Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add mohitmishra786/low-level-dev-skills --skill static-analysisgit clone --depth 1 https://github.com/mohitmishra786/low-level-dev-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/mohitmishra786/low-level-dev-skills/static-analysis)<a href="https://agentmods.dev/skills/mohitmishra786/low-level-dev-skills/static-analysis"><img src="https://agentmods.dev/badge/skills/mohitmishra786/low-level-dev-skills/static-analysis/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/mohitmishra786/low-level-dev-skills/static-analysis"><img src="https://agentmods.dev/badge/skills/mohitmishra786/low-level-dev-skills/static-analysis.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- Socket pass
- Snyk pass
- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00082 | $0.01503 |
| Opus 5 | $0.00041 | $0.00751 |
| Sonnet 5 | $0.00016 | $0.00301 |
| Haiku 4.5 | $0.00008 | $0.00150 |
Grade A, and why
static-analysis scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 193 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Static Analysis
Purpose
Guide agents through selecting, running, and triaging static analysis tools for C/C++ — clang-tidy, cppcheck, and scan-build — including suppression strategies and CI integration.
Triggers
- "How do I run clang-tidy on my project?"
- "What clang-tidy checks should I enable?"
- "cppcheck is reporting false positives — how do I suppress them?"
- "How do I set up scan-build for deeper analysis?"
- "My build is noisy with static analysis warnings"
- "How do I generate compile_commands.json for clang-tidy?"
Workflow
1. Generate compile_commands.json
clang-tidy requires a compilation database:
# CMake (preferred)
cmake -S . -B build -DCMAKE_EXPORT_COMPILE_COMMANDS=ON
ln -s build/compile_commands.json .
# Bear (for Make-based projects)
bear -- make
# compiledb (alternative for Make)
pip install compiledb
compiledb make
2. Run clang-tidy
# Single file
clang-tidy src/foo.c -- -std=c11 -I include/
# Whole project via compile_commands.json
run-clang-tidy -p build/ -j$(nproc)
# With specific checks enabled
clang-tidy -checks='bugprone-*,modernize-*,performance-*' src/foo.cpp
# Apply auto-fixes
clang-tidy -checks='modernize-use-nullptr' -fix src/foo.cpp
3. Check category decision tree
Goal?
├── Find real bugs → bugprone-*, clang-analyzer-*
├── Modernise C++ code → modernize-*
├── Follow core guidelines → cppcoreguidelines-*
├── Catch performance issues → performance-*
├── Security hardening → cert-*, hicpp-*
└── Readability / style → readability-*, llvm-*
| Category | Key checks | What it catches |
|---|---|---|
bugprone-* |
use-after-move, integer-division, suspicious-memset-usage |
Likely bugs |
modernize-* |
use-nullptr, use-override, use-auto |
C++11/14/17 idioms |
cppcoreguidelines-* |
avoid-goto, pro-bounds-*, no-malloc |
C++ Core Guidelines |
performance-* |
unnecessary-copy-initialization, avoid-endl |
Performance regressions |
clang-analyzer-* |
core.*, unix.*, security.* |
Path-sensitive bugs |
cert-* |
err34-c, str51-cpp |
CERT coding standard |
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 193 lines · 82 tokens per session scan A 6e3deab819f5
static-analysis is a skill published in the GitHub repository mohitmishra786/low-level-dev-skills (198 stars, last pushed 2mo ago), licensed MIT. It adds 82 tokens to every session and 1,503 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
log-analyzer
Parse agent log files to identify error patterns, rate limit hits, timeout clusters, tool failures, and component-level error counts. Produces a structured anomaly report. Cron-compatible — silent if no issues, alert digest if anomalies found. Also computes per-tool failure rates from a Hermes profile state.db…
debugging
Systematically diagnose and fix software bugs by analyzing error messages, stack traces, logs, and runtime behavior across multiple languages. Use when the user requests debugging or provides relevant inputs for this workflow.
error-handler
Design error handling, structured logging, and observability with OpenTelemetry (traces, metrics, logs), error classification, recovery patterns (retry with jitter, circuit breaker, bulkhead, timeout), error budgets/SLOs with burn rate alerts, and production incident triage. Use when user asks to implement error…
performance-profiler
Performance profiling and optimization for web apps — Core Web Vitals (LCP, INP, CLS), Lighthouse audits, bundle analysis, backend profiling (CPU, memory, DB queries), N+1 detection, caching strategies (Redis, CDN, HTTP), and performance budgets. Use when user asks to improve performance, run Lighthouse audit, profile…
scientific-debugging
A method for debugging software by observing the problem, forming possible explanations, running small experiments, and then fixing and checking the result.
diagnosing-ml-failures
Isolate the root cause of ML performance drops, inconsistent evaluations, prediction errors, and training-serving mismatches across data, labels, splits, pipelines, models, metrics, and runtime behavior. Use when investigating a reproducible failure or regression, not routine model selection or general performance…