Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add prime-radiant-inc/greenfield --skill git-archaeologygit clone --depth 1 https://github.com/prime-radiant-inc/greenfieldWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/prime-radiant-inc/greenfield/git-archaeology)<a href="https://agentmods.dev/skills/prime-radiant-inc/greenfield/git-archaeology"><img src="https://agentmods.dev/badge/skills/prime-radiant-inc/greenfield/git-archaeology/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/prime-radiant-inc/greenfield/git-archaeology"><img src="https://agentmods.dev/badge/skills/prime-radiant-inc/greenfield/git-archaeology.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Prompt Injection · line 127 Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.Fix: Audit all comments and invisible characters. Remove any instructions that direct the agent to perform unauthorized actions. Use plain, reviewable content.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00053 | $0.02978 |
| Opus 5 | $0.00026 | $0.01489 |
| Sonnet 5 | $0.00011 | $0.00596 |
| Haiku 4.5 | $0.00005 | $0.00298 |
Grade A, and why
git-archaeology scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 312 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Git Archaeology Methodology
Extract behavioral intelligence from version control history. Commit messages, PR descriptions, blame annotations, and issue references encode design decisions, behavioral changes, and maintenance patterns that no other source captures.
When to Use This Mode
Git archaeology activates when:
- The target is a git repository (or has a
.gitdirectory) - The discovery inventory identifies a git repository with meaningful commit history
- Other modes discover a git repository during analysis
This mode runs independently of all other intelligence sources. It requires only access to the git repository and optionally to a GitHub/GitLab remote. All output is RAW (commit messages and PR descriptions may reference proprietary internals).
Why Git History Matters
Source code tells you what the system does NOW. Git history tells you:
- What changed and why -- commit messages encode intent that is invisible in the current code
- What broke and how it was fixed -- fix commits reveal failure modes and edge cases
- What was deliberately removed -- reverted features and deleted code reveal abandoned behaviors
- Where maintenance concentrates -- frequently modified files signal complexity and instability
- What decisions were debated -- PR descriptions capture design trade-offs that never appear in documentation
Phase 1: Repository Overview
Goal: Establish the scope, age, and shape of the project.
# Commit count and date range
echo "Total commits: $(git rev-list --count HEAD)"
echo "First commit: $(git log --reverse --format='%ai' | head -1)"
echo "Latest commit: $(git log -1 --format='%ai')"
# Contributors
git shortlog -sn --no-merges | head -20
# Active branches
git branch -r --sort=-committerdate | head -20
# Tags (releases)
git tag --sort=-version:refname | head -20
# Commit frequency (commits per month, last 12 months)
for i in $(seq 0 11); do
month=$(date -d "$i months ago" +%Y-%m 2>/dev/null || date -v-${i}m +%Y-%m)
count=$(git rev-list --count --after="${month}-01" --before="${month}-31" HEAD 2>/dev/null || echo "0")
echo "$month: $count"
done
# Top-level directory structure at HEAD
git ls-tree --name-only HEAD
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 11d ago First seen · 312 lines · 53 tokens per session scan A 903280b93028
git-archaeology is a skill published in the GitHub repository prime-radiant-inc/greenfield (275 stars, last pushed 1mo ago), licensed Apache-2.0. It adds 53 tokens to every session and 2,978 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
commit
Git commit workflow with precommit hook handling, lint/type checking, README updates, and API reference updates. Use when the user wants to commit changes. Handles precommit hooks that modify files (formatting, linting) by re-staging and retrying. Runs ruff lint and pyright type checks on staged Python files, and…
update-pr
Update an existing pull request with new changes. Use when the user wants to update a PR, push follow-up changes to a PR, refresh a PR description, or sync a PR with latest commits. Triggers on: update pr, update-pr, update the pr, push to pr, refresh pr, sync pr, update pull request.
codex-setup
Initialize sd0x-dev-flow infrastructure for Codex CLI and other non-Claude agents. Generates AGENTS.md, installs the commit-msg hook, copies runner scripts. The pre-push gate is opt-in via --with-push-gate. Use when setting up a new project or after updating skills.
smart-rebase
Smart partial rebase for squash-merge repositories. Auto-detect which commits to keep/drop when base branch was squash-merged into target. Use when: user says 'rebase', 'partial rebase', 'base already merged', 'smart rebase', or /smart-rebase. Not for: simple git rebase (the developer runs it — Claude never executes…
merge-prep
Pre-merge analysis and preparation. Analyzes source branch vs target branch: commit stats, conflict detection, file impact. Analysis-only v1 — outputs report + suggested commands, does not auto-merge. Use when: user says 'merge prep', 'pre-merge', 'merge analysis', or /merge-prep.
next-step
Change-aware next step advisor. Use when: user asks what to do next, workflow progression is unclear, session just started with dirty worktree. Not for: executing the suggested command (user decides), auto-loop decisions (hooks handle that). Output: findings-based suggestions or session summary with commit seed.