Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add sarveshtalele/mcp-skills-registry --skill legacy-discoverygit clone --depth 1 https://github.com/sarveshtalele/mcp-skills-registryWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/sarveshtalele/mcp-skills-registry/legacy-discovery)<a href="https://agentmods.dev/skills/sarveshtalele/mcp-skills-registry/legacy-discovery"><img src="https://agentmods.dev/badge/skills/sarveshtalele/mcp-skills-registry/legacy-discovery/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/sarveshtalele/mcp-skills-registry/legacy-discovery"><img src="https://agentmods.dev/badge/skills/sarveshtalele/mcp-skills-registry/legacy-discovery.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00144 | $0.00779 |
| Opus 5 | $0.00072 | $0.00390 |
| Sonnet 5 | $0.00029 | $0.00156 |
| Haiku 4.5 | $0.00014 | $0.00078 |
Grade A, and why
legacy-discovery scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
legacy-discovery
Discover and reverse-engineer a codebase — one skill, two modes.
When to use
- You have a github.com URL → pass
repo_url(remote: clone + full SDD). - You have a local directory the server can read → pass
repo_path(local scan).
Provide exactly one. Passing neither, or both, returns a clear error.
Outputs
mode—remoteorlocal.- Remote:
manifest,report_markdown,sdd_available. - Local:
spec_markdown,architecture_markdown,inventory.
Guardrails
The returned object is the complete analysis. Do not supplement it with web search, external fetches, or prior memory — report exactly what the skill returns.
User stories
- As an architect, I point at a GitHub URL and get an SDD without cloning by hand.
- As a maintainer, I scan a local checkout to inventory its stack and entry points.
Edge cases
- Neither input → error asking for
repo_urlorrepo_path. - Both inputs → error (ambiguous).
repo_pathnot a directory → clear error suggestingrepo_urlfor remotes.
See the analysis engine/ under scripts/ for the remote-mode pipeline.
What ships with it
19 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- assets/requirements.txt 261 B
- README.md 3.2 KB
- references/ARCHITECTURE.md 7.1 KB
- references/AUTH_PATTERNS.md 5.6 KB
- scripts/engine/__init__.py 951 B runs code
- scripts/engine/ai_analysis.py 29 KB runs code
- scripts/engine/analyzer.py 74 KB runs code
- scripts/engine/evaluator.py 34 KB runs code
- scripts/engine/generators/__init__.py 310 B runs code
- scripts/engine/generators/dashboard.py 83 KB runs code
- scripts/engine/generators/report.py 22 KB runs code
- scripts/engine/generators/sdd.py 14 KB runs code
- scripts/engine/loaders.py 3.3 KB runs code
- scripts/engine/output_manager.py 5.5 KB runs code
- scripts/engine/parsers.py 24 KB runs code
- scripts/engine/pipeline.py 16 KB runs code
- scripts/main.py 10 KB runs code
- scripts/reverse_engineer_skill.py 6.4 KB runs code
- templates/report_template.md 5.4 KB
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago First seen · 86 lines · 144 tokens per session scan A cc7a33087874
legacy-discovery is a skill published in the GitHub repository sarveshtalele/mcp-skills-registry (2 stars, last pushed 11d ago), licensed MIT. It adds 144 tokens to every session and 779 once invoked, about $0.0007 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
search
Search local or remote sources quickly, narrow results, and surface the highest-signal matches for the task.
analyzing-malicious-pdf-with-peepdf
Perform static analysis of malicious PDF documents using peepdf, pdfid, and pdf-parser to extract embedded JavaScript, shellcode, and suspicious objects. Use when triaging a suspicious PDF attachment from a phishing email, analyzing a PDF-based exploit document, or building detection signatures for weaponized PDF…
llama-factory
Expert guidance for fine-tuning LLMs with LLaMA-Factory - WebUI no-code, 100+ models, 2/3/4/5/6/8-bit QLoRA, multimodal support.
analyzing-android-malware-with-apktool
Perform static analysis of Android APK malware using apktool for resource decompilation, jadx for Java source recovery, and androguard for manifest inspection, dangerous permission-combination detection, and identification of obfuscated code, dynamic code loading, and reflection-based API calls. Use to statically…
bilibili_search
Search for videos on Bilibili using keyword queries generated from user interests.
frontend-feature
Build a new page, view, or data-driven feature in the Next.js frontend. Use when adding a route under the dashboard/marketing area, wiring UI to a backend endpoint, adding client state, or creating a localized page. Covers App Router, data fetching, Zustand stores, and i18n.