Borrowing it
Nothing to install: this file belongs to ccbud/CCBuddy. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/ccbud/CCBuddy/main/.agents/skills/dep-refs/SKILL.mdgit clone --depth 1 https://github.com/ccbud/CCBuddyWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/ccbud/ccbuddy/dep-refs)<a href="https://agentmods.dev/skills/ccbud/ccbuddy/dep-refs"><img src="https://agentmods.dev/badge/skills/ccbud/ccbuddy/dep-refs/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/ccbud/ccbuddy/dep-refs"><img src="https://agentmods.dev/badge/skills/ccbud/ccbuddy/dep-refs.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00064 | $0.00494 |
| Opus 5.5 | $0.00026 | $0.00198 |
| Sonnet 5 | $0.00013 | $0.00099 |
| Haiku 4.5 | $0.00006 | $0.00049 |
Grade A, and why
dep-refs scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
Dep Refs
Use the repository's pnpm dep:refs CLI to answer symbol-level questions before changing or deleting TypeScript exports. Run commands from the ccbuddy repository root.
Workflow
Start broad when deleting code:
pnpm knip
Use knip to find likely unused exports, then inspect any risky or unclear export with dep:refs:
pnpm dep:refs packages/shared/src/remoteTarget.ts:stripRemoteTargetSecrets
List all exports in a file when the exact symbol name is unknown:
pnpm dep:refs --list-exports packages/shared/src/remoteTarget.ts
Use scoped scans for fast exploration only when the scope is intentionally limited:
pnpm dep:refs --scope packages/services packages/shared/src/remoteTarget.ts:stripRemoteTargetSecrets
Before claiming an export is safe to delete, prefer an unscoped dep:refs run so cross-package callers are not missed.
JSON Mode
Use silent pnpm mode for machine-readable output, because normal pnpm output includes extra banner lines:
pnpm -s dep:refs packages/shared/src/remoteTarget.ts:stripRemoteTargetSecrets --json | jq .
Use JSON when summarizing many symbols, feeding results to jq, or comparing references and reExports counts programmatically.
Interpreting Results
Treat References (0) and Re-exports (0) as "no static references found", not as proof that no dynamic usage exists. The script does not detect dynamic import() paths or string-based references.
If a symbol only appears under Re-exports, trace the outward barrel path before deleting. A re-export can still be part of the public surface even when there are no direct internal imports.
For refactors, report concrete callers with file and line from the CLI output, then decide whether to update callers, preserve the export, or delete it.
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 56 lines · 64 tokens per session scan A a7f6b4d44c34
dep-refs is a skill published in the GitHub repository ccbud/CCBuddy (8 stars, last pushed yesterday), licensed Apache-2.0. It adds 64 tokens to every session and 494 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-25.
Other skills, from other repositories
operate-a2a-superhub
Operate and diagnose the A2A Superhub product across its CLI, HTTP, and declared MCP/A2A surfaces. Use when the user explicitly asks to inspect a Superhub, create or read Superhub tasks or artifacts, work with Superhub memory/inbox/wakeup/handoffs, validate this product skill, diagnose auth/index/queue/capability…
debugger
Rank root-cause hypotheses and propose the smallest safe fix.
code-remediate
Apply selected review fixes; bare PR targets use current online items, while PR +review adds the latest matching artifact.
challenge-resolve
Independently review and fix a scoped diff through bounded convergence rounds, with evidence-backed closure and explicit stop/recovery decisions. Use for requested adversarial review-and-fix loops, not a single read-only review.
checking-code-quality
Checks code quality metrics including complexity, duplication, naming conventions, and function length. Use when running quality gates, reviewing code smells, or checking lint rules. Automatically triggered on complex modules or post-refactor.
delegate-with-mission-cards
Delegate independent, bounded work to specialized reader and writer subagents with explicit ownership and parent verification. Use when parallel work can be scoped and verified independently.