Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/baz-scm/baz-plugin/baz-codebase-explorationnpx skills add baz-scm/baz-plugin --skill baz-codebase-explorationgit clone --depth 1 https://github.com/baz-scm/baz-pluginWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/baz-scm/baz-plugin/baz-codebase-exploration)<a href="https://agentmods.dev/skills/baz-scm/baz-plugin/baz-codebase-exploration"><img src="https://agentmods.dev/badge/skills/baz-scm/baz-plugin/baz-codebase-exploration.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00108 | $0.02677 |
| Opus 5 | $0.00054 | $0.01339 |
| Sonnet 5 | $0.00022 | $0.00535 |
| Haiku 4.5 | $0.00011 | $0.00268 |
Grade A, and why
baz-codebase-exploration scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
- Do **not** use your file-read mechanism (local `Read`, `gh api .../contents/<path>`, `curl`, …) for anything except opening **one already-known file path**. Pointing it at a directory, or firing several to "look around How it starts
The opening of the file, as written. The whole thing — 119 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Baz Codebase Exploration
This skill helps you plan a change across your org's repos using indexed search. It applies whether or not the relevant repos are checked out locally — and especially when a change crosses a contract boundary between repos: you edit one side, another repo defines the other. Baz MCP tools are how you search code across the org. Once you know a file's path, read it however you like — local Read if the repo is checked out, otherwise your own fetch.
When to use this skill
- The user asks to plan a feature, scope a change, or design an implementation
- The change might touch more than one repository in the org
- You own one side of a cross-repo contract (API param, request/response schema, event payload) — even when that side is checked out locally
- The relevant code lives in repos the user has not cloned locally
Tool routing — strict
| Job | Tool |
|---|---|
| Find which repos are involved | repo_search (Baz) |
| Find code by symbol / regex inside a repo | remote_grep (Baz) |
| Find files by name / glob inside a repo | remote_file_search (Baz) |
Forbidden — every kind of search goes through a Baz tool, never through your read or shell tool. These are the patterns that cause the most waste:
- Do not list or walk a repo's file tree to find files — no directory listing, no recursive tree fetch (e.g.
gh api .../contents/<dir>,gh api .../git/trees/HEAD?recursive=1,ls/findover a checkout). Useremote_file_search. - Do not crawl or scan a repo's contents to find a symbol or string (e.g.
gh search code, grepping fetched files). Useremote_grep. - Do not use your file-read mechanism (local
Read,gh api .../contents/<path>,curl, …) for anything except opening one already-known file path. Pointing it at a directory, or firing several to "look around", is a search — route it throughremote_file_search/remote_grep. The read tool is the last step, never the exploration.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 119 lines · 108 tokens per session scan A 1fd0c2430408
baz-codebase-exploration is a skill published in the GitHub repository baz-scm/baz-plugin (10 stars, last pushed 7d ago), licensed MIT. It adds 108 tokens to every session and 2,677 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
taiyi-ui-design
TaiyiForge 第 4 阶段 — UI/UX 契约,产出 UI-DESIGN.md。四端通用。.
taiyi-evolve
TaiyiForge 辅助 — 实现后架构与文档同步(architecture-sync)。OpenCode / Claude / Codex / Cursor 通用。.
taiyi-diagram-c4
TaiyiForge 辅助 — 从代码反推 C4 架构文档(Observed/Inferred 分层 · Mermaid 真源)。OpenCode / Claude / Codex / Cursor 通用。.
flow-next-resolve-pr
Resolve PR review feedback. Fetches unresolved threads, triages, fixes, replies and resolves via GraphQL. Use when asked to address review comments.
flow-next-tracker-sync
Project a flow-next spec to a tracker issue (Linear, GitHub, GitLab, Jira) and reconcile two-way. Use when asked to sync to a tracker. NOT plan-sync.
writing-style
Use for technical communication - GitHub/GitLab tickets, PR/MR descriptions, issue comments, code review comments, commit messages. Direct, brief style with no AI-speak. NOT for README.md, public docs, or blog posts.