Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/kleosr/kleosrules/complexitynpx skills add kleosr/kleosrules --skill complexitygit clone --depth 1 https://github.com/kleosr/kleosrulesWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00066 | $0.00770 |
| Opus 5 | $0.00033 | $0.00385 |
| Sonnet 5 | $0.00013 | $0.00154 |
| Haiku 4.5 | $0.00007 | $0.00077 |
Grade A, and why
complexity scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 77 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Complexity
Thin roof: shared/rules/complexity.mdc. The lint number is law. Nesting ≤2 in ponytail is not a substitute.
Cap
Repo config wins. Else 10. Do not raise a cap that already exists. Do not switch to Sonar cognitive complexity unless this repo already uses it.
Detect (Grep, then one tool)
- Grep
complexity,C901,mccabe,gocyclo,cyclo,cognitivein eslint/ruff/clippy/biome/pyproject.toml/Makefile/CI. - If a cap exists, that number is law.
- If missing and eslint, ruff, or biome is already installed: add the rule to that config. Do not add a new linter stack.
- If no linter exists: still write as if cap 10. Cite that TOOLCHAIN has no complexity job. Do not invent eslint for a repo that has none.
TS/JS
Legacy .eslintrc*: "complexity": ["error", 10] (or the repo's number).
Flat eslint.config.*: keep the repo's existing complexity option; if absent and eslint already runs, add it next to the other rules — same number.
Run the repo lint on files you touched (pnpm exec eslint path, pnpm exec biome check path). Not a global npx stack.
Python / Go / Rust
Ruff: C901 with max-complexity = 10 (or the repo's number). Pylint R1260 only if pylint is already the house linter. gocyclo or clippy only if already in TOOLCHAIN.
Red — extract until green
Do this, in order:
- Early return. Flatten
if. - Replace
else ifchains with a map/table. - Pull a branch into a named function that does one job.
- Nested ternary →
ifor a lookup.
Never eslint-disable complexity, # noqa: C901, --ignore C901, or clippy allow-wrap. before_shell.sh denies those bypasses.
// BAD — one function owns every branch
export function route(cmd: string, admin: boolean): string {
if (cmd === "a") {
if (admin) return "a-admin"
return "a"
} else if (cmd === "b") {
if (admin) return "b-admin"
return "b"
}
return "none"
}
// GOOD — table + early return (lint can count this)
const TABLE: Record<string, { user: string; admin: string }> = {
a: { user: "a", admin: "a-admin" },
b: { user: "b", admin: "b-admin" },
}
export function route(cmd: string, admin: boolean): string {
const row = TABLE[cmd]
if (!row) return "none"
if (admin) return row.admin
return row.user
}
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 77 lines · 66 tokens per session scan A 7de85babb5e8
complexity is a skill published in the GitHub repository kleosr/kleosrules (2 stars, last pushed 2d ago), licensed MIT. It adds 66 tokens to every session and 770 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
agentic-dns
Agentic AI-native multi-tier DNS routing, live packet tracing, and failover bypass engine for Pi-hole, CoreDNS, dnsdist, Unbound, Stubby, DNSCrypt-Proxy, and VPN DNS.
diagnose
Diagnose your Claude Code hooks setup. Checks which hooks are active, verifies permissions, and identifies common configuration issues.
110-java-maven-best-practices
Use when you need to review, improve, or troubleshoot a Maven pom.xml file — including dependency management with BOMs, plugin configuration, version centralization, multi-module project structure, build profiles, or any situation where you want to align your Maven setup with industry best practices. Part of the…
032-architecture-adr-non-functional-requirements
Facilitates conversational discovery to create Architectural Decision Records (ADRs) for non-functional requirements using the ISO/IEC 25010:2023 quality model. Use when the user wants to document quality attributes, NFR decisions, security/performance/scalability architecture, or design systems with measurable…
124-java-secure-coding
Use when you need to apply Java secure coding best practices — including validating untrusted inputs, defending against injection attacks with parameterized queries, minimizing attack surface via least privilege, applying strong cryptographic algorithms, handling exceptions securely without exposing sensitive data…
132-java-testing-integration-testing
Use when you need to set up, review, or improve Java integration tests — including generating a BaseIntegrationTest.java with WireMock for HTTP stubs, detecting HTTP client infrastructure from import signals, injecting service coordinates dynamically via System.setProperty(), creating WireMock JSON mapping files with…