Borrowing it
Nothing to install: this file belongs to aimasteracc/tree-sitter-analyzer. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/aimasteracc/tree-sitter-analyzer/main/.claude/skills/tsa-constraints/SKILL.mdgit clone --depth 1 https://github.com/aimasteracc/tree-sitter-analyzerWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/aimasteracc/tree-sitter-analyzer/tsa-constraints)<a href="https://agentmods.dev/skills/aimasteracc/tree-sitter-analyzer/tsa-constraints"><img src="https://agentmods.dev/badge/skills/aimasteracc/tree-sitter-analyzer/tsa-constraints/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/aimasteracc/tree-sitter-analyzer/tsa-constraints"><img src="https://agentmods.dev/badge/skills/aimasteracc/tree-sitter-analyzer/tsa-constraints.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00161 | $0.01211 |
| Opus 5.5 | $0.00064 | $0.00484 |
| Sonnet 5.5 | $0.00032 | $0.00242 |
| Haiku 4.5 | $0.00016 | $0.00121 |
Grade A, and why
tsa-constraints scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 147 lines — stays where its author put it; the contents beside it link to each section on GitHub.
tsa-constraints — Inhibitory edges as code
Bio-analogy: inhibitory synapses — declared "X must NOT call Y" rules that fire UNSAFE verdicts when violated. Rules live in
architectural-constraints.ymlat repo root, are evaluated against the persisted call graph, and persist violations in SQLite for fast re-reads.
When to use
| Goal | Action |
|---|---|
| List current rules | Read architectural-constraints.yml |
| Check repo against rules | edit action=constraints (no args) |
| Pre-edit gate (includes rule check) | edit action=safe (auto) |
| Add a new rule | Edit YAML + re-run edit action=constraints |
| Filter violations by severity | edit action=constraints severity_min="error" |
| Filter by path | edit action=constraints path_filter="mcp/**" |
Procedure
One-shot audit
edit action=constraints
Returns:
success: true
verdict: SAFE | CAUTION | UNSAFE
violations: [
{rule_id, caller_file, caller_line, callee_name, callee_file, severity, reason}
]
rule_count: <int>
evaluated_edge_count: <int>
Verdict cascade:
UNSAFE→ any error-severity violationCAUTION→ any warn-severity violationSAFE→ none
Adding a new rule
- Open
architectural-constraints.ymlat repo root - Append:
- id: <slug, kebab-case> severity: error | warn | info rule: forbid from: "path/glob/**" to: "path/glob/**" reason: "<why this is forbidden>" exceptions: ["specific/file.py"] # optional - Run
edit action=constraintsto see if existing code violates the new rule - Either: fix the violations OR add them to
exceptions
Reading violations
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2mo ago First seen · 147 lines · 161 tokens per session scan A 16be04723fc9
tsa-constraints is a skill published in the GitHub repository aimasteracc/tree-sitter-analyzer (61 stars, last pushed today), licensed MIT. It adds 161 tokens to every session and 1,211 once invoked, about $0.0006 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
find-bugs
Locate likely bug locations in code.
codegraph
Use for repo structure, symbol navigation, dependency analysis, duplicate triage, and PR impact review when plain text search is too shallow.
debug-issue
Systematically debug issues using graph-powered code navigation.
systemic-issue-triage
Trigger: new issue, bug report, triage, backlog, issue flood, community report, root cause, dead-end, blocked user. Attack issues by root class, never one-by-one; fixes must shrink the system, not grow it.
issue-root-resolution
Trigger: root audit, atacar la raíz, issue roots, backlog roots, mechanism map, deletion-driven fix, resolver issues de raíz, close outdated issues. Audit and resolve issue clusters by verified root cause.
rdd-defect-workflow
Trigger: RDD, receipt-driven development, review authority, receipt/lineage, correction/recovery, delivery gate/kill switch, bounded review defects. Guide work.