Getting it into your agent
This one installs as part of its plugin. Adding the marketplace and installing the plugin brings it with everything else the plugin ships.
/plugin marketplace add JSungMin/vs-token-safer/plugin install vs-token-saferWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/jsungmin/vs-token-safer/vs-dce)<a href="https://agentmods.dev/skills/jsungmin/vs-token-safer/vs-dce"><img src="https://agentmods.dev/badge/skills/jsungmin/vs-token-safer/vs-dce/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/jsungmin/vs-token-safer/vs-dce"><img src="https://agentmods.dev/badge/skills/jsungmin/vs-token-safer/vs-dce.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00128 | $0.00994 |
| Opus 5 | $0.00064 | $0.00497 |
| Sonnet 5 | $0.00026 | $0.00199 |
| Haiku 4.5 | $0.00013 | $0.00099 |
Grade A, and why
vs-dce scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 53 lines — stays where its author put it; the contents beside it link to each section on GitHub.
vs-token-safer — dead-code elimination (preview only)
Topological dead-code analysis built on the OFFICIAL language-server call graph (clangd / Roslyn / tsserver /
pyright). You name seed symbol(s); it walks callers/callees to a fixpoint and classifies every reachable
symbol. The output is token-capped (names + file:line, no source bodies). Nothing leaves the machine.
How to run
Prefer the vts_admin MCP tool (it runs in the warm server process; vts is often not on PATH in Bash). Fall
back to the bundled CLI via node:
vts_admin { "op": "dce", "params": { "seed": "Foo", "projectPath": "<root>" } }
# several seeds: "params": { "seeds": "Foo,Bar", "projectPath": "<root>", "entry": "main,registerPlugin" }
# CLI fallback: node "$CLAUDE_PLUGIN_ROOT/server/cli.js" dce --seed Foo --projectPath <root>
Warm-index requirement (C++/clangd). The call graph must be warm. A cold or large clangd tree (e.g. an
Unreal monorepo, ~26k TUs) under-reports callers, so a live symbol could look DEAD — dce therefore REFUSES on
a cold clangd index. Scope + build first: vts setup --scope Source then vts preindex (or keep the MCP server
warm), then re-run. allowCold=true inspects a cold index with every verdict forced to INCONCLUSIVE (never
DEAD). TypeScript/Python/C# index on open and are not gated.
Show the result verbatim. Buckets: DEAD (no live caller, in safe deletion order) · HELD (still called) ·
ENTRY (kept root: main / public API / a name passed via entry) · INCONCLUSIVE (unresolved or the
caller set couldn't be proven complete).
Two modes. Default = caller-cascade (start from seeds, follow callers). Pass roots to switch to
reachability / mark-sweep (the Go-deadcode/RTA model): liveness is computed FORWARD from the named entry
points, so a missing caller can't cause a false DEAD — only an incomplete root set can (the reference verify
catches it). Roots are framework-agnostic — name them (roots="main,RunTests") or commit a team-curated
.vts-index/dce-roots.json. vts hard-codes NO framework markers (no UFUNCTION / @Route / [Test]); you
declare your own entry points, the same charter-pure mechanism as the committable concept-synonyms file.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 53 lines · 128 tokens per session scan A afb0658f17ad
vs-dce is a skill published in the GitHub repository JSungMin/vs-token-safer (11 stars, last pushed yesterday), licensed MIT. It adds 128 tokens to every session and 994 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
clipper1
Use when maintaining legacy code that depends on Clipper 1.x API for polygon clipping and offsetting. Clipper1: the original widely-deployed polygon boolean library. Prefer Clipper2 for new projects.
clipper2
Use when performing high-performance 2D polygon boolean operations (union, intersection, difference, XOR) and offsetting via C++, C#, or Python bindings. Clipper2: the modern polygon clipping library with robust numerical handling.
entity-design
Design EF Core entities with navigation properties, value objects, Fluent API configuration, and audit fields. Use when creating new database entities, adding relationships, configuring owned types, designing a domain model for Entity Framework Core, or setting up table-per-hierarchy inheritance.
tech-preflight-dotnet
Verify .NET SDK compatibility, map project dependency graphs, and run baseline builds before code changes. Use when starting a new task, onboarding to a .NET solution, checking environment readiness, or diagnosing build failures from SDK mismatches.
cpp-debugging
Use when a C++ failure involves memory lifetime, undefined behavior, native crashes, or debugger-only state — debug with symbols, sanitizers, and platform-native debuggers before patching symptoms.
aspnet-core
ASP.NET Core 8+ with controllers, services, DI, configuration, and middleware pipeline. Covers Program.cs setup and enterprise patterns. USE WHEN: user mentions "ASP.NET Core", "Web API", ".NET controllers", "Program.cs", "dependency injection", ".NET DI", ".NET configuration", "appsettings" DO NOT USE FOR: Minimal…