Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add 05-deepak-patidar/claude-skills --skill dependency-disciplinegit clone --depth 1 https://github.com/05-deepak-patidar/claude-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/05-deepak-patidar/claude-skills/dependency-discipline)<a href="https://agentmods.dev/skills/05-deepak-patidar/claude-skills/dependency-discipline"><img src="https://agentmods.dev/badge/skills/05-deepak-patidar/claude-skills/dependency-discipline/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/05-deepak-patidar/claude-skills/dependency-discipline"><img src="https://agentmods.dev/badge/skills/05-deepak-patidar/claude-skills/dependency-discipline.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00084 | $0.01214 |
| Opus 5 | $0.00042 | $0.00607 |
| Sonnet 5 | $0.00017 | $0.00243 |
| Haiku 4.5 | $0.00008 | $0.00121 |
Grade A, and why
dependency-discipline scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 54 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Dependency Discipline
Every dependency is code you now ship, maintained by strangers, on their schedule, with your name on the incident. npm install is the easiest way to adopt a liability while feeling productive. The discipline: adopt deliberately, pin exactly, upgrade continuously, and keep the exits marked.
Gate 1: Before adding — the adoption review
First question: can 30 lines of your own code do this? For anything smaller than a real domain (left-pad-class utilities, one date format, a simple retry), writing it beats importing it — your 30 lines have no transitive tree, no CVE feed, no maintainer burnout. Import for genuine domains: crypto (NEVER hand-roll — threat-model-security), parsers for messy formats, timezone data, database drivers, frameworks.
If importing, spend five deliberate minutes:
- Aliveness: commits/releases in the last year, issues getting answers, more than one maintainer (bus factor). A dead dependency is a fork you haven't admitted to yet.
- Weight: what does it drag in transitively? (
npm ls, dependency graph). A 3-line convenience with 40 transitive deps is a bad trade; prefer libraries with shallow trees. - Blast radius when it breaks: dev-only tool (low bar) vs runtime-critical path vs touches-money-or-auth (high bar: popularity, audit history, and your own reading of its core code).
- License compatible with your use (GPL in a proprietary SaaS backend is usually fine; in distributed code it's a legal meeting).
- Exit cost: how hard to replace later? High-exit-cost deps (frameworks, ORMs) deserve real evaluation; for the rest, keep them behind your own adapter so the exit stays cheap (architecture-design).
Gate 2: Pinning — builds must not drift
- Lockfiles committed, always, and honored in CI/production installs (
npm ci,pip install -r requirements.txtwith pins,poetry.lock,cargo.lock). An unlocked build means yesterday's green and today's deploy are different software (deployment-safety Gate 1). - Docker base images by specific tag (ideally digest), never
latest. Same for GitHub Actions (@v4minimum; SHA-pin for anything with secrets access). - The rule: a rebuild with no code change produces the same artifact. Any violation of that is a drift channel; close it.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago First seen · 54 lines · 84 tokens per session scan A aced50e0deb9
dependency-discipline is a skill published in the GitHub repository 05-deepak-patidar/claude-skills (4 stars, last pushed 2mo ago), licensed MIT. It adds 84 tokens to every session and 1,214 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
source-command-audit-whitepapers
Audit version freshness, FR/EN parity, and metadata quality of all whitepapers and recap cards.
eval-agents
Audit Claude Code agents defined in .claude/agents/ for description specificity, model tier appropriateness, tools scoping, and system prompt quality. Detects dispatch ambiguity between agents, flags over-permissive tool grants, and checks for human-in-the-loop patterns that break programmatic orchestration. Use when…
issue-triage
3-phase issue backlog management with audit, deep analysis, and validated triage actions. Use when triaging GitHub issues, sorting bug reports, cleaning up stale tickets, or detecting duplicate issues. Args: 'all' to analyze all, issue numbers to focus (e.g. '42 57'), 'en'/'fr' for language, no arg = audit only.
check-cache-bugs
Audit Claude Code setup for cache bugs (CC#40524): sentinel, --resume/--continue, attribution header + ArkNill B3/B4/B5.
land-and-deploy
Merge PR, wait for CI, verify deploy, run canary. The complete landing pipeline.
self-assessment
Interactive skill assessment with personalized learning path generation.