Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add agentic-research/mache --skill authoring-smell-rulesgit clone --depth 1 https://github.com/agentic-research/macheWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/agentic-research/mache/authoring-smell-rules)<a href="https://agentmods.dev/skills/agentic-research/mache/authoring-smell-rules"><img src="https://agentmods.dev/badge/skills/agentic-research/mache/authoring-smell-rules/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/agentic-research/mache/authoring-smell-rules"><img src="https://agentmods.dev/badge/skills/agentic-research/mache/authoring-smell-rules.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00102 | $0.01656 |
| Opus 5 | $0.00051 | $0.00828 |
| Sonnet 5 | $0.00020 | $0.00331 |
| Haiku 4.5 | $0.00010 | $0.00166 |
Grade A, and why
authoring-smell-rules scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 77 lines — stays where its author put it; the contents beside it link to each section on GitHub.
/mache:authoring-smell-rules — Add a find_smells rule
A smell rule is a SQL query over mache's projected graph tables plus metadata. Rules live in smellRegistry in cmd/smell_rules.go (built-ins) or in $MACHE_SMELL_RULES_DIR (external, appended at init). Each rule is one SmellRule:
SmellRule{
ID: "magic_int_in_comparison", // stable; the MCP/CLI argument
Languages: []string{"go"}, // match _source.language; empty = any
Description: "...", // shown in the rules listing
Requires: []string{"_ast", "nodes"}, // tables the query reads (capability gate)
ScopeColumn: "lit.source_id", // SQL expr compared to source_id; "" disables scoping
Query: `SELECT source_id, node_id, start_byte, end_byte, start_row, start_col, <metric> AS metric
FROM ... WHERE ... %s`, // %s = optional injected scope clause
DefaultMinMetric: 10, // threshold when caller omits min_metric (0 = return all)
Severity: SeverityWarn, // off | warn | error
Tags: []string{"complexity"}, // free-form; CLI --tags selection (cap 3-5)
}
The query contract
Return columns in this order: source_id, node_id, start_byte, end_byte, start_row, start_col, metric. The %s placeholder receives the scope clause (so a rule can be run against one file). The handler applies min_metric filtering on the metric column, but does not sort — rows come back in the query's order, so if you want top-N-by-metric you must add ORDER BY metric DESC to your SQL yourself (the metric-bearing built-ins do). Use 0 AS metric for non-metric rules.
⚠ The capability split (Requires) — get this right
What tables exist depends on who built the .db:
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 77 lines · 102 tokens per session scan A 92b1304a33d0
authoring-smell-rules is a skill published in the GitHub repository agentic-research/mache (45 stars, last pushed today), licensed Apache-2.0. It adds 102 tokens to every session and 1,656 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
lsp-inspect
Full code quality audit for a file, package, or directory. Supports batch mode (directory walk with --top ranking), comparison mode (--diff for branch-only issues), severity calibration by blast radius, fix suggestions, and confidence tiers. Applies a check taxonomy (dead symbols, silent failures, error wrapping…
lsp-dead-code
Enumerate exported symbols in a file and surface those with zero references across the workspace. Use when auditing for dead code, cleaning up APIs, or checking which exports are safe to remove.
lsp-impact
Blast-radius analysis for a symbol or file — shows all callers, type supertypes/subtypes, and reference count before you change it. Use when refactoring, deleting, or changing the signature of any function, type, or method. Also accepts a file path to surface all exported-symbol impact in one shot.
lsp-refactor
End-to-end safe refactor workflow — blast-radius analysis, speculative preview, apply to disk, verify build, run affected tests. Inlines lsp-impact + lsp-safe-edit + lsp-verify + lsp-test-correlation into one coordinated sequence.
lsp-safe-edit
Wrap any code edit with before/after diagnostic comparison. Speculatively previews the change first (previewedit), then applies to disk only if the error delta is acceptable. If post-edit errors appear, surfaces code actions for quick fixes. Handles single and multi-file edits.
lsp-understand
Deep-dive exploration of unfamiliar code — given a symbol or file, builds a complete Code Map showing type info, implementations, call hierarchy (2-level depth limit), all references, and source. Broader than lsp-explore: accepts files, synthesizes multi-symbol relationships, and produces a navigable dependency map.