Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/borda/ai-rig/query-codenpx skills add Borda/AI-Rig --skill query-codegit clone --depth 1 https://github.com/Borda/AI-RigWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/borda/ai-rig/query-code)<a href="https://agentmods.dev/skills/borda/ai-rig/query-code"><img src="https://agentmods.dev/badge/skills/borda/ai-rig/query-code.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00078 | $0.01906 |
| Opus 5 | $0.00039 | $0.00953 |
| Sonnet 5 | $0.00016 | $0.00381 |
| Haiku 4.5 | $0.00008 | $0.00191 |
Grade A, and why
query-code scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 96 lines — stays where its author put it; the contents beside it link to each section on GitHub.
NOT for: rebuilding the index (use /codemap-py:scan-codebase), renaming symbols (use /codemap-py:rename-refs), or which tests cover or are affected by a change (use /codemap-py:test-impact).
Test-impact split: a one-off structural fact ("which tests would this touch?") uses table subcommand test-impact <target>; full affected-test workflow (index ensure, JSON parse, pytest command, not_covered caveat) uses /codemap-py:test-impact. NOT-for defers workflow, not subcommand.
Skip Codemap when exact file + symbol localize edit and no caller, dependency, blast-radius, test-impact, import, or source-slice fact remains open. Lifecycle boundary—callback/hook, cancellation/exception, scheduling/cleanup, state transfer—keeps scope open: inspect source + named test/oracle, then query fn-rdeps for caller or fn-deps for callee responsibility. Explicit structural query/tool requirement overrides skip. Otherwise use smallest complete query.
Choose the smallest complete query set
"Affected if X changes" = reverse dependencies. Run every query from the caller's current repository; working directory selects project index. Do not cd into $CLAUDE_PLUGIN_ROOT or plugin directory.
codemap-py query --compact <subcommand> [arguments]
Enabled plugin adds version-matched bin/ to Bash PATH. If unavailable interactively, invoke installed plugin's absolute bin/codemap-py launcher as one standalone command and accept normal host permission prompt. Prepend no cd, export, or other shell command.
| Goal | Query subcommand |
|---|---|
| production module importers / blast radius | rdeps <module> --exclude-tests |
| direct test-module importers | rdeps <module> then filter/report test modules |
| module imports | deps <module> |
| shortest import chain | path <from> <to> |
| production centrality / highest in-degree | central --top N --exclude-tests |
| internal-import coupling (not centrality) | coupled --top N |
| symbol source including module imports or module symbols | symbol <name> --with-imports · symbols <module> |
| regex symbol search | find-symbol <pattern> |
| direct production callers | fn-rdeps <module::symbol> --exclude-tests |
| callers plus test-module importers | fn-rdeps <module::symbol> --exclude-tests, then rdeps <module> |
| direct imports / callees | fn-deps <module::symbol> |
| transitive callers / function blast | fn-blast <module::symbol> |
| broken Sphinx cross-references | xrefs --broken <module> |
| changed-code blast radius | diff-impact [--base REF] |
| transitive affected tests / mocks | test-impact <target> · mock-rdeps <target> |
| pytest fixtures | fixture-rdeps <name> · fixture-graph <test-file> |
| subprocess relationships | subprocess-deps <module> · subprocess-rdeps <module> |
| coverage / documentation gaps | coverage <target> · coverage-gap [module] · undocumented [module] |
Direct/every/all/production/blast-radius callers → fn-rdeps <module::symbol> --exclude-tests; fn-blast <module::symbol> only for explicit transitive, closure, hops, or all-levels requests.
Test modules directly importing module: use rdeps <module>, then filter/report tests. Reserve test-impact <target> for transitive affected-test selection.
symbol <name> accepts bare function (for example authenticate) or qualified method (for example MyClass.method); module::symbol belongs to fn-* call-graph queries. To chain symbol into fn-*, compose returned module + qualified_name exactly as <module>::<qualified_name>; example mypackage.module::MyClass.method. For feature scaffolding, query requested qualified extension method (for example, symbol MyClass.add_feature), not nearby symbol MyClass or symbols <module> listing unless broader scope requested.
For method changes possibly affecting overrides, use find-symbol '<ClassSuffix>\.<method>$' --exclude-tests --limit 0 for same-name override candidates. Name match discovers candidates, not inheritance; inspect each source to verify ancestry + package boundaries before treating as override.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 96 lines · 78 tokens per session scan A beaf5a857a06
query-code is a skill published in the GitHub repository Borda/AI-Rig (26 stars, last pushed yesterday), licensed Apache-2.0. It adds 78 tokens to every session and 1,906 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
neo-python
Use this skill when writing, reviewing, debugging, or architecting Python 3.10+ code, including type hints, structural pattern matching, dataclasses, async/task groups, packaging-aware project structure, testability, and maintainability.
building-telegram-bots
Writes correct, version-aware Telegram bot code. Use when writing, extending, or debugging a Telegram bot in python-telegram-bot, aiogram, grammY, or Telegraf. Not for Telegram client API (TDLib), languages other than Python and Node.js, or non-Telegram platforms.
neo-python-manager
Use this skill when the user asks how to install, add, remove, update, or run Python dependencies; choose between uv, Poetry, venv, or pip; create/sync a virtual environment; or diagnose Python package manager setup from pyproject.toml, lock files, or requirements.txt.
astropy
Core Python library for astronomy and astrophysics workflows that need Astropy APIs, including units/quantities, coordinates, FITS I/O, tables, time systems, WCS, and cosmology. Use when implementing or debugging astronomical data analysis code with Astropy.
bioservices
Unified Python interface to 40+ bioinformatics services. Use when querying multiple databases (UniProt, KEGG, ChEMBL, Reactome) in a single workflow with consistent API. Best for cross-database analysis, ID mapping across services. For quick single-database lookups use gget; for sequence/file manipulation use…
cobrapy
Constraint-based metabolic modeling (COBRA). FBA, FVA, gene knockouts, flux sampling, SBML models, for systems biology and metabolic engineering analysis.