Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add s977043/PlanGate --skill ref-integrity-scangit clone --depth 1 https://github.com/s977043/PlanGateWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/s977043/plangate/ref-integrity-scan)<a href="https://agentmods.dev/skills/s977043/plangate/ref-integrity-scan"><img src="https://agentmods.dev/badge/skills/s977043/plangate/ref-integrity-scan/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/s977043/plangate/ref-integrity-scan"><img src="https://agentmods.dev/badge/skills/s977043/plangate/ref-integrity-scan.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00160 | $0.02084 |
| Opus 5.5 | $0.00064 | $0.00834 |
| Sonnet 5.5 | $0.00032 | $0.00417 |
| Haiku 4.5 | $0.00016 | $0.00208 |
Grade A, and why
ref-integrity-scan scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 111 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Ref Integrity Scan
Provenance（出典・vendoring 規約）: growth-core
deletion-reference-scan（upstream: Growth-Teams-Agent@5219642 / 2026-07-03 時点）を PlanGate 向けに 汎用化して取り込み（#798）。上流への自動追従はしない — 上流更新の反映は 意図的に diff をレビューして行う（provenance 追跡 + 意図的更新の vendoring 標準）。
ファイル・ディレクトリを削除・移動・改名する前後に、リポジトリ全体を対象に被参照（そのパスを指している箇所）を洗い出し、ダングリング参照を防ぐための手順スキル。
#691（check-stale-skill-refs.py）との相補関係
| スキル/スクリプト | 走査方向 | 検出対象 |
|---|---|---|
scripts/check-stale-skill-refs.py（#691） |
outbound（発信） | スキル/コマンド/エージェントが参照している先が実在しない（stale） |
| 本スキル（ref-integrity-scan） | inbound（被参照） | 削除・移動・改名する対象への参照が他のどこかに残っている |
#691 は「自分が指している先が消えていないか」、本スキルは「自分を消したときに誰かが迷子にならないか」を確認する。両方向を揃えることで参照整合を守る。
実害事例（動機）
2026-07-10、self-review スキルを diff-audit へ改名した際（#796）、削除・改名前の被参照スキャンを行わなかったため、以下が事後検出になった:
acceptance-reviewからのリンク切れ（RiverReview レビューで major 指摘として検出）.cursor配下の壊れた symlink（旧パスself-reviewを指したまま。Codex 側レビューで検出）
いずれも事前に inbound スキャンを行っていれば着手前に判明していた。本スキルはこの再発防止策として新設する。
When NOT to use
- コード内の import / require 参照の整合性チェック → 型チェッカー / linter を使う
- 外部サイトへのリンク切れ（http/https URL）のチェック → 対象外（本スキルはリポジトリ内参照のみ）
手順
Step 1: 対象パスの確認
削除・移動・改名する対象パスを列挙する（複数可）。例:
対象: .claude/skills/self-review/ (旧名)
対象: .claude/skills/self-review/SKILL.md
移動・改名の場合は「旧パス」と「新パス」の両方を把握しておく（新パスは対象外、旧パスのみスキャン対象）。
Step 2: スキャン実行
フルパスとファイル名のみの 2 パターンで grep する。参照形式が ./ 省略・相対パス表記・単純なファイル名参照など様々なため、片方だけでは取りこぼす。
対象ディレクトリ・ファイル: docs/ .claude/ .agents/ .codex/ .cursor/ plugin/ bin/ scripts/ CLAUDE.md AGENTS.md README*.md
対象拡張子: *.md *.json *.sh *.yaml *.yml
TARGET_FULL="path/to/target" # フルパス（削除・移動対象）
TARGET_NAME="$(basename "$TARGET_FULL")" # ファイル名のみ
# プレースホルダのまま実行すると全行マッチで大量出力になるためガードする
if [ -z "$TARGET_FULL" ] || [ "$TARGET_FULL" = "path/to/target" ]; then
echo "Error: TARGET_FULL を実際の対象パスに設定してください" >&2
else
# git grep は .gitignore を尊重し高速。--untracked で未コミットの新規ファイルも対象に含める
# パターン1: フルパスでの参照
git grep -n -F --untracked -- "$TARGET_FULL" -- '*.md' '*.json' '*.sh' '*.yaml' '*.yml'
# パターン2: ファイル名のみでの参照（誤検出が出やすいので手動で絞り込む）
git grep -n -F --untracked -- "$TARGET_NAME" -- '*.md' '*.json' '*.sh' '*.yaml' '*.yml'
fi
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 111 lines · 160 tokens per session scan A bf7cf0f389b6
ref-integrity-scan is a skill published in the GitHub repository s977043/PlanGate (2 stars, last pushed yesterday), licensed MIT. It adds 160 tokens to every session and 2,084 once invoked, about $0.0006 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
postmortem
Auto-generates a structured postmortem from a completed campaign. Reads the campaign file, telemetry logs, and feature ledger. Produces a documented analysis of what broke, what the safety systems caught, and what patterns emerged. Can also be invoked manually for any incident.
systematic-debugging
4-phase root cause analysis: observe, hypothesize, verify, fix. Enforces investigation before any code changes. Emergency stop after 2 failed fixes. Prevents shotgun debugging and fix cascades.
04-audit
Audit a codebase read-only across seven quality pillars into one ranked report. Use when the user wants to assess, health-check, or audit a codebase or one pillar. Not for fixing findings, reviewing a change, or checking a feature works.
07-refactor
Improve code across four axes (cleanup, performance, security, architecture) by scanning and fixing, or applying a pushed audit report. Use when the user wants to refactor, optimize, harden, or remove code. Not for read-only diagnosis or adding tests.
03-assert
Assert the work behaves by iterating the project's coding assertions until they pass, plus optional architecture and frontend facets. Use to validate an implementation. Not for reviewing or writing tests.
08-debug
Reproduce and fix a known bug, or find an unknown root cause by hypothesis validation. Use when the user wants to fix a bug, find why something breaks, or reopen a stuck investigation. Not for building a feature or reviewing a diff.