Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add cyanheads/nist-nvd-mcp-server --skill code-simplifiergit clone --depth 1 https://github.com/cyanheads/nist-nvd-mcp-serverWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/cyanheads/nist-nvd-mcp-server/code-simplifier)<a href="https://agentmods.dev/skills/cyanheads/nist-nvd-mcp-server/code-simplifier"><img src="https://agentmods.dev/badge/skills/cyanheads/nist-nvd-mcp-server/code-simplifier/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/cyanheads/nist-nvd-mcp-server/code-simplifier"><img src="https://agentmods.dev/badge/skills/cyanheads/nist-nvd-mcp-server/code-simplifier.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00160 | $0.05653 |
| Opus 5.5 | $0.00064 | $0.02261 |
| Sonnet 5.5 | $0.00032 | $0.01131 |
| Haiku 4.5 | $0.00016 | $0.00565 |
Grade A, and why
code-simplifier scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
This is a copy
100% identical to code-simplifier — 0 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.
How it starts
The opening of the file, as written. The whole thing — 177 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Code Simplifier
Cleanup pass over a session's changes or a named target. Reviews the code in scope, understands how it fits the existing codebase, and makes targeted improvements — modernizing syntax, removing unnecessary complexity, consolidating duplicated logic, catching efficiency issues. Prioritizes codebase cohesion over local perfection.
Core philosophy
Every change must earn its keep. A simplification that doesn't meaningfully improve clarity, correctness, or cohesion is noise. Don't refactor for refactoring's sake. Don't create new files, abstractions, or utilities unless they solve a demonstrated problem. If the existing code works and is readable, leave it alone. The goal is a cohesive codebase, not a pristine one.
Procedure
Phase 1: Set the scope
Two scopes; the caller's wording picks one, and the diff is the default.
- Diff (nothing named): run
git statusto see the shape of the working tree, thengit diff HEADfor all uncommitted changes (staged and unstaged). Untracked files never appear in the diff — list them withgit ls-files --others --exclude-standard(git statuscollapses a new directory to one line) and read them directly. If the diff is empty and there are no untracked files, review the last commit (git diff HEAD~1 HEAD); if that is also empty, say the tree is clean and stop. Don't go hunting through the codebase for files to improve. - Target (a named path, module, or "the whole codebase"): the named files are the scope, whatever their git state. Work one module or directory at a time and re-run the gate after each, so a large scan never becomes one unverifiable diff. Take the target as named — don't rank or narrow it by commit history.
Phase 2: Understand the surrounding codebase
Don't review changes in isolation. Before any modifications:
- Read the full files containing changes — not just the diff hunks. Understand imports, surrounding logic, module structure.
- Identify the project language(s) and select the relevant transformation rules. Discard inapplicable rules.
- Survey adjacent code — shared utilities, sibling modules, common patterns. You need to know what already exists before deciding something is missing.
- Run the project's gate once before editing to establish a baseline. Use the gate the project's
CLAUDE.md/AGENTS.mdnames; absent one, take it frompackage.jsonscripts —devcheckif present, elsecheck, else the separatetypecheck/lintscripts — or aMakefilechecktarget. Python projects gate onuv run ruff check,uv run ruff format --check, and the configured type checker. Add the test suite when the gate doesn't run it — read the script rather than assume (adevcheckoften stops at lint and typecheck); without tests, nothing shows behavior survived the pass. In a Bun project that tests with Vitest, runbun run test— barebun testbypasses the script and runs Bun's own runner. If the gate is already red, say so in the summary and don't attribute the failure to your changes.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 11d ago Changed · +13 lines · +19 tokens per session e52938014509
- 1mo ago Changed · +33 lines · +17 tokens per session be774f3b313c
- 1mo ago First seen · 131 lines · 124 tokens per session scan A b61d1bb9bf8f
code-simplifier is a skill published in the GitHub repository cyanheads/nist-nvd-mcp-server (1 stars, last pushed 12d ago), licensed Apache-2.0. It adds 160 tokens to every session and 5,653 once invoked, about $0.0006 per session on Opus 5.5. A static security scan graded it A with 0 findings. It is 100% identical to code-simplifier, differing in 0 lines, and is treated as a copy.
Other skills, from other repositories
hypotheses
Turns a research direction into testable hypotheses with predictions, competing explanations and the experiments that discriminate between them, including the design (controls, randomization, blocking), sample size or seed count, the pre-specified analysis, and the result that would falsify each hypothesis. Use when a…
performing-endpoint-vulnerability-remediation
Performs vulnerability remediation on endpoints by prioritizing CVEs based on risk scoring, deploying patches, applying configuration changes, and validating fixes. Use when remediating findings from vulnerability scans, responding to critical CVE advisories, or maintaining endpoint compliance with patch management…
swarm-pr-review
Run a graph-guided, tool-augmented PR review using context packing, parallel exploration, mandatory repository-agnostic risk-family coverage with dispatch scaled to diff size and risk, independent reviewer validation, critic challenge, and metrics writeback. Use for deep pull request review with low false-positive…
include-test-files-that-assert-on-behavior-being-changed-in-decl
When delegating a task affected by this skill, include.
issue-import-from-pr
Open a tracker for a security-relevant fix that already exists as a public PR, with no report. The tracker lands in Assessed with scope, PR-state and remediation fields filled from the PR; pairs with security-cve-allocate.
self-review
Run a structured pre-flight self-review on local changes before opening a PR. Reads the diff against a configurable base (default: the merge base of HEAD and origin/ ), checks correctness, security, and project conventions, and returns a structured report. No state changes, no PR, no external writes — the report is…