Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add Snowflake-Labs/cocoplus --skill cocotracegit clone --depth 1 https://github.com/Snowflake-Labs/cocoplusWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/snowflake-labs/cocoplus/cocotrace)<a href="https://agentmods.dev/skills/snowflake-labs/cocoplus/cocotrace"><img src="https://agentmods.dev/badge/skills/snowflake-labs/cocoplus/cocotrace/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/snowflake-labs/cocoplus/cocotrace"><img src="https://agentmods.dev/badge/skills/snowflake-labs/cocoplus/cocotrace.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00022 | $0.01956 |
| Opus 5 | $0.00011 | $0.00978 |
| Sonnet 5 | $0.00004 | $0.00391 |
| Haiku 4.5 | $0.00002 | $0.00196 |
Grade A, and why
cocotrace scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 180 lines — stays where its author put it; the contents beside it link to each section on GitHub.
CocoTrace — Requirements-to-Implementation Traceability
Overview
CocoTrace maintains a directed dependency graph: bloom.md → discuss.md → spec.md → plan.md → build-output → eval-results. SHA-256 content hashes detect genuine changes (not timestamp drift from git operations). Staleness propagates downstream from any changed node.
Why SHA-256, not timestamps: Rebase and cherry-pick change file mtimes without changing content. SHA-256 only signals real changes.
Commands
$trace build
-
Execute the
cocotrace/trace-checkcontract (deterministic, no LLM, Tier 2 async) -
Read output
lifecycle/trace.json -
Display summary table:
Artifact Status SHA-256 ────────────── ──────── ────────── bloom.md current abc12345 discuss.md stale def67890 spec.md stale (downstream of discuss.md) plan.md missing — build-output missing — eval-results missing — -
Create git commit:
chore(cocotrace): update artifact traceability graph -
Output: "[N] current, [M] stale, [P] missing"
Idempotent: Running twice on unchanged content produces bit-identical trace.json.
$trace gaps
-
Read
lifecycle/trace.json -
Read
lifecycle/spec.md- If spec.md has no
##section headings: output "spec.md has no section structure — gap analysis requires structured sections" and exit gracefully
- If spec.md has no
-
Extract requirement sections (all
##headings in spec.md) -
Check
lifecycle/build/for corresponding implementation files -
Report:
## Traceability Gap Analysis ### Orphaned Requirements (in spec.md, no build artifact) - § 3.2 Model Selection Criteria — no matching build artifact found ### Uncovered Code (in build/, no traceable requirement) - lifecycle/build/helper-utils.sql — not referenced in spec.md ### Coverage Requirements covered: 4/6 (67%) Implementation traced: 3/4 (75%)
$trace show <artifact>
- Read
lifecycle/trace.json - Trace backward from
<artifact>: which upstream nodes inform it? - Trace forward: which downstream nodes it produces?
- Display ASCII dependency chain with YOU ARE HERE marker:
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 6d ago First seen · 180 lines · 22 tokens per session scan A 840f87bc0094
cocotrace is a skill published in the GitHub repository Snowflake-Labs/cocoplus (720 stars, last pushed 6d ago), licensed MIT. It adds 22 tokens to every session and 1,956 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
audit-activation
Audits sub-agent activation from explicit consumer telemetry roots. It separates attempted, started, completed, and unattributed events, reports coverage, and identifies observed zero starts without making an estate-wide dormancy claim. Use when specialized agents feel under-used, before pruning the catalog, or after…
golden-dataset
Golden dataset lifecycle patterns for curation, versioning, quality validation, and CI integration. Use when building evaluation datasets, managing dataset versions, validating quality scores, or integrating golden tests into pipelines.
critical-review
Radical-honesty architectural review — questions code, methodology, design, and operational fitness.
code-reviewer
A code-review workflow written in Chinese that checks software changes for correctness, security, performance, and maintainability. It also defines a report format for critical issues and suggestions.
skill-steward
Use when installed skills need a lifecycle audit: scans the forge registry and the configured skill directories for staleness, overlap, and conflicting triggers, then proposes a retire, promote, merge, or quarantine action per skill with evidence.
test-writing
Write tests that catch real regressions — behavior-focused, minimal mocking, edge cases chosen from the code's actual branches. Use when adding tests for new code or backfilling tests for a fix.