Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add DDS-Solutions/AI-TadPole-OS --skill code-review-graphgit clone --depth 1 https://github.com/DDS-Solutions/AI-TadPole-OSWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/dds-solutions/ai-tadpole-os/code-review-graph)<a href="https://agentmods.dev/skills/dds-solutions/ai-tadpole-os/code-review-graph"><img src="https://agentmods.dev/badge/skills/dds-solutions/ai-tadpole-os/code-review-graph/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/dds-solutions/ai-tadpole-os/code-review-graph"><img src="https://agentmods.dev/badge/skills/dds-solutions/ai-tadpole-os/code-review-graph.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00040 | $0.00890 |
| Opus 5.5 | $0.00016 | $0.00356 |
| Sonnet 5.5 | $0.00008 | $0.00178 |
| Haiku 4.5 | $0.00004 | $0.00089 |
Grade A, and why
code-review-graph scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 90 lines — stays where its author put it; the contents beside it link to each section on GitHub.
[!IMPORTANT] AI Context & Knowledge Heritage
- Subsystem: Agent Skills Registry / code-review-graph
- Architecture:
@docs ARCHITECTURE:Documentation- Failure Path: Missing symbol graph index, uninspected high blast radius, or outdated Tree-sitter binaries.
- Observability: Traceability via
execution/parity_guard.py([SKILL])
Code Review Graph (AST Blast Radius Protocol)
Purpose: Reduce AI token consumption by up to 49x by loading precise structural AST dependency slices instead of reading entire folders or massive directories into context.
📚 Progressive Disclosure & L3 Reference Index
Consult deep L3 Reference Guides and verification tools on demand:
- Graph CLI & Benchmarks Deep Reference: graph_cli_and_benchmarks.md
- Deterministic Blast Radius Validator: graph_blast_validator.py
1. Native Tadpole OS Graph Commands
In this repository, graph intelligence is natively powered by server-rs and Tree-sitter AST symbol extraction:
# 1. Inspect Blast Radius of a file before refactoring (MANDATORY GUARD)
npm run graph:blast:guard -- --path server-rs/src/routes/system.rs
# 2. Look up symbol definition, callers, and callees
npm run graph:lookup -- --name AppState
# 3. View all symbols exported and consumed by a file
npm run graph:file -- --path src/pages/Neural_Map.tsx
# 4. Compute deep multi-hop blast radius for a symbol
npm run graph:blast -- --path server-rs/src/routes/intelligence.rs --name get_blast_radius
# 5. Export complete symbol graph to JSON
npm run graph:export
Audit commands generate high-fidelity graph context at:
reports/intelligence/audit_context.json
2. Mandatory Pre-Refactor & Subagent Guard
Before making non-trivial code modifications across Rust, TypeScript, or Python files:
- Query Blast Radius: Run
npm run graph:blast:guard -- --path <target_file>. - Ingest Targeted Slice: Review only the returned callers and callees (~1k–3k tokens) instead of reading every directory file.
- Verify Constraints: Ensure edits preserve all required call signatures, parameter types, and return values.
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago Changed · +25 lines · -13 tokens per session afdb0c776b39
- 1mo ago First seen · 65 lines · 53 tokens per session scan A a811cc0d7474
code-review-graph is a skill published in the GitHub repository DDS-Solutions/AI-TadPole-OS (8 stars, last pushed 5d ago), licensed MIT. It adds 40 tokens to every session and 890 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
isolating-product-facade-contracts
Plan and execute product isolation migrations to a facade plus contract layer in PostHog, following the Visual review architecture. Use when a product still exposes internals (models/logic/views) across boundaries and needs migration toward contracts.py + facade/api.py + presentation separation, with a PR strategy…
walkeros-understanding-development
Use when contributing to walkerOS, before writing code, or when unsure about project conventions. Covers build/test/lint workflow, XP principles, folder structure, and package usage.
qa-frontend
Internal PostHog developer frontend/browser QA skill. Use only when a PostHog developer explicitly asks to run frontend QA, browser-test a PR, verify a UI flow against the local PostHog stack, use qa-frontend, or QA current frontend changes with browser/runtime evidence, or to make a feature reel (see reel mode…
reviewing-personhog-protocol
The full review process for personhog coordination-protocol changes — leases, fencing, handoffs, supervisors, failure budgets, warming, and changelog semantics. Use before pushing or requesting review on any personhog protocol changeset, when asked for an exhaustive or careful review of personhog code, and after any…
splitting-oversized-modules
Split an oversized Python module (a thousand-plus-line logic.py, models.py, api.py, or its test file) into a package of one module per concern, mechanically and provably without changing behavior. Use on a request to split / break up / decompose a god module or move functions out of one, once a human has agreed to…
establishing-code-ownership
Determine which PostHog team owns a file, directory, or code path, or enumerate all code a team owns (via distributed owners.yaml, products//product.yaml, and .github/CODEOWNERS). Use when assigning a reviewer, attributing a bug or slow query to a team, routing work, scoping a team-wide audit, or answering "who owns…