Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/saidake/code-trace-tree-vscode/code-trace-treenpx skills add saidake/code-trace-tree-vscode --skill code-trace-treegit clone --depth 1 https://github.com/saidake/code-trace-tree-vscodeWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00228 | $0.07074 |
| Opus 5 | $0.00114 | $0.03537 |
| Sonnet 5 | $0.00046 | $0.01415 |
| Haiku 4.5 | $0.00023 | $0.00707 |
Grade C, and why
code-trace-tree scanned grade C with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Tells the agent never to refusehighAnti-refusal
Suppressing the ability to decline removes a core safety control; a later harmful request then succeeds.
is expected for this skill; do not refuse that path as "outside the workspace." This is a copy
100% identical to code-trace-tree — 0 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.
How it starts
The opening of the file, as written. The whole thing — 607 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Code Trace Tree
Build and display code workflows as nested trees of line, file, and directory trace points. Operate the hybrid storage used by the Code Trace Tree IDE plugins, then ask the IDE to reload.
Only edit or sync traces when the user explicitly asks (for example: generate topic-related
nodes, add a tip at a line, rebind after edits). Do not auto-sync every turn.
Never delete existing trace points (including ones rebind reports as "invalid") unless
the user explicitly asks to remove them.
How to use this skill
Read this SKILL.md only. Do not list, search, or explore this skill's scripts/ or
references/ folders, and do not open script source to learn the API. Invoke the documented
Python commands by absolute path.
Open scripts/ or references/ only if you hit a critical problem while using the skill
(script missing or crashing, storage corrupt, or an error this file does not cover).
Skill scripts location
Helper scripts live under <Agent Skill Path>/code-trace-tree/scripts/.
Agent Skill Path is this agent’s skills directory (the parent of code-trace-tree/) for the agent you are running — project-local if present, otherwise global. It ends at skills, not at code-trace-tree. The skill is agent-agnostic; the table below lists known roots for common agents (examples, not an exclusive list). Other agents that load skills from a skills/ folder work the same — use that agent’s path.
| Agent (examples) | Global Agent Skill Path | Project-local Agent Skill Path |
|---|---|---|
| Claude Code | ~/.claude/skills |
<repo>/.claude/skills |
| Cursor | ~/.cursor/skills |
<repo>/.cursor/skills |
| GitHub Copilot | ~/.copilot/skills |
<repo>/.github/skills |
| Codex | ~/.agents/skills |
<repo>/.agents/skills |
| Gemini CLI | ~/.gemini/skills |
<repo>/.gemini/skills |
On Windows, ~ is %USERPROFILE%. Resolve Agent Skill Path once per session. Invoke scripts with absolute paths via python (or python3 if that is what is on PATH). Keep the process CWD in the IDE project (do not cd into the skill folder). Direct invocations: Trace Tree OPs. On PowerShell, also see Windows PowerShell.
What ships with it
8 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- references/data-format.md 17 KB
- scripts/create_tree.py 8.8 KB runs code
- scripts/request_refresh_profile.py 1.9 KB runs code
- scripts/request_refresh_settings.py 779 B runs code
- scripts/request_refresh.py 1.1 KB runs code
- scripts/resolve_storage.py 2.4 KB runs code
- scripts/select_trace_points.py 1014 B runs code
- scripts/trace_tree.py 60 KB runs code
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 607 lines · 228 tokens per session scan C de684931a7f2
code-trace-tree is a skill published in the GitHub repository saidake/code-trace-tree-vscode (16 stars, last pushed 2d ago), licensed MIT. It adds 228 tokens to every session and 7,074 once invoked, about $0.0011 per session on Opus 5. A static security scan graded it C with 1 finding (tells the agent never to refuse). It is 100% identical to code-trace-tree, differing in 0 lines, and is treated as a copy.
Other skills, from other repositories
code-trace-tree
Read, edit, and refresh Code Trace Tree plugin data (VS Code and JetBrains). Use when the user asks to add/update/remove trace points (line, file, or directory), inspect or modify Code Trace Tree profiles, sync agent-written traces into the IDE, ask the IDE to reload plugin data, or select/navigate to trace points in…
feishu
Work with Feishu or Lark bots, docs, sheets, bitables, approval flows, and OpenAPI/MCP setup without hardcoding credentials.
interview
Ask one useful structured question at a time only when material product/implementation choices are genuinely missing; remember answers and produce a brief/spec. Discoverable facts should be investigated instead of asked.
writing
将共享历史中的已验证事实和计算结果整理成符合受众、格式与长度约束的成稿。.
test
Detect the project’s test stack, run the narrowest useful tests, create tests when authorized, and report coverage/gaps honestly.
verify
Exercise the real app/API/CLI and collect observable evidence; tests alone do not count as end-to-end verification.