ops-codegraph-tool: Skill for Claude Code

.claude/skills/create-skill/SKILL.md

create-skill is a skill for Claude Code from optave/ops-codegraph-tool. It costs 28 tokens per session (6,863 once invoked), scanned C, original, Apache-2.0.

A guided process for creating a new Claude Code skill, which is a reusable set of instructions for an AI coding assistant. It checks the skill's name, structure, shell scripts, and quality requirements.

In plain words
What is it for?
Scaffolding a skill, writing its instructions, validating its files, and ensuring the project is ready for review.
Why use it?
It prevents common mistakes when writing or packaging a skill and adds checks before it is used.

Skill for Claude Code

Written for Claude Code: allowed-tools in frontmatter. Also seen: reads .claude/ paths; positional $N argument; mentions Claude Code.

This is optave/ops-codegraph-tool's own configuration. It tells Claude Code how to work on ops-codegraph-tool itself, so it is not a mod to install elsewhere. Copy it as a starting point and replace the rules that are about this project. Everything ops-codegraph-tool configures →

Reuse

Borrowing it

Nothing to install: this file belongs to optave/ops-codegraph-tool. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file
curl -O https://raw.githubusercontent.com/optave/ops-codegraph-tool/main/.claude/skills/create-skill/SKILL.md
Clone the repo
git clone --depth 1 https://github.com/optave/ops-codegraph-tool

Made for: Claude Code.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for create-skill

README.md
[![agentmods](https://agentmods.dev/badge/skills/optave/ops-codegraph-tool/create-skill/github.svg)](https://agentmods.dev/skills/optave/ops-codegraph-tool/create-skill)
Your own site
<a href="https://agentmods.dev/skills/optave/ops-codegraph-tool/create-skill"><img src="https://agentmods.dev/badge/skills/optave/ops-codegraph-tool/create-skill/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for create-skill

Your own site · 80×15
<a href="https://agentmods.dev/skills/optave/ops-codegraph-tool/create-skill"><img src="https://agentmods.dev/badge/skills/optave/ops-codegraph-tool/create-skill.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 28 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 6,863 The whole file, excluding the scripts and references it only reads on demand.
Security scan C 2 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00028 $0.06863
Opus 5.5 $0.00011 $0.02745
Sonnet 5.5 $0.00006 $0.01373
Haiku 4.5 $0.00003 $0.00686

Measured 2mo ago against content hash 216d1503a278, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade C, and why

create-skill scanned grade C with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2mo ago.

The scan reads SKILL.md. This mod also ships 2 executable files (scripts/lint-skill.sh, scripts/smoke-test-skill.sh), listed below but not scanned — reading those needs a real analyzer, not pattern matching.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Recursive force deletehighDestructive command

rm -rf with a variable or a broad path is one typo away from removing the wrong tree.

rm -rf $WORK_DIR # BUG: $WORK_DIR is empty here

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

for tool in git mktemp; do # replace with the actual shell commands your skill uses (e.g. jq, python, curl)
.claude/skills/create-skill/SKILL.md · 607 lines

How it starts

The opening of the file, as written. The whole thing — 607 lines — stays where its author put it; the contents beside it link to each section on GitHub.

/create-skill — Skill Factory

Create a new Claude Code skill with correct structure, robust bash, and built-in quality gates. This skill encodes lessons from 250+ Greptile review comments to prevent the most common skill authoring mistakes.

Arguments

  • $ARGUMENTS must contain the skill name in kebab-case (e.g. deploy-check)
  • If $ARGUMENTS is empty, ask the user for a skill name before proceeding

Set SKILL_NAME to the provided name. Validate it is kebab-case (^[a-z][a-z0-9]*(-[a-z0-9]+)*$). Reject otherwise.


Phase 0 — Discovery & Pre-flight

Pre-flight: Verify required tools and environment:

for tool in git mktemp; do
  # > /dev/null 2>&1: suppress command path on success and shell's "not found" on failure — the || clause provides the error message
  command -v "$tool" > /dev/null 2>&1 || { echo "ERROR: required tool '$tool' not found"; exit 1; }
done
# > /dev/null 2>&1: suppress git's own "fatal: not a git repository" — our || message is more actionable
git rev-parse --show-toplevel > /dev/null 2>&1 || { echo "ERROR: not in a git repository — run /create-skill from the repo root"; exit 1; }

Parse $ARGUMENTS per the Arguments section above. If validation fails, abort with a clear error.

Discovery: Before writing anything, gather requirements interactively. Ask the user these questions (all at once, not one-by-one):

  1. Purpose — What does this skill do? (one paragraph)
  2. Arguments — What CLI arguments should it accept? (e.g. --fix, --dry-run, <path>)
  3. Phases — What are the major steps? (bullet list of 3-8 phases)
  4. Tools needed — Which tools does it need? (Bash, Read, Write, Edit, Glob, Grep, Agent)
  5. Artifacts — Does it produce output files? If so, where and what format?
  6. Dangerous operations — Does it modify code, push to git, call external APIs, or delete files?
  7. Resume/skip support — Should it support --start-from or --skip-* flags for long-running pipelines?

Wait for the user's answers before proceeding. Do not guess or assume.

Read the full file on GitHub · 607 lines

Files

What ships with it

2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2mo ago First seen · 607 lines · 28 tokens per session scan C 216d1503a278

Subscribe to this mod's changes

create-skill is a skill published in the GitHub repository optave/ops-codegraph-tool (99 stars, last pushed 5d ago), licensed Apache-2.0. It adds 28 tokens to every session and 6,863 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it C with 2 findings (recursive force delete, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Related

Other skills, from other repositories

ix

Answer structural questions about a codebase — what a symbol is, what calls it, what a change breaks, where the hotspots are — from a persistent code graph via the ix CLI, instead of grepping.

ix-infrastructure/Ix · 44 tokens

roam

Codebase comprehension via roam-code CLI. Use when exploring codebases, planning modifications, debugging failures, assessing PR risk, or checking architecture health. Triggers on: understanding project structure, pre-change safety checks, finding symbols/files, blast radius analysis, affected tests, health scoring…

Cranot/roam-code · 86 tokens

cymbal

Tree-sitter indexed code navigator. Use the cymbal CLI — not Read, Grep, Glob, or Bash — for finding where symbols are defined, tracing callers and callees, locating interface implementations, understanding the impact of a change, and mapping imports across an existing codebase. Returns precise, token-efficient…

1broseidon/cymbal · 89 tokens

rust-doctor

Use when Rust code just changed and must not regress, when the user asks to scan, audit or health-check a Cargo workspace, says "rust-doctor", or wants one of its findings explained, tuned or switched off.

arthjean/rust-doctor · 49 tokens

codespaces

Build and query architecture-aware code search, dependency graphs, call flows, impact analysis, and belief maps for Python, TypeScript, TSX, Rust, C#, Java, Go, Ruby, and Ruby on Rails repositories. Use before non-trivial code changes to find module boundaries, blast radius, architecture violations, and the minimal…

diskd-ai/codespaces · 74 tokens

review

The definitive code review, for any codebase. Five-phase workflow: git context detection (worktree, branch, base, changed files), Pharaoh recon (architecture map, module context, blast radius in one call, with a fallback when the repo isn't mapped), parallel specialized agent dispatch (code quality, security against…

Pharaoh-so/pharaoh-mcp · 131 tokens