**:
- [Assumption 1 about this state]
- [Assumption 2 about this state]
Step 2: Implicit Data Contracts
Identify places where code assumes specific data formats or structures:
Contract Types
- Expected JSON structures
- Database schema assumptions
- API response formats
- File formats
- String encoding assumptions
- Timezone assumptions
Output Format
## Implicit Data Contracts
### Contract: [Description]
**Location**: `file_path:line_number`
**Assumed Structure**:
```json
{
"field1": "string",
"nested": {
"field2": 123
}
}
Where It's Assumed:
file_path:line_number- Expects field1 to existfile_path:line_number- Assumes nested.field2 is a numberfile_path:line_number- Relies on specific order
Not Validated:
- ✗ No null checks for nested object
- ✗ No type validation for field2
- ✗ No handling for missing fields
Breaking Changes Would Affect:
- [List of dependent code locations]
Recommendation:
- Add schema validation at:
file_path:line_number - Define explicit TypeScript interface / JSON Schema
- Add defensive null checks
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 655 lines · 17 tokens per session scan A 78d7d6cc9682
hidden-dependencies is a command published in the GitHub repository sigistry/marketplace (3 stars, last pushed 4d ago), licensed MIT. It adds 17 tokens to every session and 3,994 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other commands, from other repositories
dead-code-scan
Scan for dead code, unused imports, duplicates, and zombie code across the project.
esp-debug
Help debug ESP32 crashes, hangs, and peripheral issues.
performance-audit-static
Static performance audit of AI-built code — find N+1 queries and request waterfalls, over-fetching, missing indexes, and caching opportunities, ranked by effort and impact.
audit
Audit an existing codebase. Detects stack, finds gaps, creates tasks, generates PROJECT.md.
analyze-misfires
Identify skills injected where not needed, propose regex and description tightening.
debug
Structured debugging with parallel investigation agents.