Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add OneWave-AI/claude-skills --skill static-analysis-sweepgit clone --depth 1 https://github.com/OneWave-AI/claude-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/onewave-ai/claude-skills/static-analysis-sweep)<a href="https://agentmods.dev/skills/onewave-ai/claude-skills/static-analysis-sweep"><img src="https://agentmods.dev/badge/skills/onewave-ai/claude-skills/static-analysis-sweep/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/onewave-ai/claude-skills/static-analysis-sweep"><img src="https://agentmods.dev/badge/skills/onewave-ai/claude-skills/static-analysis-sweep.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00071 | $0.00806 |
| Opus 5.5 | $0.00028 | $0.00322 |
| Sonnet 5.5 | $0.00014 | $0.00161 |
| Haiku 4.5 | $0.00007 | $0.00081 |
Grade A, and why
static-analysis-sweep scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 27d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 84 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Static Analysis Sweep
Reading code for bugs finds what you thought to look for. A scanner finds the rest. This skill runs the tools, then does the part the tools cannot: deciding which findings are real.
Core Behavior
Scan the diff first, the repo second. Triage every finding. Never hand over a raw scanner dump — an unfiltered report is how real findings get ignored.
The Tools
Semgrep — fast, pattern-based, good defaults, no build required.
semgrep --config=auto --error --quiet . # whole repo
semgrep --config=auto --quiet --baseline-commit=origin/main # diff only
Secret scanning — the highest-value scan per second spent.
gitleaks detect --no-banner --redact
git log -p -S'BEGIN PRIVATE KEY' --oneline | head
Dependency CVEs
npm audit --audit-level=high 2>&1 | tail -40
pip-audit 2>&1 | tail -40
CodeQL — deeper, needs a build, worth it on a release branch rather than every PR.
codeql database create db --language=javascript --overwrite
codeql database analyze db --format=sarif-latest --output=results.sarif
If a tool is not installed, say so and run what is available rather than silently skipping the whole sweep.
Triage
Every finding lands in one of four buckets:
Fix now — reachable from untrusted input and causes real damage: injection into a query or shell, authentication or authorization bypass, secrets in the repo, deserialization of user data, path traversal, SSRF against internal hosts.
Fix soon — real weakness, limited blast radius: missing rate limit, weak crypto choice, permissive CORS on a non-sensitive route, a dependency CVE with no exploit path.
Won't fix, explained — the pattern matched, the exploit does not exist here. Write the one-line reason. This is the bucket that earns trust in the report.
Noise — test fixtures, generated files, vendored code. Suppress with a targeted ignore, never by turning the rule off globally.
For each Fix-now item, prove reachability before claiming it: name the entry point, the path the data takes, and the sink. A finding you cannot trace is Fix-soon at best.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 27d ago First seen · 84 lines · 71 tokens per session scan A 46bf4a3b4c1b
static-analysis-sweep is a skill published in the GitHub repository OneWave-AI/claude-skills (349 stars, last pushed 15d ago), licensed MIT. It adds 71 tokens to every session and 806 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-20.
Other skills, from other repositories
ast-grep
Searches and rewrites code by AST shape across 25 languages. Use when the target is a syntax pattern (every call/class/import shaped like X, a codemod, a YAML rule) rather than literal text; for plain strings, comments, or filenames, use rg.
debugging
Runs a hypothesis-driven debugging loop across any language or binary, escalating to orthogonal oracle angles and locking the fix with a failing test. Use for crashes, silent failures, hangs, wrong responses, memory leaks, async misbehavior, or reverse engineering.
lcx-doctor
Diagnose LazyCodex and Codex CLI installation health against the latest sources. Use whenever the user asks for a doctor or health check, says LazyCodex, lazycodex-ai, omo-codex, or Codex behaves oddly after an install, update, or config change, suspects a stale, drifted, or broken setup, or wants the local install…
lcx-report-bug
Create a high-signal bug issue or PR in the repo that owns the defect. Use this whenever the user asks to report, file, open, or triage a LazyCodex, lazycodex-ai, omo-codex, Codex plugin, or upstream Codex CLI bug, especially when they need source-backed root cause, reproduction steps, fix guidance, and GitHub routing.
remove-deadcode
Remove unused code from this project with ultrawork mode, LSP-verified safety, atomic commits. Triggers: remove dead code, dead code, cleanup, remove unused.
lsp
Use when Codex needs language-server diagnostics, definitions, references, symbols, or rename safety checks in the current workspace.