Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/nearform/lastlight/dependency-impactnpx skills add nearform/lastlight --skill dependency-impactgit clone --depth 1 https://github.com/nearform/lastlightWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/nearform/lastlight/dependency-impact)<a href="https://agentmods.dev/skills/nearform/lastlight/dependency-impact"><img src="https://agentmods.dev/badge/skills/nearform/lastlight/dependency-impact.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00074 | $0.01205 |
| Opus 5 | $0.00037 | $0.00602 |
| Sonnet 5 | $0.00015 | $0.00241 |
| Haiku 4.5 | $0.00007 | $0.00120 |
Grade A, and why
dependency-impact scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 84 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Dependency impact
A major version bump is not one thing. @types/node 20→21 and a runtime
framework rewrite are both "major", and semver magnitude alone cannot tell them
apart. So judge the blast radius, not the version number: what could this
change actually break in this repository?
No checkout. The merge workflow has no working tree by design — it is the
cheap path, and keeping it cheap is what lets it run on every green dependency
PR. Every tool below is a github_* read tool already available to you. Never
clone, and never pull a lockfile diff: judge from the PR title, the file list
and the manifest change first, and reach for more evidence only when the tier is
still in doubt.
The evidence
Gather in this order and stop as soon as the tier is decided — each row costs more than the one above it.
| # | Evidence | How |
|---|---|---|
| 1 | Dev vs runtime dependency | The manifest change: dependencies vs devDependencies. @types/*, linters, formatters and test runners are dev-only; so is a GitHub Actions tag/SHA bump |
| 2 | Release notes / changelog / breaking-change headings | github_get_pull_request → the body. Dependabot embeds Release notes, Changelog and Commits sections, plus a compatibility-score badge. The body comes back capped at 4000 chars; if it was cut and you still can't see whether the release documents a breaking change, re-call with full_body: true — a buried breaking-changes heading is precisely what this row is for. Don't reach for it when the head of the notes already decided the tier |
| 3 | Blast radius | github_search_code for from "<pkg>" / require("<pkg>") — count the direct import sites. The result's total_count is that count, so read it rather than tallying items, and don't fan out a query per import spelling when one is enough to size the blast radius |
| 4 | Security sensitivity | Does the package sit in auth, crypto, serialization, network, file I/O, or database-driver territory? |
| 5 | Behavioural evidence | The settled check state supplied in your prompt — deterministic, computed in code, not inferred from mergeable_state |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 6d ago First seen · 84 lines · 74 tokens per session scan A 881c24bafc41
dependency-impact is a skill published in the GitHub repository nearform/lastlight (22 stars, last pushed yesterday), licensed MIT. It adds 74 tokens to every session and 1,205 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
example-skill
Counts lines, words, and bytes in a text file using the bundled count.sh script. Use when asked to count/measure a file's size in these terms.
design-taste-frontend
Anti-slop frontend skill for landing pages, portfolios, and redesigns. The agent reads the brief, infers the right design direction, and ships interfaces that do not look templated. Real design systems when applicable, audit-first on redesigns, strict pre-flight check.
open-code-review
Performs AI-powered code review on Git changes using the ocr CLI from alibaba/open-code-review. Use when the user asks to review code, review a pull request, review staged/unstaged changes, review a commit, or compare branches for code quality issues. Produces line-level review comments and can automatically apply…
image-to-code
Elite website image-to-code skill for Codex. For visually important web tasks, it must first generate the design image(s) itself, deeply analyze them, then implement the website to match them as closely as possible. In Codex, it must prefer large, readable, section-specific images instead of tiny compressed boards…
brandkit
Premium brand-kit image generation skill for creating high-end brand-guidelines boards, logo systems, identity decks, and visual-world presentations. Trained for minimalist, cinematic, editorial, dark-tech, luxury, cultural, security, gaming, developer-tool, and consumer-app brand systems. Optimized for intentional…
minimalist-ui
Clean editorial-style interfaces. Warm monochrome palette, typographic contrast, flat bento grids, muted pastels. No gradients, no heavy shadows.