Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add aahlijia/dekko --skill dekko-refactorgit clone --depth 1 https://github.com/aahlijia/dekkoWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/aahlijia/dekko/dekko-refactor)<a href="https://agentmods.dev/skills/aahlijia/dekko/dekko-refactor"><img src="https://agentmods.dev/badge/skills/aahlijia/dekko/dekko-refactor/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/aahlijia/dekko/dekko-refactor"><img src="https://agentmods.dev/badge/skills/aahlijia/dekko/dekko-refactor.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00125 | $0.01225 |
| Opus 5.5 | $0.00050 | $0.00490 |
| Sonnet 5.5 | $0.00025 | $0.00245 |
| Haiku 4.5 | $0.00013 | $0.00122 |
Grade A, and why
dekko-refactor scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 19d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 81 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Refactoring with dekko (find every site first)
A rename or signature change fails in one way: a site nobody listed.
Grep for the old name over-matches strings and comments and misses
aliased imports; dekko's map has the exact call, annotation, heritage
and import edges. List the sites from the map, edit only those lines,
then ask the map what still points at the old name. Tool names below
are the bare MCP names (dekko-orient has the prefixes, the CLI
fallback, and target syntax).
Before editing: the site list
Pin the target first with query_symbol (append :LINE if the reply
says it's an overload set) and read its note: lines. Then list the
sites for the kind of change:
| Change | Sites to list | Use |
|---|---|---|
| Rename or re-sign a function/method | every call site | get_callers with sites=true include_tests=true (CLI dekko query callers <sym> --sites) |
| Rename or reshape a class/struct/interface/trait | annotations that name it, implementors, constructor calls | find_type_usages <T>, get_subtypes <T> with transitive=true include_tests=true, get_callers as above; or one workset symbol=<T> type_impact=true (CLI --symbol <T> --type-impact) |
| Rename or move a file/module, or rename an exported name | import lines, including aliases | CLI only: dekko deps --file <path> (which files import it), dekko query importers <import.source> (one row per imported member, with (as alias)) |
| Change what it raises | handlers that catch it | CLI only: dekko query catches <ExcType>, dekko query throws <sym> |
Rules that make the list complete:
include_tests=trueis mandatory here. The MCP defaults hide test callers and test subtypes; a test is a site to update.- No omitted rows. Pass
budget=0or raise it until the footer stops sayingomitted. An omitted row is a missed edit. importerstakes an import string (pkg.util,./utils,org.foo.Bar), not a path;deps --filetakes the path. A row ending(as fn)means that file calls the symbol asfn: the import line and those calls are both sites.- Read only the sites.
get_context_packwithwith_source=truefor the target's own body, a line-ranged Read for each site row. - A low count on a widely used or short, common name: run
check_ambiguousordekko-verifybefore trusting it.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 19d ago First seen · 81 lines · 125 tokens per session scan A 3acbae240d76
dekko-refactor is a skill published in the GitHub repository aahlijia/dekko (5 stars, last pushed today), licensed MIT. It adds 125 tokens to every session and 1,225 once invoked, about $0.0005 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-27.
Other skills, from other repositories
roam
Codebase comprehension via roam-code CLI. Use when exploring codebases, planning modifications, debugging failures, assessing PR risk, or checking architecture health. Triggers on: understanding project structure, pre-change safety checks, finding symbols/files, blast radius analysis, affected tests, health scoring…
codegraph
Analyze indexed codebases via graph database (neug) and vector index (zvec). Covers call graphs, dependencies, dead code, hotspots, module coupling, architecture reports, semantic search, impact analysis, bug root cause from GitHub issues, class diagrams (UML), and PR review (risk scoring, conflict detection…
stuck
Diagnose frozen, stuck, or slow Qwen Code sessions on this machine. Scans for problematic processes, high CPU/memory usage, hung subprocesses, and debug logs. Use /stuck or /stuck to focus on a specific process.
oversight-team
Use when you are a seat on the oversight pod (a standing monitor-mode rig that keeps OTHER rigs healthy), configuring or running the drift detectors, or choosing whether to intervene vs escalate. Covers the pull-not-poll posture, the v0 detectors (premature-park, process-drift, off-task, token-burn), the intervention…
developing-openrig
Use when changing OpenRig's own source in a clone of the openrig repository: finding which package or file owns a behaviour, choosing which tests to run, testing a change without disturbing the OpenRig daemon your own session runs on, judging whether a diff touches a high-risk area, or preparing a pull request. Not…
ix
Answer structural questions about a codebase — what a symbol is, what calls it, what a change breaks, where the hotspots are — from a persistent code graph via the ix CLI, instead of grepping.