Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add HuntsDesk/ve-kit --skill blast-radiusgit clone --depth 1 https://github.com/HuntsDesk/ve-kitWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/huntsdesk/ve-kit/blast-radius)<a href="https://agentmods.dev/skills/huntsdesk/ve-kit/blast-radius"><img src="https://agentmods.dev/badge/skills/huntsdesk/ve-kit/blast-radius/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/huntsdesk/ve-kit/blast-radius"><img src="https://agentmods.dev/badge/skills/huntsdesk/ve-kit/blast-radius.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00066 | $0.01911 |
| Opus 5.5 | $0.00026 | $0.00764 |
| Sonnet 5.5 | $0.00013 | $0.00382 |
| Haiku 4.5 | $0.00007 | $0.00191 |
Grade A, and why
blast-radius scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 85 lines — stays where its author put it; the contents beside it link to each section on GitHub.
/blast-radius — evidence, then one proven safety fact
The script gathers evidence. You supply the judgment: read what it flagged, say "This is safe because ", and prove that fact by executing something. An argument is not a proof; a passing command is.
Three disciplines sit under it: read every reader to the point where state actually changes, scope a fix by concept rather than by directory (and check parameter defaults, not just call sites), and treat an empty result as a claim about the search, not a fact about the system.
0. Setup
The engine is scripts/blast-radius.sh, a generic, read-only script; every project fact lives in its config, .claude/blast-radius.conf (format: the CONFIG block in the engine's header). It needs git, jq and ast-grep (sg); ripgrep is optional (it falls back to git grep). With no config, every run reports PROBE_FAILED=config and exits 2. bash scripts/blast-radius.sh --self-test proves the config parser, its fail-closed reasons and the never_read refusal, reading nothing.
1. Run the script
Pick the mode that matches the change. Pass $ARGUMENTS through when the user gave one.
| Change | Command |
|---|---|
| Staged, about to commit | bash scripts/blast-radius.sh --staged |
| Unstaged edits or a planned change | bash scripts/blast-radius.sh --files <paths> |
| Commits, e.g. before a push | bash scripts/blast-radius.sh --range <base>..HEAD, where <base> is the branch you push to (e.g. origin/main) |
Run it in full mode (no --brief); --brief is for hooks. Add --guards before a production push to also run the config's banned_guard script.
Exit 2 means a probe failed, not that nothing was found. Each PROBE_FAILED=<name> line names the blind spot. Fix the cause (missing sg/jq/ripgrep, bad range), or run that probe by hand, before you rely on any key it feeds. IMPORTERS=UNKNOWN and TABLES=UNSEARCHED are unknowns, never zeros. So are KEY=SKIPPED(not configured: <directive>) (the config does not cover that probe) and a value prefixed UNCONTROLLED(no <directive>): (a search with no positive control). PROBE_FAILED=config (<reason>) means .claude/blast-radius.conf failed to load, and nothing was evaluated.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 85 lines · 0 tokens per session scan A 648a27e6aa2b
blast-radius is a skill published in the GitHub repository HuntsDesk/ve-kit (3 stars, last pushed 5d ago), licensed MIT. It adds 66 tokens to every session and 1,911 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-12.
Other skills, from other repositories
browser-edge-cases
SOP for debugging browser automation failures on complex websites. Use when browser tools fail on specific sites like LinkedIn, Twitter/X, SPAs, or sites with Shadow DOM.
triage-issue
Analyze a GitHub issue, verify claims against the codebase, and close invalid issues with a technical response.
hive.error-recovery
Follow a structured recovery decision tree when tool calls fail instead of blindly retrying or giving up.
skill-repair
Diagnose and fix failing or degraded skills automatically - systemic-first triage, per-category playbooks, and a verification plan.
self-improve
Improve the agent itself, or audit its recent performance - better skills, prompts, workflows, and config, plus a quality/reliability/memory-hygiene review of what it did and what failed.
systematic-debugging
Systematic approach to diagnosing and fixing errors.