Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add Czarnak/totally-integrated-claude --skill plc-code-analysisgit clone --depth 1 https://github.com/Czarnak/totally-integrated-claudeWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/czarnak/totally-integrated-claude/plc-code-analysis)<a href="https://agentmods.dev/skills/czarnak/totally-integrated-claude/plc-code-analysis"><img src="https://agentmods.dev/badge/skills/czarnak/totally-integrated-claude/plc-code-analysis.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00144 | $0.02688 |
| Opus 5 | $0.00072 | $0.01344 |
| Sonnet 5 | $0.00029 | $0.00538 |
| Haiku 4.5 | $0.00014 | $0.00269 |
Grade A, and why
plc-code-analysis scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 254 lines — stays where its author put it; the contents beside it link to each section on GitHub.
plc-code-analysis
Goal
Perform structured, multi-perspective security and quality analysis of PLC code, producing a severity-ranked findings report. Acts as an automated "second pair of eyes" for automation engineers.
Independence from tia-openness-roadmap
This skill is NOT routed by tia-openness-roadmap. It has its own trigger patterns and
operates independently. The Openness roadmap handles engineering automation (create, modify,
import/export via API). This skill handles analysis and review of existing code.
The skill can consume code retrieved through an integration or exported through Openness/VCI, but it does not depend on a particular wrapper.
Input recognition
PLC code commonly arrives in one of four ways. Identify the exact format and provenance before analysis.
Format 1 — Raw SCL / Structured Text
The user pastes or uploads .scl, .st, or plain-text PLC code. This is the simplest case.
Parse directly as text. Look for FUNCTION_BLOCK, FUNCTION, ORGANIZATION_BLOCK, DATA_BLOCK
headers to identify block boundaries.
Format 2 — SIMATIC SD source documents (V21)
TIA Portal V21 can export S7-1200/S7-1500 SCL, LAD, FBD, DB, F-DB, UDT, and
F-UDT content in the text-based SIMATIC Source Document format. Analyze the
.s7dcl declaration/code document together with its .s7res resources when both
exist. Preserve document paths and identifiers so findings can be traced back.
SIMATIC SD is a source representation, not runtime evidence. In particular, an SCL block can be exported even when it is not compile-clean; successful export does not prove a successful compile, download, or PLC behavior.
Format 3 — SimaticML XML (exported LAD/FBD/SCL)
The user provides .xml files exported from TIA Portal. These follow the SimaticML schema.
Key navigation points:
<SW.Blocks.FB>,<SW.Blocks.FC>,<SW.Blocks.OB>,<SW.Blocks.DB>— block type<Interface>→<Section Name="Input|Output|InOut|Static|Temp|Constant">— variable declarations<ObjectList>→<CompileUnit>— individual networks<FlgNet>inside CompileUnit — LAD/FBD network logic as a directed graph<Access>elements — variable references with scope and UID<Part>elements — instructions (contacts, coils, function calls)<Wire>elements — connections between parts (data/signal flow)<StructuredText>— SCL compile-unit content, including inline SCL in LAD/FBD<Comment>— block and network comments (valuable for process context)- Root block kind (
SW.Blocks.FB,SW.Blocks.FC,SW.Blocks.OB, orSW.Blocks.GlobalDB) and<AttributeList>elements such as<Number>,<ProgrammingLanguage>, and<MemoryLayout>(Optimized/Standard)
What ships with it
6 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 7d ago First seen · 254 lines · 144 tokens per session scan A 8cb1c4103920
plc-code-analysis is a skill published in the GitHub repository Czarnak/totally-integrated-claude (55 stars, last pushed 21d ago), licensed MIT. It adds 144 tokens to every session and 2,688 once invoked, about $0.0007 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
gemini
Cross-model second opinion from Google Gemini — a different AI reviewing the same changes, with deep Google ecosystem knowledge. Three modes: review (pass/fail gate for Google Ads campaigns, SEO metadata, or code), challenge (adversarial stress-test that tries to break your changes), and consult (open Q&A with Gemini…
review
Review code with parallel agents — tests, security, Ecto, LiveView, Oban. Use after implementation to catch bugs and anti-patterns before committing.
audit
Project health audit and health check — architecture, performance, tests, dependencies, code quality. Use when assessing overall project health, before releases, or after refactors.
phx-pr-review
Address feedback left on a GitHub pull request: fetch unresolved review threads, make agreed Elixir/Phoenix code fixes, reply, and resolve. Use for a PR URL/number or reviewer comments. NOT for pre-PR review, findings triage, or CI monitoring.
codex-ab
Run an A/B codex review experiment — holistic codex review vs 3 focused dimension passes (security, ecto, liveview) on the branch diff, classify findings, report a panel-value verdict. Use when the branch is fresh, before any codex review runs.
boundaries
Analyze Phoenix context boundaries and module coupling via mix xref. Use when checking cross-context calls, validating dependencies, before splitting modules, or reviewing architecture.