jscpd is a source-code copy/paste detector that finds duplicated code blocks across files and reports the results in formats such as SARIF, HTML, and badges. Developers use it for code-quality checks, continuous integration, pre-commit hooks, and agent-assisted reviews across many programming-language formats. Its catalogue skills help coding agents run or interpret duplication checks.
Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add kucherenko/jscpd --skill codebase-refactoringgit clone --depth 1 https://github.com/kucherenko/jscpdWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/kucherenko/jscpd/codebase-refactoring)<a href="https://agentmods.dev/skills/kucherenko/jscpd/codebase-refactoring"><img src="https://agentmods.dev/badge/skills/kucherenko/jscpd/codebase-refactoring/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/kucherenko/jscpd/codebase-refactoring"><img src="https://agentmods.dev/badge/skills/kucherenko/jscpd/codebase-refactoring.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- Socket pass
- Snyk pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00063 | $0.02506 |
| Opus 5.5 | $0.00025 | $0.01002 |
| Sonnet 5.5 | $0.00013 | $0.00501 |
| Haiku 4.5 | $0.00006 | $0.00251 |
Grade A, and why
codebase-refactoring scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 27d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 201 lines — stays where its author put it; the contents beside it link to each section on GitHub.
codebase-refactoring
A guided pass over a codebase's three biggest maintenance costs — duplicated code, dead code, and complexity — using jscpd to find each and a strategy to fix it. Use this skill when asked to "clean up", "improve", "refactor" or "pay down tech debt in" a codebase, rather than to fix one specific bug.
Start here: measure, then prioritize
npx jscpd --health --reporters ai <path>
health 74 B (duplication 75, dead-code 72, complexity 76; 93 code lines)
The health score is a weighted mix of three sub-scores, each a share of the
code lines — high is good, 100 is clean. The lowest of the three names where
the codebase actually hurts most; if it isn't the order below, do that
dimension first instead. n/a on a dimension (e.g. dead code n/a) means
jscpd could not measure it — dead-code detection needs JavaScript,
TypeScript or Python to be a real share of the code — skip that step rather
than treating it as clean.
For the full picture behind that score — largest duplicated formats, most
complex files, largest dead-code findings, all in one screen — run npx jscpd --dashboard instead. Its console output (the default) is the only
reporter with that per-file detail; --reporters ai on --dashboard prints
the same one-line summary shown above, not the breakdown, so don't reach for
it expecting more than the score. Use --reporters json on --dashboard if
you need the detail in a parseable form.
The three passes below are otherwise independent and safe to run in any order; duplication → dead code → complexity is the default because fixing duplication first means step 2 isn't wasting effort tracing call sites that a later extract-function pass will move anyway, and clearing dead code before step 3 means the files ranked for simplification are ones actually worth simplifying, not ones about to be deleted.
Step 1 — Duplicated code
npx jscpd --reporters ai --summary <path>
Find and read each clone, decide whether it is a real copy worth merging, and apply the matching refactoring strategy (extract function, parameterize, extract a shared module or constant, or a base class/template for structural duplication). Full guided workflow, triage rules for renamed/near-miss clones, and worked examples per clone kind:
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 27d ago First seen · 201 lines · 63 tokens per session scan A 5eab466b683f
codebase-refactoring is a skill published in the GitHub repository kucherenko/jscpd (6,399 stars, last pushed yesterday), licensed MIT. It adds 63 tokens to every session and 2,506 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-19.
Other skills, from other repositories
recipe-diagnose
Investigate problem, verify findings, and derive solutions.
roam
Codebase comprehension via roam-code CLI. Use when exploring codebases, planning modifications, debugging failures, assessing PR risk, or checking architecture health. Triggers on: understanding project structure, pre-change safety checks, finding symbols/files, blast radius analysis, affected tests, health scoring…
dorodango
Polishes working code through successive quality passes in fresh subagents. Use after tests pass when code needs multi-dimension refinement before release.
ring:searching-code
Forensic code search and analysis with optional Chain of Draft (CoD) ultra-concise mode. Five-phase methodology (clarification, planning, execution, analysis, synthesis) with severity assessment. Use for targeted investigation of specific patterns, bugs, or vulnerabilities. Skip for broad architecture mapping (use…
ring:using-assert
Using lib-observability/assert, Lerian's runtime assertion package, in two modes. Sweep Mode detects panic()/log.Fatal zero-panic violations, DIY invariant checks, hand-rolled domain predicates, and missing InitAssertionMetrics. Reference Mode catalogs the asserter lifecycle, domain predicates, observability trident…
ring:fixing-lint
Fixing lint to a clean state: runs the linter, groups reported issues into independent streams, and dispatches one parallel fixer agent per stream (ring:backend-go for Go, ring:general-purpose otherwise), iterating until clean. Use when a codebase has lint errors across multiple files. Skip for a single error (fix…