Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add linkpranay-ai/context-engineering-protocol --skill ult-codegraphgit clone --depth 1 https://github.com/linkpranay-ai/context-engineering-protocolWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/linkpranay-ai/context-engineering-protocol/ult-codegraph)<a href="https://agentmods.dev/skills/linkpranay-ai/context-engineering-protocol/ult-codegraph"><img src="https://agentmods.dev/badge/skills/linkpranay-ai/context-engineering-protocol/ult-codegraph/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/linkpranay-ai/context-engineering-protocol/ult-codegraph"><img src="https://agentmods.dev/badge/skills/linkpranay-ai/context-engineering-protocol/ult-codegraph.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00040 | $0.04514 |
| Opus 5.5 | $0.00016 | $0.01806 |
| Sonnet 5.5 | $0.00008 | $0.00903 |
| Haiku 4.5 | $0.00004 | $0.00451 |
Grade A, and why
codegraph scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 345 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Codebase Graph (graphify wrapper)
Wraps the external graphify CLI (https://github.com/safishamsi/graphify, MIT
license, distributed as the PyPI package graphifyy) to build a knowledge
graph of a codebase — files, functions, classes, and their
calls/imports/uses/inherits relationships — at graphify's own fixed
output location, graphify-out/, where other skills query it directly.
Status: piloting. Validated on a real ~40 KSLOC FastAPI codebase (a structural lead —
webhook_dispatcher.py → RetryPolicy, the bridge between two otherwise-separate subsystems — that a textualgrepcould not find, since the bridging file never mentions the target term) before this migration. Now rolling out to a small set of engineering volunteers piloting it on substantially larger codebases (500 KSLOC+), wheregraph.jsonitself can run to tens of MB and the scoped-query pattern below stops being optional and starts being the only thing that scales. Report findings (works well / doesn't / surprises) as an issue in this repo so this can graduate out of pilot status or be reworked.
How to generate / refresh the graph
Step 0 — scope the index (first run only)
Before running graphify update on the whole repo, take a quick look at
what's actually there:
# Top-level dirs by file count — surfaces generated/vendored/other-language subtrees
for d in */; do n=$(find "$d" -type f | wc -l); echo "$n $d"; done | sort -rn | head -10
Then ask: is there one directory that holds essentially all the source you care about, separate from generated code, vendored third-party libraries, or bindings for other languages?
- Yes — point
graphify updateat that directory instead of.(e.g.graphify update src/ --no-cluster). Smaller, cleaner graph; less cross-language noise inaffected/explainresults. - No (everything's genuinely mixed) — run
graphify update . --no-clusteron the repo root. Validated on a real ~300 KSLOC, 8-language, 2425-file monorepo (google/protobuf): completed in 5m28s, 73K nodes / 254K edges, withaffected/explainqueries returning in ~3s — an unscoped run on a messy repo is workable, just expect occasional cross-language results. - No, but multiple genuinely independent roots (e.g. sibling repos or workspace directories with no shared parent worth scoping to) — index each root separately, then combine:
What ships with it
3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago Changed · +30 lines 35ec649d5332
- 1mo ago First seen · 315 lines · 40 tokens per session scan A b7534f2bb814
codegraph is a skill published in the GitHub repository linkpranay-ai/context-engineering-protocol (9 stars, last pushed 16d ago), licensed Apache-2.0. It adds 40 tokens to every session and 4,514 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
recovery
Handle blocked verification outcomes.
ambiguity-detector
Takes surface scan results, optional LLM synthesis open-question entries, and optional tree-sitter AST signals to score project ambiguities (1-10). Outputs structured ambiguityfeed for smart-question-generator. Pure heuristic — no LLM calls. Designed for Stage 3.5 of the /gaai:bootstrap pipeline (between LLM synthesis…
memory-index-lint
Validate discoverability invariants of memory index.md and archive/superseded-decisions.archive.md. Tool-agnostic L3 prompt + capability-dependent L4 script. Detects table corruption, dangling/orphan supersession pointers, frontmatter inconsistencies, missing affordance signals.
remediate-failures
Correct failures, rule violations, and acceptance criteria gaps detected during QA review. Activate when qa-review returns FAIL. Fixes without redefining scope — loops until all quality gates pass.
post-mortem-learning
Analyze failures and suboptimal deliveries to identify root causes, contributing factors, and raw lessons. Activate after significant delivery failures, repeated QA failures, or when patterns of issues need to be understood.
aicrew-fix
Run the aicrew /fix fast bug fix flow in Codex (triage -> root cause -> TDD -> verify).