code-locate

code-locate is a skill for Claude Code from Mozurok/fhorja.dev. It costs 93 tokens per session (4,231 once invoked), scanned A, original, MIT.

A skill that locates likely code paths for a described behavior in the current codebase and reports candidate files, line ranges, confidence, and search evidence.

In plain words
What is it for?
Use it to trace where a behavior is implemented and prepare a source-of-truth update for the next investigation step.
Why use it?
It narrows a broad engineering question into concrete places to inspect before changing code.

Skill for Claude Code

Written for Claude Code: installed under .claude/. Also seen: reads .claude/ paths; mentions subagents; reads ~/.codex paths.

Good fit Use it to trace where a behavior is implemented and prepare a source-of-truth update for the next investigation step.

Compare 6 skills from other repositories ↓
Install with agentmods
npx agentmods add skills/mozurok/fhorja.dev/code-locate
Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent
npx skills add Mozurok/fhorja.dev --skill code-locate
Clone the repo
git clone --depth 1 https://github.com/Mozurok/fhorja.dev

Made for: Claude Code.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for code-locate

README.md
[![agentmods](https://agentmods.dev/badge/skills/mozurok/fhorja.dev/code-locate/github.svg)](https://agentmods.dev/skills/mozurok/fhorja.dev/code-locate)
Your own site
<a href="https://agentmods.dev/skills/mozurok/fhorja.dev/code-locate"><img src="https://agentmods.dev/badge/skills/mozurok/fhorja.dev/code-locate/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for code-locate

Your own site · 80×15
<a href="https://agentmods.dev/skills/mozurok/fhorja.dev/code-locate"><img src="https://agentmods.dev/badge/skills/mozurok/fhorja.dev/code-locate.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 93 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 4,231 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00093 $0.04231
Opus 5.5 $0.00037 $0.01692
Sonnet 5.5 $0.00019 $0.00846
Haiku 4.5 $0.00009 $0.00423

Measured 12d ago against content hash 96981fc8cf7e, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

code-locate scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.claude/skills/code-locate/SKILL.md · 128 lines

How it starts

The opening of the file, as written. The whole thing — 128 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Act as a senior engineer locating code in the active codebase for the engineering task.

Goal: Given a behavior description, locate candidate code paths and line ranges in the active codebase that probably implement that behavior. Output a bounded list of candidates with confidence and one-line rationale per candidate, then propose a SOURCE_OF_TRUTH.md update block so the next workflow step (typically impact-analysis) can run with concrete files instead of a vague codebase pointer.

Mandatory context bootstrap (before any output):

  • Read these sections in WORKFLOW_OPERATING_SYSTEM.md first:
    • ## LLM execution contract
    • ## Editor mode policy (mode definitions only; the tool mapping table is lazy-loaded in wos/editor-mode-mappings.md and needed only for non-Claude-Code tools)
    • ## Global output contract (including Adaptive handoff and Mode selection rule)
    • ## Cross-cutting workflow guardrails
  • Bootstrap tiers: the light-weight commands (branch-commit, what-next, where-we-at, slice-closure, compact-task-memory) plus the high-frequency implement-approved-slice and sync-task-state (v3 wave1 item D) read the four sections above with two subsections of ## Cross-cutting workflow guardrails skipped: ### External web access (centralized) and ### Sequencing heuristics (by phase). Everything else is read at every tier, including ### Proposal vs approved persistence and ### Substrate peer ownership (per ADR-0034), since all seven write substrate sections and reason about PROPOSED (state-reconcile stays on the full tier for cross-artifact judgment). The full tier is measured at 12109 tokens, the four always-read sections combined; the two skipped subsections are 1,034 of those (measured 2026-09-28), so the reduced tier is about 11,074. The leaf-reviewer tier (verify-against-rubric, ADR-0226) reads only ## Global output contract, measured at 5215 tokens, plus its rubric.
  • Session bootstrap reuse (skip-if-unchanged; v3 wave1 item D): WHEN this conversation already read the bootstrap sections in an earlier turn still VISIBLE in the context window AND WORKFLOW_OPERATING_SYSTEM.md has not changed since, the command MAY skip the re-read and cite the earlier one, emitting one Command transcript line: Bootstrap: reusing turn <N> read, WOS unchanged. Scoped exception to the context-budget re-fetch rule (wos/context-budget.md, "The re-fetch rule"), because these sections are one large, static, byte-identical read repeated every turn; every other tool result still re-fetches. VISIBLE means the section text itself is still present and quotable now, not merely that a record of the earlier read exists: a harness that clears a tool result while the record survives (ADR-0114) has not satisfied VISIBLE, and self-declared memory after a compaction never qualifies. A stateless-per-turn harness is excluded. The transcript line is mandatory; a silent skip is invalid output.
  • Resolving the spec and wos/<topic>.md: canonical repository FIRST. Otherwise use active-adapter docs: ~/.claude/workflow-docs (CLAUDE_WORKFLOW_DOCS_DIR), ~/.cursor/workflow-docs (WORKFLOW_DOCS_DIR; project .cursor/workflow-docs on project installs), ~/.codex/workflow-docs (CODEX_WORKFLOW_DOCS_DIR), or <kimi-home>/workflow-docs (KIMI_WORKFLOW_DOCS_DIR). Nonempty overrides win. Kimi home: KIMI_CODE_HOME, else existing ~/.kimi-code, else existing ~/.kimi, default ~/.kimi-code. Use one root for both paths; try other adapters if absent or unknown. Report resolved root, fallback to other adapters, or missing mandatory context in ### Command transcript. Installed snapshots refresh and prune retired topics only on sync.
  • Read additional sections only when relevant to this command's role.
  • Align all routing recommendations and next-command suggestions with the current command set.
  • Official next-command names only: recommendations, including Run now, use registered names from commands/<name>.md or commands/<name>/SKILL.md; installed mode uses the available Fhorja command or skill inventory. No invented aliases. Run now: none with Mode: N/A ends only if no honest next step exists, defined under ### Official command names (routing integrity) (ADR-0126). Required inputs:
  • active task folder path
  • TASK_STATE.md (current phase)
  • SOURCE_OF_TRUTH.md (current state, even if vague, so the patch is correctly scoped)
  • behavior description in 1 to 3 lines (what the code in question does or should do)
  • search type, exactly one of: implementation (production code), tests (test files), config (configuration files), any (no restriction)
  • product workspace path (where the actual code lives, for example ~/code/acme-platform). For single-repo tasks, this is the only repo. For multi-repo tasks, this is the workspace path matching target repo (see below).
  • target repo (only for multi-repo tasks where SOURCE_OF_TRUTH.md has a ## Repositories section): the repo identifier to search. Must match one entry in the ## Repositories section. See the spec ## Multi-repo support (v1) for the schema.
  • search scope hint if known (path prefix, language, glob, etc.), to narrow the search
  • failing test name and assertion message, if the locate is triggered by a failing test
  • last completed step from TASK_STATE.md (command and summary)

Read the full file on GitHub · 128 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 12d ago Changed · -37 tokens per session 96981fc8cf7e
  2. 15d ago Changed · -1 lines e384050e450c
  3. 22d ago Changed · -1 lines 0a55ebbe010f
  4. 23d ago Changed · -15 lines · -79 tokens per session 580b68fdaf93
  5. 1mo ago First seen · 145 lines · 209 tokens per session scan A 5bdcde5d6792

Subscribe to this mod's changes

code-locate is a skill published in the GitHub repository Mozurok/fhorja.dev (10 stars, last pushed 13d ago), licensed MIT. It adds 93 tokens to every session and 4,231 once invoked, about $0.0004 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Related

Other skills, from other repositories

systematic-debugging

A step-by-step method for finding the underlying cause of technical problems before changing code. It covers reading errors, reproducing failures, checking recent changes, and tracing data across system components.

jnMetaCode/superpowers-zh · 24 tokens

systemic-issue-triage

Trigger: new issue, bug report, triage, backlog, issue flood, community report, root cause, dead-end, blocked user. Attack issues by root class, never one-by-one; fixes must shrink the system, not grow it.

Gentleman-Programming/gentle-ai · 57 tokens

diagnosing-superpowers

A diagnostic workflow for investigating problems in Superpowers agent sessions using saved conversation records. It requires evidence linked to exact file paths and line numbers, then organizes findings into a report.

jnMetaCode/superpowers-zh · 111 tokens

issue-root-resolution

Trigger: root audit, atacar la raíz, issue roots, backlog roots, mechanism map, deletion-driven fix, resolver issues de raíz, close outdated issues. Audit and resolve issue clusters by verified root cause.

Gentleman-Programming/gentle-ai · 45 tokens

rdd-defect-workflow

Trigger: RDD, receipt-driven development, review authority, receipt/lineage, correction/recovery, delivery gate/kill switch, bounded review defects. Guide work.

Gentleman-Programming/gentle-ai · 41 tokens

kiro-debug

Investigate implementation failures using root-cause-first debugging. Use when an implementer is blocked, verification fails, or repeated remediation does not converge.

gotalab/cc-sdd · 33 tokens