Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add jdanigo/hydraia --skill repo-scangit clone --depth 1 https://github.com/jdanigo/hydraiaWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/jdanigo/hydraia/repo-scan)<a href="https://agentmods.dev/skills/jdanigo/hydraia/repo-scan"><img src="https://agentmods.dev/badge/skills/jdanigo/hydraia/repo-scan/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/jdanigo/hydraia/repo-scan"><img src="https://agentmods.dev/badge/skills/jdanigo/hydraia/repo-scan.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00036 | $0.00829 |
| Opus 5 | $0.00018 | $0.00415 |
| Sonnet 5 | $0.00007 | $0.00166 |
| Haiku 4.5 | $0.00004 | $0.00083 |
Grade A, and why
repo-scan scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
This is a copy
98% identical to repo-scan — 127 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.
How it starts
The opening of the file, as written. The whole thing — 80 lines — stays where its author put it; the contents beside it link to each section on GitHub.
repo-scan
Every ecosystem has its own dependency manager, but no tool looks across C++, Android, iOS, and Web to tell you: how much code is actually yours, what's third-party, and what's dead weight.
When to Use
- Taking over a large legacy codebase and need a structural overview
- Before major refactoring — identify what's core, what's duplicate, what's dead
- Auditing third-party dependencies embedded directly in source (not declared in package managers)
- Preparing architecture decision records for monorepo reorganization
Installation
# Fetch only the pinned commit for reproducibility
mkdir -p ~/.claude/skills/repo-scan
git init repo-scan
cd repo-scan
git remote add origin https://github.com/haibindev/repo-scan.git
git fetch --depth 1 origin 2742664
git checkout --detach FETCH_HEAD
cp -r . ~/.claude/skills/repo-scan
Review the source before installing any agent skill.
Core Capabilities
| Capability | Description |
|---|---|
| Cross-stack scanning | C/C++, Java/Android, iOS (OC/Swift), Web (TS/JS/Vue) in one pass |
| File classification | Every file tagged as project code, third-party, or build artifact |
| Library detection | 50+ known libraries (FFmpeg, Boost, OpenSSL…) with version extraction |
| Four-level verdicts | Core Asset / Extract & Merge / Rebuild / Deprecate |
| HTML reports | Interactive dark-theme pages with drill-down navigation |
| Monorepo support | Hierarchical scanning with summary + sub-project reports |
Analysis Depth Levels
| Level | Files Read | Use Case |
|---|---|---|
fast |
1-2 per module | Quick inventory of huge directories |
standard |
2-5 per module | Default audit with full dependency + architecture checks |
deep |
5-10 per module | Adds thread safety, memory management, API consistency |
full |
All files | Pre-merge comprehensive review |
How It Works
- Classify the repo surface: enumerate files, then tag each as project code, embedded third-party code, or build artifact.
- Detect embedded libraries: inspect directory names, headers, license files, and version markers to identify bundled dependencies and likely versions.
- Score each module: group files by module or subsystem, then assign one of the four verdicts based on ownership, duplication, and maintenance cost.
- Highlight structural risks: call out dead-weight artifacts, duplicated wrappers, outdated vendored code, and modules that should be extracted, rebuilt, or deprecated.
- Produce the report: return a concise summary plus the interactive HTML output with per-module drill-down so the audit can be reviewed asynchronously.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 7d ago First seen · 80 lines · 36 tokens per session scan A 691cb6f30316
repo-scan is a skill published in the GitHub repository jdanigo/hydraia (8 stars, last pushed 21d ago), licensed MIT. It adds 36 tokens to every session and 829 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. It is 98% identical to repo-scan, differing in 127 lines, and is treated as a copy.
Other skills, from other repositories
jentic
Use this skill whenever the user wants to work with a third-party or external API/tool through the Jentic platform — e.g. asks to "find the vessel-tracking API and add it", "get rows from this Google Sheet", connect Slack, import/search/discover an API, integrate or automate a SaaS, pull data from a service, or call…
contribute-spec-fix
Fix a broken OpenAPI spec in jentic-public-apis with an OpenAPI Overlay, validate it (spectral lint + idempotency check), and contribute it back via a PR to the community catalog. Falls back to applying the same overlay to the local Jentic registry if the user can't wait for maintainer approval, and closes the loop by…
returns-policy
Answer return, refund, and warranty questions for electronics. Use when the user mentions returns, refunds, RMAs, warranty coverage, damaged items, or opened packaging.
technical-troubleshooting
Provide setup, troubleshooting, and maintenance guidance. Use when the user reports a device that won't power on, connectivity issues, setup questions, overheating, or maintenance concerns.
fabrik-review
Use when operating as the Fabrik Review stage agent. This skill guides code review of an implementation, finding and fixing issues, and ensuring the PR is ready for human review.
fabrik-implement
Use when operating as the Fabrik Implement stage agent. This skill guides the implementation of a planned feature, following the task checklist to produce committed, tested, pushed code on a feature branch.