Borrowing it
Nothing to install: this file belongs to mtarcure/claude-vibe-squad. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/mtarcure/claude-vibe-squad/main/.agents/skills/code-reachability-audit/SKILL.mdgit clone --depth 1 https://github.com/mtarcure/claude-vibe-squadWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/mtarcure/claude-vibe-squad/code-reachability-audit)<a href="https://agentmods.dev/skills/mtarcure/claude-vibe-squad/code-reachability-audit"><img src="https://agentmods.dev/badge/skills/mtarcure/claude-vibe-squad/code-reachability-audit.svg" alt="Measured on agentmods" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 3 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high YARA Match · line 25 YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).Fix: Remove the malware payload or compromised file entirely. Investigate how it entered the skill and audit all other artifacts for additional indicators of compromise.
- medium Rogue Agent · line 24 Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.Fix: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
- medium Rogue Agent · line 25 Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.Fix: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00066 | $0.01056 |
| Opus 5 | $0.00033 | $0.00528 |
| Sonnet 5 | $0.00013 | $0.00211 |
| Haiku 4.5 | $0.00007 | $0.00106 |
Grade A, and why
code-reachability-audit scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 89 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Code Reachability Audit
Deciding a file is dead is a deletion, and deletions are irreversible. The claim "nothing calls this" is an absence claim, so it needs an exhaustive search plus a control proving the search can detect presence. A grep miss is not proof.
The search set — every surface, not just the obvious ones
A repo-only git grep is not exhaustive. Check all of these:
| Surface | Why it hides callers |
|---|---|
| Shell | exec, source, bash "$VAR", paths built from $(dirname …) |
| Python | subprocess, Path(...), names assembled from parts |
.github/workflows/** |
CI is a caller with no in-repo reference to it |
Git hooks (.githooks/**) |
invoked by git, never by code |
| Plugin manifests, lane adapters | declarative wiring, not calls |
~/Library/LaunchAgents/*.plist |
outside the repo entirely |
crontab -l, systemd units |
same class as launchd on other platforms |
| Operator documentation | a script a human runs on purpose is live with zero programmatic callers |
The launchd surface is the one that bites. On 2026-08-06 an audit classified
bin/squad-monitor.sh as dead on correct in-repo evidence — its only references
were two tests. It runs every 120 seconds via com.chrono.squad-monitor,
registered in ~/Library/LaunchAgents/, where no git grep reaches. Six repo
scripts are bound that way. bin/doctor.sh now reports the mapping on every
health run; read it before calling anything dead.
Matching, without fooling yourself
Both failure directions are real and both happened in one session:
- Too loose. A bare basename search reported
capture.pyas having six callers. Every hit was insideautocapture.py. - Too strict. Anchoring with
[^A-Za-z0-9_/-]then excluded/, hiding path-qualified references, so a file with a live caller looked orphaned.
Use (^|[^A-Za-z0-9_-])<basename> — allow a path separator before the name,
forbid word characters.
Two controls, every time
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 89 lines · 66 tokens per session scan A bc0c33d8c89d
code-reachability-audit is a skill published in the GitHub repository mtarcure/claude-vibe-squad (109 stars, last pushed 2d ago), licensed MIT. It adds 66 tokens to every session and 1,056 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
rust-check
Run cargo check on the current Rust project to find compile errors.
debug
Reproduce, minimize, localize, identify root cause, and distinguish diagnosis from an authorized fix. Prefer root-cause over symptom patches.
openrig-skills
Use when you're operating OpenRig and need the right skill or context for fleet recovery, seat handover, new-seat orientation, a watchdog wake, cross-host reach to an agent on another machine, rig packaging, an OpenRig upgrade, systematic debugging, queue triage, or implementation planning; also use when you don't…
diagnose-skill-run
Diagnose a failed or suspicious Runx skill execution from receipts and harness evidence, then propose the smallest bounded improvement without replaying the failed operation.
postmortem-maker
Turn resolved-incident fragments into a traceable postmortem that separates fragment-cited facts from hypotheses, blocks publication while unknowns remain, and keeps the comms send behind a human gate.
oversight-team
Use when you are a seat on the oversight pod (a standing monitor-mode rig that keeps OTHER rigs healthy), configuring or running the drift detectors, or choosing whether to intervene vs escalate. Covers the pull-not-poll posture, the v0 detectors (premature-park, process-drift, off-task, token-burn), the intervention…