hydraflow: Skill for Claude Code

.codex/skills/hf.check-cross-service-impact/SKILL.md

hf.check-cross-service-impact is a skill for Claude Code, Codex from T-rav/hydraflow. It costs 11 tokens per session (692 once invoked), scanned A, original, Apache-2.0.

A warning hook for Python files in a shared folder that may be used by several services. It looks for downstream services importing the shared module and warns about possible effects.

In plain words
What is it for?
Use it when changing shared Python modules to prompt checks of the services that depend on them.
Why use it?
It helps developers notice that a change in shared code can affect multiple parts of a system, not just the file being edited.

Skill for Claude CodeCodex

Written for Claude Code and Codex: ${CLAUDE_PROJECT_DIR variable, but also installed under .codex/.

This is T-rav/hydraflow's own configuration. It tells Claude Code and Codex how to work on hydraflow itself, so it is not a mod to install elsewhere. Copy it as a starting point and replace the rules that are about this project. Everything hydraflow configures →

Reuse

Borrowing it

Nothing to install: this file belongs to T-rav/hydraflow. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file
curl -O https://raw.githubusercontent.com/T-rav/hydraflow/staging/.codex/skills/hf.check-cross-service-impact/SKILL.md
Clone the repo
git clone --depth 1 https://github.com/T-rav/hydraflow

Made for: Claude Code, Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for hf.check-cross-service-impact

README.md
[![agentmods](https://agentmods.dev/badge/skills/t-rav/hydraflow/hf.check-cross-service-impact/github.svg)](https://agentmods.dev/skills/t-rav/hydraflow/hf.check-cross-service-impact)
Your own site
<a href="https://agentmods.dev/skills/t-rav/hydraflow/hf.check-cross-service-impact"><img src="https://agentmods.dev/badge/skills/t-rav/hydraflow/hf.check-cross-service-impact/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for hf.check-cross-service-impact

Your own site · 80×15
<a href="https://agentmods.dev/skills/t-rav/hydraflow/hf.check-cross-service-impact"><img src="https://agentmods.dev/badge/skills/t-rav/hydraflow/hf.check-cross-service-impact.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 11 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 692 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00011 $0.00692
Opus 5 $0.00005 $0.00346
Sonnet 5 $0.00002 $0.00138
Haiku 4.5 $0.00001 $0.00069

Measured 11d ago against content hash c19e25c7a23c, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-11, from the pricing page.

Security

Grade A, and why

hf.check-cross-service-impact scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.codex/skills/hf.check-cross-service-impact/SKILL.md · 75 lines

What it actually says

hf.check-cross-service-impact

#!/bin/bash
# Hook: Warn when editing shared/ files about downstream service impact.
# Fires on PreToolUse for Edit tool.
# Warns ONCE per session (4-hour window), does not block.

set -euo pipefail

INPUT=$(cat)
FILE_PATH=$(echo "$INPUT" | jq -r '.tool_input.file_path // empty')

# Only check files in shared/
if ! echo "$FILE_PATH" | grep -qE '/shared/'; then
  exit 0
fi

# Skip test files and __init__.py
if echo "$FILE_PATH" | grep -qE '(test_|_test\.py|conftest\.py|/tests/|__init__\.py)'; then
  exit 0
fi

# Only check Python files
if ! echo "$FILE_PATH" | grep -qE '\.py$'; then
  exit 0
fi

PROJECT_DIR="${CLAUDE_PROJECT_DIR:-$(pwd)}"
MARKER_DIR="/tmp/claude-code-markers/$(echo -n "$PROJECT_DIR" | md5)"
mkdir -p "$MARKER_DIR"

# Check if already warned this session (within last 4 hours)
WARNED_MARKER="$MARKER_DIR/warned-cross-service"
if [ -f "$WARNED_MARKER" ] && [ -n "$(find "$WARNED_MARKER" -mmin -240 2>/dev/null)" ]; then
  exit 0
fi

# Find which services import from shared/
SHARED_MODULE=$(echo "$FILE_PATH" | sed -n 's|.*/shared/\(.*\)\.py$|\1|p' | tr '/' '.')
SERVICES=""

# Auto-discover directories that import from shared/
for svc_dir in "$PROJECT_DIR"/*/; do
  [ -d "$svc_dir" ] || continue
  svc=$(basename "$svc_dir")
  # Skip shared itself, hidden dirs, and non-service directories
  case "$svc" in
    shared|venv|node_modules|__pycache__|.git|.claude|.hydra|.github|ui|docs) continue ;;
  esac
  if grep -rql "from shared\." "$svc_dir" --include="*.py" 2>/dev/null | head -1 > /dev/null 2>&1; then
    SERVICES="${SERVICES}  - ${svc}\n"
  fi
done

if [ -n "$SERVICES" ]; then
  echo "CROSS-SERVICE IMPACT WARNING:" >&2
  echo "  You are editing: $FILE_PATH" >&2
  echo "  This shared module is imported by:" >&2
  echo -e "$SERVICES" >&2
  echo "Consider:" >&2
  echo "  - Run tests for affected services: make test-service SERVICE=<name>" >&2
  echo "  - Check for breaking changes to function signatures or return types" >&2
  echo "  - Verify type compatibility across all consumers" >&2
  touch "$WARNED_MARKER"
fi

exit 0
Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 11d ago First seen · 75 lines · 11 tokens per session scan A c19e25c7a23c

Subscribe to this mod's changes

hf.check-cross-service-impact is a skill published in the GitHub repository T-rav/hydraflow (5 stars, last pushed yesterday), licensed Apache-2.0. It adds 11 tokens to every session and 692 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Related

Other skills, from other repositories

debug

Run /debug to find and fix a bug's root cause: a test failing for an unclear reason, /check verify finding a failure, or behavior being wrong. Runs a reproduce, localize, hypothesize, test, fix, verify loop, makes the minimal fix, and hands a regression test to /test. No features, no extra refactors.

jsmastery-pro/skills · 74 tokens

debugging-patterns

Isolate root causes through structured evidence gathering, pattern analysis, hypothesis testing (max 3 at a time, highest confidence first), and fix validation with a reproducing test before implementation. Use when any verification step fails, tests break, or debugging a reported bug. This skill MUST be consulted…

synaptiai/synapti-marketplace · 90 tokens

merge-conflict-resolution

Detect, classify (porcelain status; complexity: trivial, semantic, structural, delete-modify), and resolve git merge conflicts through per-file strategy selection (accept-ours, accept-theirs, manual-merge, rebase), manual conflict hunk parsing, and post-resolution verification (orphaned markers, build, tests). Use…

synaptiai/synapti-marketplace · 114 tokens

runtime-verification

Verify code works at runtime through build verification (mandatory), LSP diagnostics, ad-hoc verification for projects without frameworks, E2E and smoke tests, and visual verification (screenshot-analyze-verify for UI changes). Skip whitelist strictly enforced (markdown-only, config-only, dependency-bump-only with…

synaptiai/synapti-marketplace · 116 tokens

evidence-based-development

Enforce evidence-based claims through file:line citations, P1/P2/P3 prioritization proportional to evidence, and the ASSERTION/EVIDENCE/VERIFIED pattern for behavioral claims before any recommendation. Use when gathering evidence, presenting findings, or making development decisions. This skill MUST be consulted…

synaptiai/synapti-marketplace · 80 tokens

hns-lsel-curator

Local Self-Evolution Loop (LSEL) curator — the CLUSTER + drain engine for the GOOS-local PROPOSE→APPLY seam closure (SPEC-LSEL-LOCAL-EVOLUTION-001). Companion-offset drain of .moai/lessons-inbox.jsonl with a drain-side severity filter that drops the 65% Bash-timeout/sandbox noise, eventkey clustering with a frequency…

modu-ai/moai-adk · 135 tokens