Borrowing it
Nothing to install: this file belongs to j5ik2o/event-store-adapter-js. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/j5ik2o/event-store-adapter-js/main/.agents/skills/law-of-demeter/SKILL.mdgit clone --depth 1 https://github.com/j5ik2o/event-store-adapter-jsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/j5ik2o/event-store-adapter-js/law-of-demeter)<a href="https://agentmods.dev/skills/j5ik2o/event-store-adapter-js/law-of-demeter"><img src="https://agentmods.dev/badge/skills/j5ik2o/event-store-adapter-js/law-of-demeter/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/j5ik2o/event-store-adapter-js/law-of-demeter"><img src="https://agentmods.dev/badge/skills/j5ik2o/event-store-adapter-js/law-of-demeter.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00223 | $0.02507 |
| Opus 5 | $0.00112 | $0.01254 |
| Sonnet 5 | $0.00045 | $0.00501 |
| Haiku 4.5 | $0.00022 | $0.00251 |
Grade A, and why
law-of-demeter scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
This is a copy
100% identical to law-of-demeter — 0 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.
How it starts
The opening of the file, as written. The whole thing — 238 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Law of Demeter
直接の友人とだけ話せ。見知らぬ者に話しかけるな。
核心原則
メソッドは「直接の友人」のメソッドだけを呼び出し、「友人の友人」には手を出さない。
Karl Liebherr（1987年、ノースイースタン大学）が提唱。正式名称は「最小知識の原則（Principle of Least Knowledge）」。
| アプローチ | 特徴 | 問題 |
|---|---|---|
| 連鎖呼び出し | a.getB().getC().doX() |
内部構造に依存、変更に脆い |
| 委譲 | a.doX() |
結合度が低い、変更に強い |
4つのルール
メソッド M が呼び出してよいのは、以下の4種類のメソッドのみ：
| # | 許可される呼び出し先 | 説明 |
|---|---|---|
| 1 | 自身（this / self）のメソッド |
自分のクラスに定義されたメソッド |
| 2 | M の引数として渡されたオブジェクトのメソッド |
パラメータ経由の直接の友人 |
| 3 | M 内で生成したオブジェクトのメソッド |
自分が作ったオブジェクトは友人 |
| 4 | 自身のインスタンス変数（フィールド）のメソッド | 保持しているオブジェクトは友人 |
禁止: 上記メソッド呼び出しの戻り値のメソッドを呼び出すこと（＝友人の友人）
判断フロー
メソッド内で obj.method() を呼んでいる
↓
obj はどこから来たか？
├─ this/self のフィールド → ✅ 許可（ルール4）
├─ メソッドの引数 → ✅ 許可（ルール2）
├─ メソッド内で new/生成した → ✅ 許可（ルール3）
├─ this/self 自身 → ✅ 許可（ルール1）
└─ 別のメソッド呼び出しの戻り値 → ❌ 違反（友人の友人）
アンチパターン検出
Train Wreck（列車事故）
連鎖的なドット呼び出しでオブジェクトの内部構造をたどるパターン：
❌ order.getCustomer().getAddress().getCity()
❌ user.getProfile().getSettings().getTheme().getName()
❌ app.getConfig().getDatabase().getConnection().execute(query)
❌ invoice.getLineItems().get(0).getProduct().getCategory()
検出基準
| パターン | 問題 |
|---|---|
| ドットが2つ以上の連鎖 | 構造依存（ただし流暢APIは例外） |
| getter連鎖 + 末尾の操作 | 取得したオブジェクトの操作 = 友人の友人 |
| getter連鎖 + if文 | 遠いオブジェクトの状態で分岐 |
変換パターン
1. 委譲メソッドの導入
// ❌ 違反: 友人(order)の友人(customer)の友人(address)に話しかけている
City city = order.getCustomer().getAddress().getCity();
// ✅ 修正: 各レベルに委譲メソッドを追加
City city = order.getShippingCity();
// Order
public City getShippingCity() {
return customer.getShippingCity();
}
// Customer
public City getShippingCity() {
return address.getCity();
}
2. 目的に応じたメソッド名
// ❌ 違反: 内部構造を露出した名前
Email email = order.getCustomer().getEmail();
// ✅ 修正: 目的を表すメソッドを提供
Email email = order.getNotificationEmail();
3. パラメータとして渡す
// ❌ 違反: 遠いオブジェクトを取得して使用
void processOrder(Order order) {
PaymentGateway gateway = order.getCustomer().getPaymentGateway();
gateway.charge(order.getTotal());
}
// ✅ 修正: 必要なオブジェクトを引数で受け取る
void processOrder(Order order, PaymentGateway gateway) {
gateway.charge(order.getTotal());
}
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 11d ago First seen · 238 lines · 223 tokens per session scan A ddd905e98459
law-of-demeter is a skill published in the GitHub repository j5ik2o/event-store-adapter-js (24 stars, last pushed today), licensed Apache-2.0. It adds 223 tokens to every session and 2,507 once invoked, about $0.0011 per session on Opus 5. A static security scan graded it A with 0 findings. It is 100% identical to law-of-demeter, differing in 0 lines, and is treated as a copy.
Other skills, from other repositories
code-review-architecture
Architecture-focused code review covering hexagonal boundary violations, DDD anti-patterns, CQRS misuse, and microservices coupling issues. Applied in addition to the language-specific review skill when architecture markers are detected. Invoked when reviewing hexagonal architectures, DDD patterns, or microservices…
cratis-code-review
Review changed code in a Cratis application against the architecture, style, and specification-coverage criteria that the compiler cannot check, and produce a structured report with blocking issues separated from suggestions. Use when asked to review, check, or validate a change. Do not substitute it for a focused…
cratis-engineering-csharp-conventions
Apply the Cratis C# house conventions when writing or reviewing C# in a Cratis repository - formatting, naming, records and primary constructors, nullable handling, XML documentation, custom exceptions, structured logging, dependency injection, and service lifetimes. Use for any "how should this be written" C# style…
cratis-engineering-effect-boundaries
Apply the Cratis effect-boundary contract when writing or reviewing code that publishes, persists, generates, propagates, or releases. On those boundaries partial success is failure - no catch-and-continue, no defaulting to success on an unknown outcome. Use when a degraded run could still report success; defer style…
cratis-performance-review
Perform a focused scalability review of changed code in a Cratis application — Chronicle observers and replay, read-model query shape, command and query payloads, .NET enumeration, and React render cost — and report findings by risk. Use when asked to check for performance or scalability problems. Do not use for…
cratis-security-review
Perform a focused security review of changed code in a Cratis application — injection, authentication and authorization, data exposure, secrets, event-sourcing-specific exposure, and the frontend — and report findings by risk. Use when asked for a security review or audit. Do not use to implement authentication and do…