Getting it into your agent
This one installs as part of its plugin. Adding the marketplace and installing the plugin brings it with everything else the plugin ships.
/plugin marketplace add subinium/vibesubin/plugin install vibesubinWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/subinium/vibesubin/fight-repo-rot)<a href="https://agentmods.dev/skills/subinium/vibesubin/fight-repo-rot"><img src="https://agentmods.dev/badge/skills/subinium/vibesubin/fight-repo-rot/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/subinium/vibesubin/fight-repo-rot"><img src="https://agentmods.dev/badge/skills/subinium/vibesubin/fight-repo-rot.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00116 | $0.05705 |
| Opus 5 | $0.00058 | $0.02853 |
| Sonnet 5 | $0.00023 | $0.01141 |
| Haiku 4.5 | $0.00012 | $0.00571 |
Grade A, and why
fight-repo-rot scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 13d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 365 lines — stays where its author put it; the contents beside it link to each section on GitHub.
fight-repo-rot
Repos don't break in a day. They rot over months as dead code accumulates, god files grow, hardcoded paths get committed, and six-month-old TODOs turn into forever-TODOs. This skill surfaces what's rotting — it never edits code.
What this skill is: a diagnosis, sorted by confidence and leverage, with a pointer to the skill that should handle each finding.
What this skill is not: an executor. It never deletes, refactors, rewrites, or runs tests. When the operator approves a finding, it hands off to another skill (refactor-verify for deletions and restructures, project-conventions for config fixes, audit-security for CVE dependency rot). This boundary is load-bearing — the moment this skill starts editing, the evidence chain breaks.
When to trigger
- "find dead code" / "what can I delete"
- "is any of this unused"
- "clean up this repo" / "what's rotting"
- "what should I clean up"
- "where should I refactor"
- "my repo is a mess"
- "is my repo okay" (ambiguous — run this as a health check)
- before a major new feature (survey the rot first)
- before open-sourcing (don't surprise strangers)
State assumptions — before acting
Before starting the procedure, write an explicit Assumptions block. Don't pick silently between interpretations; surface the choice. If any assumption is wrong or ambiguous, pause and ask — do not proceed on a guess.
Required block:
Assumptions:
- Dispatch profile: <static-strict (TypeScript strict, Rust) — HIGH confidence reachable | dynamic (Python, Ruby, loose JS) — default ceiling is MEDIUM>
- DI/reflection/codegen: <none detected | present — push all candidates down one tier>
- Test suite state: <green (HIGH-confidence tags trustworthy) | red or missing (all tags downgraded one tier)>
Typical items for this skill:
- Language's dynamic-dispatch profile (Python / Ruby / loose JS default to MEDIUM confidence even for apparent HIGH; Rust / TypeScript-strict can reach HIGH with static grep)
- Whether reflection, DI containers, code generation, or dynamic imports are in play (every one of these pushes confidence down)
- Whether the test suite runs to green — if no, HIGH-confidence dead-code tags are actually MEDIUM until tests are reliable
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 13d ago First seen · 365 lines · 116 tokens per session scan A 7264e6ea4d22
fight-repo-rot is a skill published in the GitHub repository subinium/vibesubin (50 stars, last pushed 4mo ago), licensed MIT. It adds 116 tokens to every session and 5,705 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
neo-code-review
Use this skill when the user asks to review or audit source code, a PR, diff, commit, or recent changes for bugs, security, performance, tests, compatibility, or maintainability, duplicated code or logic across files, or hard-coded values. Also use it after an AI agent finishes modifying code to inspect the current…
neo-pr
Use this skill when the user asks to create, draft, review, format, or generate a Pull Request (PR) title and description, specify target or source branches for a repository, or convert git branch diffs into concise, high-impact, non-AI-slop PR content.
neo-rust
Use this skill when writing, refactoring, debugging, or auditing Rust code. Trigger for .rs files, Cargo projects, ownership/borrowing/lifetime issues, Result/Option error handling, unnecessary clone/performance work, unsafe code review, or modern Rust architecture.
coding-standards
Baseline cross-project coding conventions for naming, readability, immutability, and code-quality review. Use detailed frontend or backend skills for framework-specific patterns.
java-spring-code-review
Reviews Java and Spring Boot code changes with a findings-first workflow focused on behavioral regressions, contract drift, transaction and data-access risks, scheduler or async timing issues, security flaws, and performance problems. Use when the user asks to review code, inspect a PR or diff, check whether a backend…
code-review-excellence
This skill should be used when the user asks to review a diff or pull request, write review comments, audit code quality, establish review standards, or improve how a team performs code review.