Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/macintog/codex-spine/change-impactnpx skills add macintog/codex-spine --skill change-impactgit clone --depth 1 https://github.com/macintog/codex-spineWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/macintog/codex-spine/change-impact)<a href="https://agentmods.dev/skills/macintog/codex-spine/change-impact"><img src="https://agentmods.dev/badge/skills/macintog/codex-spine/change-impact.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00074 | $0.00887 |
| Opus 5 | $0.00037 | $0.00443 |
| Sonnet 5 | $0.00015 | $0.00177 |
| Haiku 4.5 | $0.00007 | $0.00089 |
Grade A, and why
change-impact scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 87 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Change Impact
Produce an evidence-backed map of what the selected change can affect, the one or two assumptions carrying most of its safety, and a finite verification list. Do not broaden the current task, mutate during a read-only review, or turn a residual finding into successor work.
Confirm The Gate
Use this skill when the proposed or reviewed change crosses at least one material boundary:
- a public interface, wire format, shared contract, or independently deployed consumer;
- persisted state, a schema, migration, cache, or compatibility contract;
- authorization, permissions, entitlements, secrets, or another trust boundary;
- build, packaging, deployment, rollout, rollback, or release behavior; or
- three or more downstream branches whose failure modes need separate proof.
Skip it when the change is local behind an unchanged interface and focused tests cover the behavior. Do not activate it merely because a diff is large, the user requested an ordinary review, or a polished risk section would make a completed decision look safer.
Map The Reach
- Bind the exact change and current evidence: repository, ref or worktree, relevant diff, intended behavior, and the authority granted by the user.
- Start with the repo-declared retrieval lane that matches the evidence: use
jcodefor definitions, call sites, callers, and adjacent code;jdocsfor authored contracts, runbooks, and reference trees; andjdatafor tabular or dataset-backed impact. Use only lanes relevant to the crossed boundary. A miss clears only the named query and scope; do not sweep all lanes or connectors. - Trace each crossed boundary to concrete consumers. Go beyond symbol callers when behavior also travels through serialized data, configuration, generated code, lifecycle ordering, pinned dependencies, operational automation, or a different runtime or language.
- For every plausible consumer, record the interface crossed, reachability,
failure mode, supporting location or runtime evidence, and status:
confirmed risk,cleared, orunproven. A search with no matches is useful cleared evidence when its scope is named. - Keep cleared checks visible. Do not report only alarming possibilities, and do not promote a hypothetical failure without a reachable path.
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 87 lines · 74 tokens per session scan A 8b9c80e99d8b
change-impact is a skill published in the GitHub repository macintog/codex-spine (9 stars, last pushed 5d ago), licensed MIT. It adds 74 tokens to every session and 887 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
bensz-rmd-rules
规范 AI 开发 R Markdown 分析脚本的行为准则。当用户要求"写 Rmd 分析"、"开发 R 脚本"、"做数据分析"时触发。核心原则:遵循主业与副业分离架构(.R 保留完整数据,.Rmd 应用业务阈值),优先使用用户已有 R 包资源;图表默认按 Nature 级别可读性与出版质量生成;专家级解读兼顾弱背景读者,提供四层框架、指标导读与不常用指标首次解释协议;路径验证确保跨平台兼容性。前提:luckyBase 为硬依赖。.
auto-test-project
当用户明确要求"测试项目"、"运行 auto-test-project"或"进行项目级测试"时使用。对完整项目进行多轮 A 轮批判性测试 + B 轮质量检查,系统化发现、记录、修复问题。⚠️ 不适用:用户只是想优化功能(应直接修改)、只是询问项目问题(应直接回答)、没有明确"测试"意图。.
auto-test-skill
当用户明确要求"测试技能"、"运行 auto-test"或"进行批判性测试"时使用。通过多轮 A 轮批判性测试 + B 轮质量原则检查,系统化发现、记录、修复问题,并沉淀可追溯的 .bensz-api/task-{yyyymmdd-hhmm}-{简短描述}/auto-test-skill/output/plans/ 与 .bensz-api/task-{yyyymmdd-hhmm}-{简短描述}/auto-test-skill/output/tests/ 文档。⚠️ 不适用:用户只是想优化功能(应直接修改)、只是询问技能问题(应直接回答)、没有明确"测试"意图。.
context-optimizer
上下文优化专家。专注于长对话中的上下文管理、token 效率和性能优化。解决 lost-in-middle、context poisoning 等问题,提升 AI 代理在复杂任务中的表现。.
git-commit
当用户明确要求"提交 Git 改动"、"生成 commit 信息"或"创建 git commit"时使用。仅用 Git 分析改动并自动生成 conventional commit 信息(可选 emoji);必要时建议拆分提交,默认运行本地 Git 钩子(可 --no-verify 跳过),提交后默认自动 push(可 --no-push 跳过)。.
git-pr-review
当用户明确要求“review 某个 GitHub PR”“评估某个 pull request 是否值得 merge”“帮我判断这个 PR 怎么处理”时使用。基于用户提供的 GitHub 仓库地址、PR 编号/链接和补充说明,进行只读、证据驱动的 PR 审查:理解 PR 解决的问题、评估方案优劣与局限、默认优先使用内置“好 PR”标准并在必要时联网补充、识别恶意或高风险改动,并输出是否建议 merge 的 Markdown 决策报告。⚠️ 不适用:用户要你直接修改 PR 代码、直接 merge PR、或在本地执行 PR 分支中的不可信代码。.