Borrowing it
Nothing to install: this file belongs to geml-spec/geml. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/geml-spec/geml/main/.claude/skills/geml-code-graph/SKILL.mdgit clone --depth 1 https://github.com/geml-spec/gemlWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/geml-spec/geml/geml-code-graph)<a href="https://agentmods.dev/skills/geml-spec/geml/geml-code-graph"><img src="https://agentmods.dev/badge/skills/geml-spec/geml/geml-code-graph/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/geml-spec/geml/geml-code-graph"><img src="https://agentmods.dev/badge/skills/geml-spec/geml/geml-code-graph.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00120 | $0.03855 |
| Opus 5.5 | $0.00048 | $0.01542 |
| Sonnet 5.5 | $0.00024 | $0.00771 |
| Haiku 4.5 | $0.00012 | $0.00385 |
Grade A, and why
geml-code-graph scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 226 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Code-graph navigation (codemap profile)
This is the in-repo variant of integrations/*/skills/geml-code-graph/SKILL.md: paths are repository-relative and it adds the local node geml-parser/dist/geml.js codemap … form; the plugin copies are byte-identical to each other and ship with the agent host plugins (geml skill install installs only the geml skill).
The call graph lives as text documents, not a database (profile:
spec/profiles/geml-codemap/geml-codemap-profile.md): one GEML document per container (module / dir /
file), each with ONE meta (module, src, entry, resolution-default),
empty-body code blocks per method, and up to three CSV edge tables —
#calls (out), #called-by (in), #unresolved (blind spots). The build's
verify has checked that every edge reference resolves.
The moves
# 1. resolve a name — where does a symbol live
node -e "console.log(JSON.stringify(require('./.geml/codemap/_index/name-lookup.json')['hashtableFind'],null,1))"
# → [{"anchor":"c:hashtable.c#hashtableFind(…)","doc":"hashtable.c.geml","id":"hashtableFind"}, …]
# Multiple entries = real ambiguity (e.g. a .c definition and a .h inline) — inspect each.
# 2. container overview — the module's surface, one glance
head -8 .geml/codemap/hashtable.c.geml # meta: entry = the externally-called methods
# 3. open the method block (src= tells you exactly where the code is)
geml get .geml/codemap/hashtable.c.geml '#hashtableFind'
# 4. forward: what it calls (grep your method's rows; follow doc.geml#id refs)
geml get .geml/codemap/hashtable.c.geml '#calls'
# 5. reverse: who calls it (aggregated, with file:line sites)
geml get .geml/codemap/hashtable.c.geml '#called-by'
A reference is #id (same document) or sibling.geml#id (that document, that
block) — geml get it the same way. index.geml holds the repo-level view:
app entries in its meta, #modules / #module-edges aggregate tables.
Reading the tables
| Line | Meaning |
|---|---|
#calls row, empty confidence |
resolved at the document's resolution-default, high confidence |
#calls row kind=candidate |
dispatch ambiguity: one of several implementations, right after its main call row. Treat the SET as the answer, never just the first |
#calls row confidence medium/low |
the extractor is less sure — say so when reporting |
#unresolved rows (hidden table) |
calls the extractor could NOT resolve — blind spots, not evidence of absence; fall back to grep when one matters |
#called-by absent for a method |
no resolved callers. Under resolution-default = heuristic that means little; under cpg it is strong (but pointer/dynamic dispatch still lands in #unresolved) |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 6d ago Changed e3d7d5612316
- 17d ago Changed · +2 lines 1e1603b856e6
- 1mo ago Changed 951411d5d253
- 1mo ago First seen · 224 lines · 120 tokens per session scan A 36622c9a6160
geml-code-graph is a skill published in the GitHub repository geml-spec/geml (29 stars, last pushed today), licensed MIT. It adds 120 tokens to every session and 3,855 once invoked, about $0.0005 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
dekko-verify
Sanity-check a suspiciously low or zero call-graph result from dekko (getcallers, getcallees, findusages, impactedtests, unused) before concluding "no callers" or "dead code," or a heritage/throws-provenance result (query supertypes, query subtypes, query throws) that labels something (external) when you expect it to…
jev
Use Jev or optional OpenAI Decisions for bounded routing, shell-command risk, text screening and failure triage. Use for "jev", "system one", or "classify this".
sw-jev
Use Jev or optional OpenAI Decisions for bounded routing, shell-command risk, text screening and failure triage. Use for "jev", "system one", or "classify this".
dekko-debug
Work a stack trace, exception, or error report from dekko's map instead of reading each frame's file. Trigger when given a traceback, an exception type or message, a failing test's error, or a question like "why does X raise", "who handles this error", "how does control get from A to B", or "where is this env var…
dekko-refactor
List every site a rename, move, or signature change must touch before editing, then prove nothing was missed after. Trigger when about to rename a function, method, class or type, rename or move a file or module, change a parameter list or return type, move a symbol between files, or remove a symbol, in a repo with a…
sqry-mistralvibe
Setup and workflow for using sqry semantic code search with the Mistral Vibe CLI. CLI-first, with MCP configuration via Vibe's config.toml. Covers installation, tool naming conventions, CLI fallback, and troubleshooting. Tool reference and query syntax are served live by sqry-mcp.