dedup

dedup is a skill for Claude Code, Codex from edimuj/tokenlean. It costs 69 tokens per session (1,642 once invoked), scanned A, original, MIT.

A workflow for finding repeated or near-identical functions and consolidating them into one shared implementation. It also adds a test that helps prevent the duplication from returning.

In plain words
What is it for?
Use it to remove duplicate helpers, consolidate repeated code, review duplication reports, and protect the cleanup with a test.
Why use it?
It separates meaningful copy-and-paste code from harmless matches and keeps future changes from recreating the same problem.

Skill for Claude CodeCodex

Written for no agent in particular: nothing here depends on one.

Good fit Use it to remove duplicate helpers, consolidate repeated code, review duplication reports, and protect the cleanup with a test.

Compare 6 skills from other repositories ↓
Install with agentmods
npx agentmods add skills/edimuj/tokenlean/dedup
Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent
npx skills add edimuj/tokenlean --skill dedup
Clone the repo
git clone --depth 1 https://github.com/edimuj/tokenlean

Made for: Claude Code, Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for dedup

README.md
[![agentmods](https://agentmods.dev/badge/skills/edimuj/tokenlean/dedup/github.svg)](https://agentmods.dev/skills/edimuj/tokenlean/dedup)
Your own site
<a href="https://agentmods.dev/skills/edimuj/tokenlean/dedup"><img src="https://agentmods.dev/badge/skills/edimuj/tokenlean/dedup/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for dedup

Your own site · 80×15
<a href="https://agentmods.dev/skills/edimuj/tokenlean/dedup"><img src="https://agentmods.dev/badge/skills/edimuj/tokenlean/dedup.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 69 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 1,642 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 1 finding. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00069 $0.01642
Opus 5.5 $0.00028 $0.00657
Sonnet 5.5 $0.00014 $0.00328
Haiku 4.5 $0.00007 $0.00164

Measured 1mo ago against content hash 69d5d02eaec4, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

dedup scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Runs shell commandslowCapability

Expected in a hook, worth knowing in a rule or an instructions file.

import { execFileSync } from 'node:child_process';
skills/claude/dedup/SKILL.md · 164 lines

How it starts

The opening of the file, as written. The whole thing — 164 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Dedup

tl dupes finds duplicates; removing them well is the skill. Most of the output is noise, the wins hide in two tiers, and the mitigation that actually sticks is non-obvious: you remove the second home, not "fix both copies."

Workflow

Scan → Triage → Mitigate → Verify → Ratchet

1. Scan

tl dupes --near        # structural + near surfaced first; tests excluded by default

Via the MCP tool, near is a number (the similarity threshold), not a flag: mcp__callmux__tl_dupes { near: 0.85 }. Passing near: true fails schema validation — the CLI's bare --near defaults that threshold for you.

Files copied verbatim into another tool (e.g. a plugin shipped into a user's config dir) are external contracts — their duplicate helpers are by-design, not cleanup targets. tl dupes excludes them by default. Mark your own in .tokenleanrc.json:

{ "externalContractFiles": ["src/my-copied-plugin.js"] }

Use tl dupes --near --include-contracts only when you deliberately want to audit those copies too.

2. Triage by tier — signal vs. noise

tl dupes returns four tiers. Treat them differently:

  • Structural + near = signal. Renamed clones and copy-paste-with-edits — the drift-prone ones. Start here.
  • Exact = quick wins, but check intent first. Two trivial pass-throughs colliding (return [...this.x.values()]) aren't always worth a shared home.
  • Names = mostly noise. Idiomatic repeats (update, close, get, logger levels). Skim, don't mine — add --no-names once you've glanced.

3. The "real dupe?" test

The rule that separates worth-fixing from leave-it:

  • Same rule encoded twice → collapse it. Validation, response unwrapping, a path-containment check, a magic constant, a normalization step. These are the drift hazards: one copy gets a fix, the other doesn't, and a phantom bug surfaces weeks later.
  • Same shape by coincidence → leave it. Logger debug/info/warn/error, SSE emit* helpers, store thunks, thin HTTP wrappers. Merging hurts readability for zero safety gain.

Read the full file on GitHub · 164 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 1mo ago First seen · 164 lines · 69 tokens per session scan A 69d5d02eaec4

Subscribe to this mod's changes

dedup is a skill published in the GitHub repository edimuj/tokenlean (13 stars, last pushed 3mo ago), licensed MIT. It adds 69 tokens to every session and 1,642 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 1 finding (runs shell commands). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Related

Other skills, from other repositories

deep-module-refactor

Explore a codebase to find opportunities for architectural improvement, focusing on making the codebase more testable by deepening shallow modules. Use when user wants to improve architecture, find refactoring opportunities, consolidate tightly-coupled modules, or make a codebase more AI-navigable.

zebbern/claude-code-guide · 62 tokens

secure-code-review

Systematically reviews code for SQL injection, XSS, SSRF, broken access control, cryptographic failures, and other common OWASP Top 10 vulnerabilities, providing vulnerable code examples and ready-to-use remediation guidance. Trigger this skill when users ask for a security review, vulnerability scan, or penetration…

zebbern/claude-code-guide · 86 tokens

witness

Independently witness that an Allium loop's convergence claim is true and was reached honestly. Use when the user wants to verify a loop's self-report, confirm tests really pass and no generated test was weakened, produce a convergence certificate or witness record, gate CI on a trustworthy signal, or check that an…

juxt/allium · 75 tokens

agentbro-pr-merge

Use when reviewing, fixing CI for, approving workflows for, or merging AgentBro pull requests into dev/main, especially external contributor PRs where contributor attribution matters.

shirenchuang/agentbro · 38 tokens

graph-it-live

Analyze code dependencies, call graphs, and architecture using the graph-it CLI. Use this skill whenever the user wants to understand how their code is connected — even if they don't say "dependency graph" explicitly. Trigger for: "what calls this function", "who uses this class", "is it safe to delete X", "what…

magic5644/Graph-It-Live · 165 tokens

pr-review

Review pull requests and Git diffs with Graph-It-Live risk, breaking-change, dependency-impact, cycle, unused-export, and test-candidate evidence. Use when asked to review a PR, inspect a diff, assess merge risk, check a branch before merging, create a Graph-It-Live review gate, or explain review-pr results. Trigger…

magic5644/Graph-It-Live · 132 tokens