Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add dinhanhthi/coding-friend --skill cf-scangit clone --depth 1 https://github.com/dinhanhthi/coding-friendWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/dinhanhthi/coding-friend/cf-scan)<a href="https://agentmods.dev/skills/dinhanhthi/coding-friend/cf-scan"><img src="https://agentmods.dev/badge/skills/dinhanhthi/coding-friend/cf-scan/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/dinhanhthi/coding-friend/cf-scan"><img src="https://agentmods.dev/badge/skills/dinhanhthi/coding-friend/cf-scan.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00055 | $0.02417 |
| Opus 5.5 | $0.00022 | $0.00967 |
| Sonnet 5.5 | $0.00011 | $0.00483 |
| Haiku 4.5 | $0.00006 | $0.00242 |
Grade A, and why
cf-scan scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 219 lines — stays where its author put it; the contents beside it link to each section on GitHub.
/cf-scan
Scan the project and bootstrap the memory system. User input: $ARGUMENTS
Purpose
New projects start with empty memory. This skill scans the codebase, extracts structured knowledge (architecture, conventions, tech stack, features, infrastructure), and stores it as memories. Safe to run multiple times — existing memories are updated, not duplicated.
Output: {CF_DOCS_ROOT}/memory/{category}/{name}.md. Never use relative paths in write specs (nested git repos); always {CF_DOCS_ROOT} / absolute.
Workflow
Step 0: Custom Guide
bash "<plugin-root>/lib/load-custom-guide.sh" cf-scan
If the block above printed anything, apply only the ## Before, ## Rules, and ## After sections; if it shows the raw command instead of output, re-run that exact load-custom-guide.sh fence now.
Step 0.5: Context Budget Check
Before proceeding, assess context budget:
- If context is above 50%, prefer selective reads (Read with offset/limit) over full file reads
- Limit cf-explorer exploration depth — map structure broadly but only deep-read files directly relevant to memory creation
- If context is above 70%, warn the user that scan quality may degrade and suggest running in a fresh session
Step 1: Warn and Confirm
This step is mandatory — do NOT skip.
Tell the user:
This skill scans your project and populates memory. It uses significant tokens (multiple explorer calls + memory writes). Estimated: 3-5 minutes depending on project size.
- Existing memories will be updated, not duplicated
- New memories will be created for discovered knowledge
- Target: ~10-15 memories covering architecture, conventions, features, infrastructure
$ARGUMENTS is an optional free-form project description; when provided, show it back ("I'll use your description to guide the scan: {$ARGUMENTS}") and include it in every explorer prompt.
Ask the user to confirm before proceeding. If they decline, stop.
Read config from CF_CONFIG_FILE (= $MAIN_REPO_ROOT/.coding-friend/config.json) for docsDir (default: docs) and language (default: en).
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago Changed · -94 lines 534212ce5994
- 1mo ago First seen · 313 lines · 55 tokens per session scan A 61e7ee084f09
cf-scan is a skill published in the GitHub repository dinhanhthi/coding-friend (4 stars, last pushed yesterday), licensed MIT. It adds 55 tokens to every session and 2,417 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
doris-debug-resource-isolation
Use for Doris Workload Group / resource tag queue starvation, CPU/memory isolation leaks, and workload policy debugging. Commands: SHOW WORKLOAD GROUPS, EXPLAIN resource.
officecli-pitch-deck
Use this skill when the user is building a fundraising / investor pitch deck — seed, Series A / B / C, convertible note, SAFE round, strategic raise. Trigger on: 'pitch deck', 'investor deck', 'Series A deck', 'Series B deck', 'Series C deck', 'fundraising deck', 'seed pitch', 'VC deck', 'raising capital', 'term sheet…
morph-ppt
Use this skill when the user wants a .pptx with smooth cross-slide animation — PowerPoint Morph transitions, Keynote-style continuous motion, shapes that grow / move / rotate as the slide advances. Trigger on: 'morph', 'morph transition', 'smooth transition', 'continuous animation across slides', 'Keynote-style…
officecli-academic-paper
Use this skill to build academic-style .docx output: journal / conference / thesis chapters carrying formal citation style (APA, Chicago, IEEE, MLA), numbered equations, figure & table cross-references, footnotes/endnotes, bibliography, or multi-column journal layout. Trigger on: 'research paper', 'journal paper'…
officecli-financial-model
Use this skill when the user wants to build a financial model — 3-statement model, DCF valuation, LBO, SaaS unit economics, sensitivity / scenario analysis, debt schedule, or fundraising projections — in Excel. Trigger on: 'financial model', '3-statement model', 'P&L + BS + CF', 'DCF', 'WACC', 'NPV', 'terminal value'…
officecli-pptx
Use this skill any time a .pptx file is involved -- as input, output, or both. This includes: creating slide decks, pitch decks, or presentations; reading, parsing, or extracting text from any .pptx file; editing, modifying, or updating existing presentations; combining or splitting slide files; working with…