agentmods.dev

octocode-research

octocode-research is a skill for Codex from bgauryy/octocode. It costs 148 tokens per session (1,343 once invoked), scanned A, original, MIT.

A code-research workflow that checks files, connections, and external sources before making claims or changes.

In plain words
What is it for?
Use it to trace callers and imports, map a codebase, investigate failures, review outside repositories or packages, and confirm a proposed fix.
Why use it?
It reduces the risk of guessing how code works or changing one part while breaking another.

Skill for Codex

Written for Codex: agents/openai.yaml present. Also seen: mentions subagents.

not rated 957repo +3 2d ago A scan SkillSpector: warn 148 tokens original MIT

Good fit Use it to trace callers and imports, map a codebase, investigate failures, review outside repositories or packages, and confirm a proposed fix.

Compare 6 skills from other repositories ↓
Install with agentmods
npx agentmods add skills/bgauryy/octocode/octocode-research
View source ↗ bgauryy/octocode octocode.ai
Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent
npx skills add bgauryy/octocode --skill octocode-research
Clone the repo
git clone --depth 1 https://github.com/bgauryy/octocode

Made for: Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for octocode-research

README.md
[![agentmods](https://agentmods.dev/badge/skills/bgauryy/octocode/octocode-research/github.svg)](https://agentmods.dev/skills/bgauryy/octocode/octocode-research)
Your own site
<a href="https://agentmods.dev/skills/bgauryy/octocode/octocode-research"><img src="https://agentmods.dev/badge/skills/bgauryy/octocode/octocode-research/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for octocode-research

Your own site · 80×15
<a href="https://agentmods.dev/skills/bgauryy/octocode/octocode-research"><img src="https://agentmods.dev/badge/skills/bgauryy/octocode/octocode-research.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 148 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 1,343 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe. Third-party audits
  • NVIDIA SkillSpector warn 7 Sept 2026
SkillSpector: 4 findings, up to medium

These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →

  • medium MCP Rug Pull · line 54
    npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
    Fix: Pin the version: npx @scope/[email protected]
  • medium MCP Rug Pull · line 57
    npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
    Fix: Pin the version: npx @scope/[email protected]
  • medium MCP Rug Pull · line 58
    npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
    Fix: Pin the version: npx @scope/[email protected]
  • medium MCP Rug Pull · line 59
    npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
    Fix: Pin the version: npx @scope/[email protected]
How audits are shown
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00148 $0.01343
Opus 5.5 $0.00059 $0.00537
Sonnet 5.5 $0.00030 $0.00269
Haiku 4.5 $0.00015 $0.00134

Measured 2mo ago against content hash 0dd7a864064c, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

octocode-research scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2mo ago.

The scan reads SKILL.md. This mod also ships 1 executable file (scripts/check-description.mjs), listed below but not scanned — reading those needs a real analyzer, not pattern matching.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

skills/octocode-research/SKILL.md · 75 lines

How it starts

The opening of the file, as written. The whole thing — 75 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Octocode Research

Evidence before assertion. Find the anchor, read the exact bytes, prove the claim, then answer or patch.

FRAME → CLASSIFY → MODEL → SEARCH → READ EXACT → PROVE → DECIDE/PATCH → VERIFY

That's the full shape, not a checklist to march through. Scale it to the claim: a small lookup gets a cheap read and an honest confidence label; a delete, a merge verdict, or a root cause earns the whole ladder. Skip stages you can already answer — but say which ones you skipped.

The rules

  1. Open with one line: corpus, actual vs desired, task class, mode, surfaces used and skipped.
  2. Call it a bug only when evidence shows a supported contract was violated.
  3. Root cause needs mechanism, trigger, violated contract, divergence boundary, and a killed alternate.
  4. Use the strongest handle you already hold. For nontrivial claims check two of: structure, stream, connections.
  5. A snippet is a lead. Empty means this lane can't see it, not it isn't there. Say which you mean.
  6. Track claim → evidence → confidence → next check. Cite exact anchors, and only checks that actually ran.
  7. Ask before broad contracts, deletes/renames, thin evidence, or a third unrelated search space. Patch after proof.

Stop when: grounded evidence answers the framed question and the alternate is dead; no cheap next step can change the conclusion; the budget is hit (default 3-5 decisive iterations or ~15 minutes); the last iterations changed no state; retries stay thin, or a license/product/architecture call belongs to the user; a gate blocks (broad contract, delete/rename, clone or run untrusted code, unapproved artifact write); or a skill edit measured flat/worse — revert through references/improve-loop.md. Report the remaining gaps instead of padding certainty.

Workflows

Start with references/algorithm.md (routing, evidence grades) and references/problem-framing.md (is this a bug, feature, enhancement, or still unknown?). Then pick one route by what you're looking at — load references/workflows.md when you need the per-route detail, the load budget per task size, or the handoff receipt between routes:

Read the full file on GitHub · 75 lines

Files

What ships with it

23 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2mo ago First seen · 75 lines · 148 tokens per session scan A 0dd7a864064c

Subscribe to this mod's changes

octocode-research is a skill published in the GitHub repository bgauryy/octocode (957 stars, last pushed 2d ago), licensed MIT. It adds 148 tokens to every session and 1,343 once invoked, about $0.0006 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

DebuggingResearchaiclaude-aicursor-aidevelopmentmcpmodelcontextprotocol
Related

octocode-research compared with skills from other repositories

octocode-research next to 6 skills from other repositories
ModTypeStarsLast pushLicenceScanTokensWorks with
octocode-researchbgauryy/octocodeSkill9572d agoMITA148Codex
fix-testsgirijashankarj/cursor-handbookSkill332mo agoMITA27Cursor
query-optimizationgirijashankarj/cursor-handbookSkill332mo agoMITA28Cursor
debug-issuegirijashankarj/cursor-handbookSkill332mo agoMITA34Cursor
agenttrace-session-auditsickn33/agentic-awesome-skillsSkill49kyesterdayMITA34Claude Code
log-error-digestzebbern/claude-code-guideSkill4.7k3d agoMITA71Claude Code, Codex
code-review-webrampstackco/claude-skillsSkill1.0k11d agoMITA121Claude Code