Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/drhalto/agentmako/mako-tracenpx skills add drhalto/agentmako --skill mako-tracegit clone --depth 1 https://github.com/drhalto/agentmakoWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/drhalto/agentmako/mako-trace)<a href="https://agentmods.dev/skills/drhalto/agentmako/mako-trace"><img src="https://agentmods.dev/badge/skills/drhalto/agentmako/mako-trace.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00070 | $0.00910 |
| Opus 5 | $0.00035 | $0.00455 |
| Sonnet 5 | $0.00014 | $0.00182 |
| Haiku 4.5 | $0.00007 | $0.00091 |
Grade A, and why
mako-trace scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 114 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Mako Trace
Use this skill for focused evidence traces around a known target. The output should help the user understand what implements the target, what depends on it, and what evidence supports the answer.
Targeted Answer Tools
route_trace
Use to find the route handler, nearby files, and evidence for a route/API behavior.
- Best when the user names a route, page, method/path pair, or route-like URL.
- Pair with
auth_pathfor authorization questions. - Pair with
route_contextwhen the user wants a wider route neighborhood.
schema_usage
Use to find where an indexed schema object, table shape, or validation type is defined and referenced.
- Best for schema objects and type-ish entities.
- Use before editing validation contracts or generated schema surfaces.
- Pair with
trace_tableortable_neighborhoodfor database-backed entities.
file_health
Use to understand a file's role, dependents, risks, and likely blast radius.
- Best before editing a central or unfamiliar file.
- Pair with
imports_impactfor a deeper dependency view. - Do not use it for repo-wide orientation; use
repo_map.
auth_path
Use to inspect likely authentication or authorization boundaries for a route, file, feature, or flow.
- Best when the user asks what protects something or whether auth is enforced.
- Pair with
route_trace,route_context, andtenant_leak_auditwhen the risk is tenant or data-boundary related. - If no exact route, file, or feature matches,
auth_pathreturnsmatched: false,reason, and a suggestedcross_searchfallback instead of throwing a batch-breaking error. - Do not overclaim; report evidence and uncertainty.
Composer Trace Tools
trace_file
Use for a compact file trace: symbols, imports, routes, schema touches, and notable relationships before editing.
preflight_table
Use before changing database-backed behavior to inspect table usage, RLS, relations, and common query paths.
trace_edge
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 114 lines · 70 tokens per session scan A 3f56671249ea
mako-trace is a skill published in the GitHub repository drhalto/agentmako (51 stars, last pushed 1mo ago), licensed Apache-2.0. It adds 70 tokens to every session and 910 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
ctxo-safe-edit
Use BEFORE editing, renaming, or deleting any function, class, or method, to avoid breaking dependents.
ctxo-understand
Use at the START of any code task (fix, extend, refactor, understand) before reading source files, to orient with ctxo and avoid going in the wrong direction.
ctxo-review-pr
Use when reviewing a PR, a diff, or recent changes, to get a full risk assessment in one call.
composer-prompting
Internal guidance for shaping a well-specified coding task into a tight Cursor/Composer prompt before delegating it via /cursor:delegate.
figma-design-system-to-design-md
Figma design system to design.md — Extract Figma design system into a structured design.md. Use when user says 'generate design.md', 'extract design system', 'design tokens to markdown', 'create design doc from Figma', 'Figma design system to design.md', or wants to document their design system from token files and…
chinese-git-workflow
国内 Git 平台配置参考——Gitee、Coding.net、极狐 GitLab、CNB 的 SSH/HTTPS/凭据/CI 接入差异与镜像同步配置。仅在用户显式 /chinese-git-workflow 时调用,不要根据上下文自动触发。.