Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add melodic-software/claude-code-plugins --skill rename-referencesgit clone --depth 1 https://github.com/melodic-software/claude-code-pluginsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/melodic-software/claude-code-plugins/rename-references)<a href="https://agentmods.dev/skills/melodic-software/claude-code-plugins/rename-references"><img src="https://agentmods.dev/badge/skills/melodic-software/claude-code-plugins/rename-references/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/melodic-software/claude-code-plugins/rename-references"><img src="https://agentmods.dev/badge/skills/melodic-software/claude-code-plugins/rename-references.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Excessive Agency · line 170 Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.Fix: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00117 | $0.05099 |
| Opus 5.5 | $0.00047 | $0.02040 |
| Sonnet 5.5 | $0.00023 | $0.01020 |
| Haiku 4.5 | $0.00012 | $0.00510 |
Grade A, and why
rename-references scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 212 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Arguments. [audit|preview|blocklist] [<old> [to <new>]] [--container|--identifier|--include-historical…]. Full form: [audit [blast|half-rename|orphans]|preview|blocklist] [ [to ]] [--include-historical|--include-memory|--include-plan-docs|--include-bare-token|--container|--identifier] (e.g., /rename-references audit, /rename-references audit blast /verify to /verify-changes, /rename-references audit half-rename /a to /b, /rename-references audit orphans /a to /b, /rename-references blocklist)
Repository context. Gather first
Collect these with individual Bash calls, one command per call, never combined into a single invocation:
- Working tree status (empty = clean),
git status --porcelain | head -20 - Rename pairs (git), unstaged,
git diff --name-status -M HEAD | grep '^R' | head -15 - Rename pairs (git), staged,
git diff --cached --name-status -M | grep '^R' | head -15 - Current branch,
git branch --show-current
The pipe is the bound and belongs in the command. A read-time cap ("read only the first 20 entries") bounds nothing: the Bash tool returns the command's complete output into context before there is anything to decide about.
Treat a failure (not a repository, git unavailable) as an unknown value and carry on. Keep these as
separate body Bash calls rather than pre-compute lines: the harness runs a skill's whole pre-compute
block as one shell invocation, and a worktree-isolated session refuses a compound command that
contains git. The dated record for that composition claim is the source-control plugin's
worktree/reference/gather-block.md,
"The pre-compute block runs as one shell invocation".
Purpose
Renames are deceptively hard. After renaming a skill, file, or identifier, references survive in 7+ syntactic forms beyond the obvious token. Token-only grep (/old) catches the obvious ones; the rest hide in chain prose (→ old →), comma-lists (Test, Old, Retro), numbered table rows (| 7. Old |), frontmatter chain strings (description: "...→ old → retro process."), frontmatter globs ({a,b,old,c}), cross-skill mode references, and content-file paths (context/old.md style).
What ships with it
6 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 7d ago Changed · +12 lines 4aca278e1a72
- 16d ago Changed c813e4308e98
- 17d ago Changed b864127f57fa
- 18d ago Changed · +1 lines · +2 tokens per session b7bd38595db1
- 20d ago Changed · +2 lines acb4584e9ab3
- 21d ago Changed · -38 tokens per session efee8f7c342d
- 1mo ago Changed · +7 lines · +17 tokens per session b761469d0874
- 1mo ago Changed 650d986ff7b8
- 1mo ago Changed · +1 lines c5015a079154
- 1mo ago First seen · 189 lines · 136 tokens per session scan A 2c3b74832c57
rename-references is a skill published in the GitHub repository melodic-software/claude-code-plugins (26 stars, last pushed today), licensed MIT. It adds 117 tokens to every session and 5,099 once invoked, about $0.0005 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
parallel-orchestrator
Manage parallel Claude Code workstreams using git worktrees. Use when: splitting large tasks across multiple workers, coordinating parallel development, monitoring worker progress, integrating completed work, analyzing work item documents (code reviews, issue lists). Triggers: parallel, orchestrator, worktrees…
parallel-worker
Execute focused implementation tasks in a parallel workflow. Use when: working on assigned files in a worktree, making checkpoint commits, signaling dependencies or blockers, completing orchestrator-assigned tasks. Triggers: worker, checkpoint, worktree, assigned scope, commit prefix, parallel task.
changelog-summarizing
Use this skill when the user asks to summarize, recap, or post about repository changes in the Shopware AI Coding Tools marketplace since a given date — phrases like "write a changelog post for Discord", "recap this week's commits for Slack", "summarize what shipped since 2026-04-01", "draft a release announcement".…
pass-function-as-arg
For generic algorithms: strategy pattern, callbacks, configurable behavior. Pass functions as parameters to customize algorithm behavior.
find-shortest-path
For pathfinding and search: shortest path, maze solving, game AI, route planning, graph traversal, BFS/DFS, Dijkstra, A problems.
release
This skill should be used when the user wants to create a new release — bump version, tag, push, create GitHub release, and publish to npm through the release workflow. Use when user says "release", "bump version", "publish", "cut a release", or "release candidate".