Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add arbazkhan971/godmode --skill legacygit clone --depth 1 https://github.com/arbazkhan971/godmodeWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/arbazkhan971/godmode/legacy)<a href="https://agentmods.dev/skills/arbazkhan971/godmode/legacy"><img src="https://agentmods.dev/badge/skills/arbazkhan971/godmode/legacy.svg" alt="Measured on agentmods" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium MCP Rug Pull · line 31 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00050 | $0.01854 |
| Opus 5 | $0.00025 | $0.00927 |
| Sonnet 5 | $0.00010 | $0.00371 |
| Haiku 4.5 | $0.00005 | $0.00185 |
Grade A, and why
legacy scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 245 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Legacy — Legacy Code Modernization
Activate When
- User invokes
/godmode:legacy - User says "understand this legacy code"
- User says "modernize", "tech debt", "dead code"
- Codebase has no tests, deprecated APIs, EOL deps
Workflow
Step 1: Legacy Code Characterization
# Assess codebase age and activity
git log --format='%ai' --reverse | head -1
git shortlog -sn --all | head -10
git log --since="6 months ago" --oneline | wc -l
# Check test coverage
ls -d test/ tests/ spec/ __tests__/ 2>/dev/null
npx jest --coverage 2>/dev/null || \
pytest --cov 2>/dev/null || echo "No test runner"
# Audit dependencies
npm audit 2>/dev/null || pip-audit 2>/dev/null
npm outdated 2>/dev/null || pip list --outdated 2>/dev/null
# Find complexity hotspots
find . -name "*.ts" -o -name "*.py" -o -name "*.js" \
| xargs wc -l 2>/dev/null | sort -rn | head -10
LEGACY ASSESSMENT:
Language: <detected>, Age: <from git>
Size: <files, LOC>
Contributors: <active/total>
Test coverage: <% or "none">
Dependencies: <total>, <outdated>, <EOL>, <vulns>
Dead code: <estimated LOC>
Change confidence: HIGH | MEDIUM | LOW | NONE
CONFIDENCE LEVELS:
Tests + CI + Types = HIGH
Tests only = MEDIUM
No tests = LOW
Nothing = NONE
IF confidence == NONE: add characterization tests first
IF vulns > 0: prioritize security patches
IF EOL deps > 0: flag for urgent migration planning
IF files > 500 LOC: identify god classes to extract
Step 2: Understanding Legacy Code
Code Archaeology:
- Git blame: who, when, why for each section
- Dependency tracing: callers, callees, side effects
- Runtime observation: add logging at entry/exit
- Comment analysis: accurate or misleading?
Step 3: Adding Tests to Untested Code
The most critical step. Tests before any changes.
TEST STRATEGIES:
| Strategy | When to Use |
|-------------------|--------------------------|
| Characterization | Capture current behavior |
| Golden Master | Complex outputs (HTML) |
| Approval Testing | Snapshots as approval |
CHARACTERIZATION TEST:
Run code with known input
Record actual output as expected value
Test PASSES today by definition
Test FAILS if behavior changes
THRESHOLDS:
Critical paths: 100% must have tests before change
Min characterization tests per module: 5
Golden master update: requires UPDATE_GOLDEN=true
IF test captures a bug: document, fix separately
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 245 lines · 50 tokens per session scan A 444ed7b00f88
legacy is a skill published in the GitHub repository arbazkhan971/godmode (26 stars, last pushed 10d ago), licensed MIT. It adds 50 tokens to every session and 1,854 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
reality-verification
This skill should be used when the user asks to "verify a fix", "reproduce failure", "diagnose issue", "check BEFORE/AFTER state", "VF task", "reality check", "check test quality", "mock-only tests", or needs guidance on verifying fixes by reproducing failures before and after implementation, or detecting mock-heavy…
squid-triage-issue
Bug intake — localise the suspected code, capture a deterministic reproducer, and emit a groomed bug task with a regression-test acceptance criterion, ready for /squid-implement-task or the full pipeline.
triage-issue
Bug triage: explores codebase for root cause, files GitHub issue with TDD fix plan. Triggers: triage, investigate bug, fix plan, root cause, file issue, bug report.
qa-investigation
Investigate a specific test failure to its root cause and document the why. Detects whether a failing test is flaky (intermittent) or a deterministic bug during reproduction. Use when a test fails and you need the real cause, not just to make it green. Execution layer, not strategy review. Keywords: flaky test…
diagnose
A disciplined workflow for investigating software that behaves incorrectly, crashes, produces wrong output, or fails intermittently. It first requires a repeatable command that can demonstrate the reported problem before testing possible causes.
regression-test
Classify an iOS/Swift bug into its Apple-specific root-cause class (force unwrap, try!, fatalError, MainActor isolation, App Group mismatch, lifecycle) and sweep for sibling instances of that class. Complements a generic TDD/debugging skill (e.g. superpowers:test-driven-development, superpowers:systematic-debugging)…