Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add tamnguyendinh/Anvien --skill anvien-impact-analysisgit clone --depth 1 https://github.com/tamnguyendinh/AnvienWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/tamnguyendinh/anvien/anvien-impact-analysis)<a href="https://agentmods.dev/skills/tamnguyendinh/anvien/anvien-impact-analysis"><img src="https://agentmods.dev/badge/skills/tamnguyendinh/anvien/anvien-impact-analysis/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/tamnguyendinh/anvien/anvien-impact-analysis"><img src="https://agentmods.dev/badge/skills/tamnguyendinh/anvien/anvien-impact-analysis.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00049 | $0.00745 |
| Opus 5 | $0.00024 | $0.00373 |
| Sonnet 5 | $0.00010 | $0.00149 |
| Haiku 4.5 | $0.00005 | $0.00075 |
Grade A, and why
anvien-impact-analysis scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
This is a copy
86% identical to gitnexus-impact-analysis — 10 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.
How it starts
The opening of the file, as written. The whole thing — 98 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Impact Analysis with Anvien
When to Use
- "Is it safe to change this function?"
- "What will break if I modify X?"
- "Show me the blast radius"
- "Who uses this code?"
- Before making non-trivial code changes
- Before committing — to understand what your changes affect
Workflow
1. impact({target: "X", direction: "upstream"}) → What depends on this
2. READ anvien://repo/{name}/processes → Check affected execution flows
3. detect_changes() → Map current git changes to affected flows
4. Assess risk and report to user
If "Index is stale" → run
anvien analyzein terminal.
Checklist
- [ ] impact({target, direction: "upstream"}) to find dependents
- [ ] Review d=1 items first (these WILL BREAK)
- [ ] Check high-confidence (>0.8) dependencies
- [ ] READ processes to check affected execution flows
- [ ] detect_changes() for pre-commit check
- [ ] Assess risk level and report to user
Understanding Output
| Depth | Risk Level | Meaning |
|---|---|---|
| d=1 | WILL BREAK | Direct callers/importers |
| d=2 | LIKELY AFFECTED | Indirect dependencies |
| d=3 | MAY NEED TESTING | Transitive effects |
Risk Assessment
| Affected | Risk |
|---|---|
| <5 symbols, few processes | LOW |
| 5-15 symbols, 2-5 processes | MEDIUM |
| >15 symbols or many processes | HIGH |
| Critical path (auth, payments) | CRITICAL |
Tools
impact — the primary tool for symbol blast radius:
impact({
target: "validateUser",
direction: "upstream",
minConfidence: 0.8,
maxDepth: 3
})
→ d=1 (WILL BREAK):
- loginHandler (src/auth/login.ts:42) [CALLS, 100%]
- apiMiddleware (src/api/middleware.ts:15) [CALLS, 100%]
→ d=2 (LIKELY AFFECTED):
- authRouter (src/routes/auth.ts:22) [CALLS, 95%]
detect_changes — git-diff based impact analysis:
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago First seen · 98 lines · 49 tokens per session scan A d4cae0ac3d91
anvien-impact-analysis is a skill published in the GitHub repository tamnguyendinh/Anvien (9 stars, last pushed today), licensed MIT. It adds 49 tokens to every session and 745 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. It is 86% identical to gitnexus-impact-analysis, differing in 10 lines, and is treated as a copy.
Other skills, from other repositories
booboo-troubleshoot
Diagnose a Booboo brain that is not working — an empty or tiny graph, a flat starburst view, missing MCP tools, a client that cannot find the snapshot, climbing orphan counts, or a build that exits clean but produces nothing. Use when a booboo build, serve, mcp, view, panel or vault command misbehaves.
qartez
Semantic code intelligence skill for qartez MCP. Use qartez tools for code exploration, impact analysis, and guarded refactors; treat built-in code-tool denials as routing signals and recover via qartez replacements.
cli-e2e
Write, modify, or debug Docker-based Composio CLI end-to-end tests under ts/e2e-tests/cli, including binary invocation, fixture isolation, output assertions, and package manifests. Use for CLI E2E test suites only; use cli-command for CLI source implementation.
openlore-analyze-codebase
Run a full static OpenLore analysis and summarize architecture, call graph, refactoring issues, and duplicate code. Use when asked to analyze, map, or assess a codebase without LLM inference.
css-debug
Use this skill to diagnose CSS and frontend layout issues such as positioning, overflow clipping, Tailwind class conflicts, z-index stacking, and React rendering visibility problems.
ln-22-codebase-auditor
Audits cross-cutting code health, security, delivery, and maintainability when no specialist audit is primary. Not for a single delivery review.