Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add arbazkhan971/godmode --skill legacygit clone --depth 1 https://github.com/arbazkhan971/godmodeWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/arbazkhan971/godmode/legacy)<a href="https://agentmods.dev/skills/arbazkhan971/godmode/legacy"><img src="https://agentmods.dev/badge/skills/arbazkhan971/godmode/legacy/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/arbazkhan971/godmode/legacy"><img src="https://agentmods.dev/badge/skills/arbazkhan971/godmode/legacy.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium MCP Rug Pull · line 31 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00050 | $0.01854 |
| Opus 5.5 | $0.00020 | $0.00742 |
| Sonnet 5.5 | $0.00010 | $0.00371 |
| Haiku 4.5 | $0.00005 | $0.00185 |
Grade A, and why
legacy scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 245 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Legacy — Legacy Code Modernization
Activate When
- User invokes
/godmode:legacy - User says "understand this legacy code"
- User says "modernize", "tech debt", "dead code"
- Codebase has no tests, deprecated APIs, EOL deps
Workflow
Step 1: Legacy Code Characterization
# Assess codebase age and activity
git log --format='%ai' --reverse | head -1
git shortlog -sn --all | head -10
git log --since="6 months ago" --oneline | wc -l
# Check test coverage
ls -d test/ tests/ spec/ __tests__/ 2>/dev/null
npx jest --coverage 2>/dev/null || \
pytest --cov 2>/dev/null || echo "No test runner"
# Audit dependencies
npm audit 2>/dev/null || pip-audit 2>/dev/null
npm outdated 2>/dev/null || pip list --outdated 2>/dev/null
# Find complexity hotspots
find . -name "*.ts" -o -name "*.py" -o -name "*.js" \
| xargs wc -l 2>/dev/null | sort -rn | head -10
LEGACY ASSESSMENT:
Language: <detected>, Age: <from git>
Size: <files, LOC>
Contributors: <active/total>
Test coverage: <% or "none">
Dependencies: <total>, <outdated>, <EOL>, <vulns>
Dead code: <estimated LOC>
Change confidence: HIGH | MEDIUM | LOW | NONE
CONFIDENCE LEVELS:
Tests + CI + Types = HIGH
Tests only = MEDIUM
No tests = LOW
Nothing = NONE
IF confidence == NONE: add characterization tests first
IF vulns > 0: prioritize security patches
IF EOL deps > 0: flag for urgent migration planning
IF files > 500 LOC: identify god classes to extract
Step 2: Understanding Legacy Code
Code Archaeology:
- Git blame: who, when, why for each section
- Dependency tracing: callers, callees, side effects
- Runtime observation: add logging at entry/exit
- Comment analysis: accurate or misleading?
Step 3: Adding Tests to Untested Code
The most critical step. Tests before any changes.
TEST STRATEGIES:
| Strategy | When to Use |
|-------------------|--------------------------|
| Characterization | Capture current behavior |
| Golden Master | Complex outputs (HTML) |
| Approval Testing | Snapshots as approval |
CHARACTERIZATION TEST:
Run code with known input
Record actual output as expected value
Test PASSES today by definition
Test FAILS if behavior changes
THRESHOLDS:
Critical paths: 100% must have tests before change
Min characterization tests per module: 5
Golden master update: requires UPDATE_GOLDEN=true
IF test captures a bug: document, fix separately
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 245 lines · 50 tokens per session scan A 444ed7b00f88
legacy is a skill published in the GitHub repository arbazkhan971/godmode (27 stars, last pushed 1mo ago), licensed MIT. It adds 50 tokens to every session and 1,854 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
squid-triage-issue
Bug intake — localise the suspected code, capture a deterministic reproducer, and emit a groomed bug task with a regression-test acceptance criterion, ready for /squid-implement-task or the full pipeline.
triage-issue
Bug triage: explores codebase for root cause, files GitHub issue with TDD fix plan. Triggers: triage, investigate bug, fix plan, root cause, file issue, bug report.
reality-verification
This skill should be used when the user asks to "verify a fix", "reproduce failure", "diagnose issue", "check BEFORE/AFTER state", "VF task", "reality check", "check test quality", "mock-only tests", or needs guidance on verifying fixes by reproducing failures before and after implementation, or detecting mock-heavy…
qa-investigation
Investigate a specific test failure to its root cause and document the why. Detects whether a failing test is flaky (intermittent) or a deterministic bug during reproduction. Use when a test fails and you need the real cause, not just to make it green. Execution layer, not strategy review. Keywords: flaky test…
diagnose
A disciplined workflow for investigating software that behaves incorrectly, crashes, produces wrong output, or fails intermittently. It first requires a repeatable command that can demonstrate the reported problem before testing possible causes.
verify-cli-run
Prove that a command-line tool actually did what it said, instead of trusting its exit code and its output. Snapshots the filesystem before and after, names the expected consequence in advance, and returns one of four verdicts with what could not be seen. Use after running a build, a migration, a scaffolder, a…