Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/ai-driven-dev/framework/07-refactornpx skills add ai-driven-dev/framework --skill 07-refactorgit clone --depth 1 https://github.com/ai-driven-dev/frameworkWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/ai-driven-dev/framework/07-refactor)<a href="https://agentmods.dev/skills/ai-driven-dev/framework/07-refactor"><img src="https://agentmods.dev/badge/skills/ai-driven-dev/framework/07-refactor.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00057 | $0.00535 |
| Opus 5 | $0.00028 | $0.00267 |
| Sonnet 5 | $0.00011 | $0.00107 |
| Haiku 4.5 | $0.00006 | $0.00053 |
Grade A, and why
07-refactor scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 30 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Skill: refactor
The act-side of code improvement: it changes code to make it better. Behavior-preserving for cleanup, performance, and architecture; security may change behavior on purpose to close a hole.
Actions
| # | Action | Axis | Lens |
|---|---|---|---|
| 01 | performance |
performance | N+1, hot paths, batching, memoization, unnecessary I/O |
| 02 | security |
security | OWASP, input validation, authz, secrets: harden and fix |
| 03 | cleanup |
code-quality | clean code: rename, extract, DRY, dead code, complexity |
| 04 | architecture |
architecture | extract layers, fix coupling, enforce boundaries |
Run the one axis named, or offer all applicable when the request is unscoped.
Before running an action, read its file in actions/, not only the table or assets.
Transversal rules
- Scope: run the one named axis, or for an unscoped request ask once "all applicable axes, or one?" before running. A request to delete or remove code runs
cleanupdirectly, with no axis question. Never silently default to one axis. - Behavior-preserving for cleanup, performance, and architecture: public inputs and outputs stay identical, verified by tests, type checks, or a side-by-side run. Security may alter behavior to close a vulnerability, and must call that out explicitly.
- Audit-fed, optional: when the caller pushes an audit report (a path under
aidd_docs/tasks/audits/or pasted findings), take its findings for this axis as the fix list and skip the scan. The bridge is the report artifact; this skill never loads or calls another skill. The auditcode-qualitypillar feeds thecleanupaxis; the other axes map by name. - Severity uses the shared 3-level scale: 🔴 critical, 🟡 warning, 🟢 minor.
- Stay inside the axis: dependency upgrades and UI redesign are out of scope. Add tests only as a regression for a security fix, never otherwise.
What ships with it
4 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 30 lines · 57 tokens per session scan A 9450d45cc7aa
07-refactor is a skill published in the GitHub repository ai-driven-dev/framework (455 stars, last pushed today), licensed MIT. It adds 57 tokens to every session and 535 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
doctor
Diagnose and repair your TinyFish setup — MCP registration, auth, and connectivity. Runs the TinyFish CLI's own doctor for the config checks, then does the one thing the CLI cannot — proving this harness can actually reach TinyFish. Run when TinyFish tools fail, return auth errors, or after an install that did not…
feedback
File structured feedback about TinyFish — bug reports, confusing setup steps, missing features, or a doctor diagnostic report. Creates a GitHub issue on tinyfish-io/tinyfish-cookbook with the user's approval; nothing is sent without an explicit preview.
performance-optimization
Measure-first performance work. Use on triggers like "it's slow", "profile this", "optimize perf", "fix the bottleneck", "improve load time / Core Web Vitals", or when a measured regression needs fixing. Enforces measure-before-optimize. Fills a perf gap not covered by existing project skills. Not a build/ship…
ci-troubleshoot
Diagnose failed GitHub Actions runs for pi-agent-dashboard: the 10-file workflow taxonomy, the release pipeline, known failure modes, and how to read gh run logs and retrigger jobs. Use when a CI run is red, a release is stuck, a workflow won't dispatch, or you need to know which workflow does what. See release-cut to…
debug-dashboard
Diagnose problems in the running pi-agent-dashboard system: server.log, /api/health, bridge WebSocket connectivity, vitest triage, known-issue FAQ entries. Routes UI/visual issues to the browser skill. Use when the server seems hung, a pi session won't connect, tests fail mysteriously, the dashboard shows a blank…
node-inspect-debugger
See runtime state a console.log cannot reach — set real breakpoints, step, and dump the scope chain of a paused Node/TypeScript process. Use on "set a breakpoint", "inspect runtime state", "console.log isn't enough", "step through this", "what's in this closure at runtime", "attach a debugger". Not a logging or…