Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/kouroshez/coding-os/graph-explorernpx skills add kouroshez/coding-os --skill graph-explorergit clone --depth 1 https://github.com/kouroshez/coding-osWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00068 | $0.03050 |
| Opus 5 | $0.00034 | $0.01525 |
| Sonnet 5 | $0.00014 | $0.00610 |
| Haiku 4.5 | $0.00007 | $0.00305 |
Grade A, and why
graph-explorer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 226 lines — stays where its author put it; the contents beside it link to each section on GitHub.
graph-explorer
Purpose: Load the graph_os toolset (cos_graph_* MCP tools) and
use it deliberately before any non-trivial code edit. The graph is the
third retrieval layer (CLAUDE.md Three-Layer Retrieval) — use it when
tree-grep or past-memory searches return noise.
Read when: Editing src/core/** or src/cli/**, producing a rename plan,
auditing API/MCP contracts, answering "what depends on X".
Skip when: You already know the blast radius, or the change is a self-contained one-file edit with no callers.
Decision ladder
- Need to know "what calls this?" →
cos_graph_references(uid). - Need surrounding context before editing? →
cos_graph_context(uid_or_name, depth=1)(Implementer pre-impl step). - Planning a refactor? →
cos_graph_impact(uid, depth=3)(Analyst dependency map) groups edges by risk tier. - Renaming a symbol? →
cos_graph_rename_plan(uid, new_name)before anyEdit— returns call-sites, doc refs, tests, string literals. - API / contract audit? →
cos_graph_contracts(kinds=["http","mcp"])(Documenter + Deployer). - Tracing a fault? →
cos_graph_trace(entry_uid)(Debugger fault isolation step). - "Is anything similar?" →
cos_graph_similar(uid, top_k=5). - Shortest dependency path? →
cos_graph_path(source, target). - Need a diagram? →
cos_graph_export(format="mermaid", root_uid=...). - Pre-commit self-review? →
cos_graph_detect_changes(files=[...])— call BEFOREmake verify.
Method blast-radius — use
impact, not barereferences(kinds="calls"). Static AST cannot resolve instance-method calls on locally-typed receivers (backend.upsert_node(...)— the type ofbackendis unknown), soreferences(method, kinds="calls")under-reports those call sites.cos_graph_impactcompensates by traversing method→class→constructs, so "what breaks if I change this method?" stays complete. Treatreferences(calls)as a lower bound for methods.
Function blast-radius — import bindings are first-class (TASK-402). Every
from M import namesite emits animport_node which thelink_import_bindingspass binds to the real symbol (exactly-one match; ambiguous → skipped, never guessed).references(function)with default kinds therefore returns BOTH directcallsedges ANDimportsedges whoseimport_source node carries the caller'sfile_path— the init_db probe went from 6 to 80 of 106 caller files once this pass landed. Two caller classes stay invisible to static resolution and need a grep complement on security-critical sweeps: module-alias attribute calls (import database as db; db.init_db()) and calls embedded in string literals (python -c "from … import …").
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 226 lines · 68 tokens per session scan A 442e7076b67a
graph-explorer is a skill published in the GitHub repository kouroshez/coding-os (6 stars, last pushed 2d ago), licensed Apache-2.0. It adds 68 tokens to every session and 3,050 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
potpie-source-ingestion
Use when the user explicitly asks to ingest, refresh, or deeply understand a repository, PR, issue, ticket, runbook, incident report, document, or web link into Potpie. The harness performs todo-driven discovery, uses local/GitHub/integration tools and read-only subagents when available, builds evidence-backed…
potpie-repo-baseline
Use when establishing, refreshing, or deeply understanding a repository's baseline memory in Potpie: purpose, application type, features, services/modules, environments, deploy shape, dependencies, API contracts, datastores, integrations, ownership, and explicit preferences. The harness reads authored and…
graph-mutation-plan
Cookbook for composing an applygraphmutations plan — stable entitykey patterns, the canonical label/edge vocabulary, evidence/invalidation/confidence discipline, and a worked example. Load this when building a non-trivial mutation plan.
obsidian-layout-adjustment
Workflow for working with the user on changing how Obsidian looks using CSS snippets. Use this whenever the user asks to restyle Obsidian, tune a vault's visual layout, adjust tabs, sidebars, note surfaces, properties, backlinks, graph panes, file explorer rows, icons, links, shadows, active states, or CSS snippets.…
alfworld-locate-target-object
Navigates to a suspected location and identifies a target object. Use when your goal requires finding a specific object (e.g., "potato", "plate") and its location is not immediately known. Moves to a relevant receptacle (like a fridge or cabinet), checks its contents, and outputs the object's location or confirms its…
scienceworld-growth-focuser
Use when you have planted a seed or need to track a plant's growth stage (sprouting, flowering, reproduction). Applies the 'focus on' action to a specific plant or biological entity to signal intent and monitor its development. Trigger after planting or when you need to observe life cycle progression in the…