Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/kangig94/coral/pathfindnpx skills add kangig94/coral --skill pathfindgit clone --depth 1 https://github.com/kangig94/coralWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/kangig94/coral/pathfind)<a href="https://agentmods.dev/skills/kangig94/coral/pathfind"><img src="https://agentmods.dev/badge/skills/kangig94/coral/pathfind.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00015 | $0.02809 |
| Opus 5 | $0.00008 | $0.01404 |
| Sonnet 5 | $0.00003 | $0.00562 |
| Haiku 4.5 | $0.00002 | $0.00281 |
Grade A, and why
pathfind scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 309 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Pathfinding — Symptom-to-Direction Discovery
Pathfind always produces a ranked direction list and hands off to /preplan.
This is the defining contract.
Step 1 — Intake
Parse the user's problem descriptions from args.
-
Clarification guardrail: If fewer than 2 concrete symptoms are identified, ask clarifying questions. Max 2 clarification rounds, then proceed with caveats noted in the artifact.
-
Derive
{topic}from the user's input as English kebab-case (e.g. "API slow, DB limits, user complaints" ->api-performance) -
Create artifact file:
CORAL_PROJECT/plans/pathfind-{topic}.mdwith header:# Pathfind: {topic} ## Problems [User's original problem descriptions]
Step 2 — Triage
Cluster related problems by shared patterns, systems, or root cause indicators.
- Group symptoms that likely share a common cause
- Identify cross-cutting symptoms that appear in multiple clusters
- Single-symptom input: treat as one cluster, note limited clustering in artifact
Write to artifact:
## Problem Clusters
| Cluster | Symptoms | Pattern |
|---------|----------|---------|
| {name} | {list} | {shared pattern or system} |
Step 3 — Investigate
Bug detection: Before investigation, check for bug-type symptoms:
- Detection: symptoms containing error output, stack traces, or "X crashes/fails when Y"
- If bug-type symptoms found:
- Suggest: "These symptoms look like code bugs — consider
/analyzeor/bugfixfor: {bug symptoms}" - If all symptoms are bugs: exit with delegation suggestion
- If mixed: continue pathfind with remaining non-bug symptoms
- Suggest: "These symptoms look like code bugs — consider
Investigation path — choose based on whether relevant code exists:
A. Codebase exists (clusters reference existing systems, files, or modules):
Agent({ subagent_type: "coral:scanner",
prompt: "Investigate these problem clusters using Approach B (Process Investigation).
Scope: systems and modules related to these clusters only — do NOT perform a full project scan.
Clusters: {cluster list with symptoms}
Work dir: {work_dir}
Output: root cause candidates per cluster with file:line evidence." })
If scanner fails: retry once, then proceed with direct codebase reads.
B. No codebase / process-only problems (clusters are about workflow, team, tooling, or greenfield): Skip scanner. Pathfind derives root causes directly from triage clusters through reasoning. Use web search for prior art if the problem domain is unfamiliar.
Map findings to problem clusters — derive root causes:
- Each root cause must trace back to one or more clusters
- Each root cause must have evidence (file:line, observation, or reasoning chain)
Write to artifact:
## Root Causes
| # | Root Cause | Source Cluster | Evidence |
|---|-----------|----------------|----------|
Step 4 — Prescribe
Generate directions through orthogonal lanes — one direction per lane, not multiple per root cause. Lanes guarantee divergence because each forces a different mechanism.
Derive lanes from the problem domain. Each lane must represent a fundamentally different mechanism — not a variation. Aim for 3-5 lanes.
Examples by domain:
Code/architecture problems:
| Lane | Perspective |
|---|---|
local_repair |
Minimal in-place fix, no architectural change |
boundary_redesign |
Move responsibility across interfaces or ownership lines |
representation_change |
Change state, data model, or information shape |
probe_first |
Add instrumentation or experiments before committing to a fix |
workflow_guardrail |
Solve via tests, process, tooling, or validation |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 309 lines · 15 tokens per session scan A f4eb239e6ca6
pathfind is a skill published in the GitHub repository kangig94/coral (11 stars, last pushed 3d ago), licensed MIT. It adds 15 tokens to every session and 2,809 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
deployment
This skill should be used when shipping an app to production — setting up CI/CD, deploys, preview environments, error monitoring, environment separation, or rollback. Trigger phrases include "deploy this", "set up CI/CD", "GitHub Actions", "add error tracking", "set up Sentry", "monitor production", "staging…
api-design
This skill should be used when designing or building an API — endpoints, routes, request/response shapes, error formats, pagination, versioning, or deciding REST vs GraphQL. Trigger phrases include "design the API", "build an endpoint", "REST or GraphQL", "how should I structure my routes", "API error format"…
architecture-primer
This skill should be used when the user wants to design, plan, or decide the architecture of a system, app, or platform from scratch. Trigger phrases include "how do I structure this", "what architecture should I use", "how does this scale", "monolith or microservices", "what database", "what stack", "design the…
saas-router
This skill should be used FIRST whenever the user wants to create, build, design, ship, or prototype any digital product — a SaaS, web app, platform, MVP, landing page, sales page, dashboard, admin panel, backoffice, internal tool, API, database, auth, payments, or any user interface. Trigger phrases (English) include…
data-modeling
This skill should be used when designing a database schema, modeling data, choosing a database, planning migrations, or setting up multi-tenancy for a SaaS. Trigger phrases include "design the database", "model this data", "what database should I use", "schema for", "multi-tenant", "tenant isolation", "add an index"…
pre-ship-security
This skill should be used right before deploying or shipping to production — a fast security review of the finished code, not a deep audit. Trigger phrases include "ready to ship", "before I deploy", "security check before launch", "is this safe to ship", "pre-launch checklist", "review security", "did I miss…