Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/ghostlygawd/codeweb/codebase-anatomynpx skills add GhostlyGawd/codeweb --skill codebase-anatomygit clone --depth 1 https://github.com/GhostlyGawd/codewebWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00136 | $0.02745 |
| Opus 5 | $0.00068 | $0.01373 |
| Sonnet 5 | $0.00027 | $0.00549 |
| Haiku 4.5 | $0.00014 | $0.00275 |
Grade A, and why
codebase-anatomy scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 213 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Codebase Anatomy (codeweb)
Build a structural map of the system. Each function, class, method, or exported symbol is a node. Calls, imports, and inheritance relationships are edges. Each node belongs to a domain. An overlap graph identifies separate parts that do the same work.
The result is an evidence-backed restructuring plan. It identifies the duplicated logic that can move into one defined system and the symbols that must depend on that system.
When to Use
- Restructuring your own codebase and you need to see the real dependency web and where it's duplicative before moving code.
- Onboarding to a large or legacy system at symbol resolution, including relationships across folders.
- Reviewing an external repo (a plugin, library, or template you found on GitHub) end-to-end before adopting it — what it does, how it's wired, and whether it's worth committing to.
- Hunting cross-cutting duplication that file/module tools miss (the same check coded N times in N domains).
Two Modes
- internal — analyze the current project; produce a domain map + overlap graph + restructure recommendations.
- external —
targetis a git URL orowner/repo. Clone it read-only to a temp dir, map it the same way, and add an adoption review (risk, dependencies, architecture verdict, "should you adopt this?").
Auto-detect: a URL or owner/repo ⇒ external; a path or . ⇒ internal. --mode overrides.
Non-Negotiable Rules
- Never execute the target. No build, run, test, install, or entrypoint — for internal or external code. Only read files and invoke read-only static-analysis tools that inspect files already on disk. This is absolute for external repos (their toolchain can run their code).
- Evidence over guesswork. Every node, edge, domain, and overlap must trace to code you read
or a tool emitted. When unsure of an edge or an overlap, omit it or mark it
low— never inflate. A report that cries wolf is worse than no report. - No silent truncation. If you cap depth, sample, or skip files, say so in the report and in
meta. Coverage gaps must be visible. - One graph, one schema. Everything conforms to
references/graph-schema.md. The HTML renderer and all agents depend on it. - Reuse, don't reinvent. If they're installed, hand off to
repo-scan(file/library classification),codebase-onboarding(guides),refactor-cleaner(acting on the list) rather than redoing their jobs. These are optional separate skills — when absent, do the step inline (each Handoffs entry names its one-line alternative). Never search for or apologize about a skill that isn't there.
What ships with it
3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 213 lines · 136 tokens per session scan A 486246e26e0f
codebase-anatomy is a skill published in the GitHub repository GhostlyGawd/codeweb (0 stars, last pushed 2d ago), licensed MIT. It adds 136 tokens to every session and 2,745 once invoked, about $0.0007 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
bonsai-ninja
Use bonsai-ninja as compiler-backed structural evidence when mapping a codebase, finding symbols, tracing behavior, inspecting dataflow, debugging across files, reviewing change impact, exporting graph facts, or running SAST.
dekko-orient
Use dekko's tools instead of grep/Read whenever a repo has a .dekko/ directory — not just at session start. Trigger on any "find/locate/understand this symbol," "what does this file/dir contain," "what will this change break," or "read this file" impulse. dekko has already parsed and indexed the repo; grepping or…
dekko-daemon
Start dekko's background daemon before a session that will run many bare dekko CLI commands via Bash (not the MCP tools) against a large or medium repo. Trigger when you're about to run several dekko CLI invocations in a row on the same repo — a long refactor loop, a batch of query/search/outline calls, or a…
dekko-notes
Read and write dekko's symbol-anchored notes in any repo with a .dekko/ directory. Trigger every time you pull a symbol's context (querysymbol, getcontextpack, dekko query/context), right after a non-obvious change, and right after any rename/move/signature edit (to sweep orphaned notes). Notes are durable, committed…
dekko-verify
Sanity-check a suspiciously low or zero call-graph result from dekko (getcallers, getcallees, findusages, impactedtests, unused) before concluding "no callers" or "dead code," or a heritage/throws-provenance result (query supertypes, query subtypes, query throws) that labels something (external) when you expect it to…
dekko-review-context
Give a code-review or PR-description flow a structural head start before reading a diff line by line. Trigger when the user asks for a PR description, a pre-merge summary, or invokes a code-review flow (this repo's open-agent-hub:review//review, or an equivalent in another environment) against a diff in a repo with a…