indexing-code

A code relationship and change-history index for a project. It shows which functions call each other, what files depend on a file, and where changes are likely to have wider effects.

In plain words
What is it for?
Use it to understand an unfamiliar codebase, trace a bug, search indexed code, assess the impact of a change, and identify high-risk or tightly connected files.
Why use it?
It reduces the risk of changing code without noticing its callers, dependencies, related files, or untested paths. It also helps trace how a function or file has changed over time.

Skill for Claude CodeCodex

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add skills/telagod/code-abyss/indexing-code
Any agent
npx skills add telagod/code-abyss --skill indexing-code
Clone the repo
git clone --depth 1 https://github.com/telagod/code-abyss

Made for: Claude Code, Codex.

Per session 50 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 1,834 The whole file, excluding the scripts and references it only reads on demand.
Security scan D 3 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00050 $0.01834
Opus 5 $0.00025 $0.00917
Sonnet 5 $0.00010 $0.00367
Haiku 4.5 $0.00005 $0.00183

Measured 2d ago against content hash aea381957e88, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade D, and why

indexing-code scanned grade D with 3 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

The scan reads SKILL.md. This mod also ships 5 executable files (hooks/common/install-hooks.sh, hooks/common/pre-edit-check.sh, hooks/common/session-init.sh, …), listed below but not scanned — reading those needs a real analyzer, not pattern matching.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Downloads and executes remote codehighSupply chain

curl | sh runs whatever the server returns today, which is not necessarily what it returned when this was reviewed.

> - `--with-abyss` **已移除**(Agent OS v5.1)。请用 `curl -fsSL https://raw.githubusercontent.com/telagod/abyss/main/install.sh | bash`;claude/codex/gemini graph hooks 用 `abyss attach <host>`

Reads agent configuration directoriesmediumAgent snooping

.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.

abyss attach claude # → ~/.claude/settings.json

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

> - `--with-abyss` **已移除**(Agent OS v5.1)。请用 `curl -fsSL https://raw.githubusercontent.com/telagod/abyss/main/install.sh | bash`;claude/codex/gemini graph hooks 用 `abyss attach <host>`
skills/indexing-code/SKILL.md · 149 lines

How it starts

The opening of the file, as written. The whole thing — 149 lines — stays where its author put it; the contents beside it link to each section on GitHub.

代码关系图 · abyss

不是搜索工具,是代码的调用图 + 时间智能。通过 shell 调用 abyss CLI。

前置

进入项目时,检查并初始化索引:

command -v abyss >/dev/null && [ ! -f .code-abyss/index.db ] && abyss index

核心行为

改文件前:跑 abyss context

即将修改任何代码文件时,先获取该文件的完整上下文(不需要知道函数名):

abyss context <要修改的文件路径> --json

返回:该文件所有函数的外部调用方、依赖的类型和函数、热点评分、耦合文件。

根据返回结果:

  • 有 production callers:检查改动是否会破坏调用方,改完逐个同步
  • hotspot score > 5000:高风险文件,跑 abyss impact <func> --json 深入分析
  • impact risk > 7/10:跟用户确认方案后再改
  • 有 uncovered paths:提醒用户补测试
  • 有 coupled files:检查耦合文件是否需要同步修改

其他场景

场景 命令
初识项目架构 abyss map --json
追查 bug 来源 abyss history <file> --symbol <func> --json
搜索代码(比 grep 好) abyss search "关键词" --json

输出说明

--json 输出结构化 JSON,agent 直接解析。不加 --json 输出人类可读文本。

context 输出关键字段

{
  "symbols_with_external_callers": [
    { "symbol": "SetError",
      "external_callers": [
        { "file": "handler.go", "line": 42, "caller": "HandleRequest",
          "confidence": 0.95, "is_test": false }
      ],
      "possible_callers": []
    }
  ],
  "dependencies": [{ "name": "Account", "file": "types.go", "kind": "type_ref" }],
  "hotspot": { "score": 5200, "changes_30d": 12, "complexity": 433 },
  "coupled_files": [{ "file": "gateway.go", "co_changes": 13, "coupling": "65%" }]
}
  • external_callers:confidence ≥ 0.7 的可信调用方,按解析档位标注(1.0 同文件 / 0.95 同包 / 0.9 import 限定 / 0.8 全局唯一)
  • possible_callers:confidence < 0.7 的歧义匹配——参考线索,不是事实,勿据此改调用方

impact 输出关键字段

{
  "direct_callers": 17,
  "transitive_callers": 521,
  "uncovered_paths": ["handler.go:DoSomething"],
  "risk_score": 8.5,
  "risk_factors": ["high blast radius", "319 paths without test coverage"]
}

CLI 速查

abyss index                           # 建索引(~5s)
abyss context <file> [--json]         # 文件完整上下文(改代码前用这个)
abyss callers <symbol> [--json]       # 谁调了这个函数(默认隐藏 confidence < 0.7)
abyss callers <symbol> --min-confidence 0   # 连歧义匹配一起看
abyss impact <symbol> [--json]        # 改了会影响什么(低置信边被排除时会在 risk_factors 标注)
abyss hook pre-edit                   # agent hook:stdin 读 tool JSON,增量刷新索引后输出警告
abyss hook post-edit                  # agent hook:编辑后增量刷新索引
abyss search "query" [--json]         # 搜索代码
abyss map [--json]                    # 项目热点+耦合
abyss history <file> [--symbol X]     # 变更历史
abyss stats                           # 索引统计

Read the full file on GitHub · 149 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2d ago First seen · 149 lines · 50 tokens per session scan D aea381957e88

Subscribe to this mod's changes

indexing-code is a skill published in the GitHub repository telagod/code-abyss (240 stars, last pushed 1mo ago), licensed MIT. It adds 50 tokens to every session and 1,834 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it D with 3 findings (downloads and executes remote code, reads agent configuration directories, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Related

Other skills, from other repositories

codexkit-a-b-test-planner

Design rigorous A/B test plans with hypothesis, sample size calculation, Minimum Detectable Effect (MDE), randomization strategy, and decision rules. Includes guardrail metrics and rollout playbook. Use when planning product experiments, conversion optimization, or data-driven feature decisions.

hoavdc/CodexKit · 62 tokens

codexkit-api-design-reviewer

Review REST and GraphQL API designs for consistency, usability, and best practices. Covers naming conventions, versioning strategy, error format, pagination, authentication patterns, and breaking change detection. Use when reviewing API specs, designing new APIs, or auditing existing endpoints.

hoavdc/CodexKit · 60 tokens

codexkit-architecture-decision-writer

Write Architecture Decision Records (ADRs) following the Michael Nygard format. Captures context, options considered, decision rationale, and consequences. Use when making technology choices, framework selections, or any architectural decision that future developers need to understand.

hoavdc/CodexKit · 59 tokens

codexkit-audit-readiness-checker

Assess organizational readiness for financial audits (internal or external). Map assertions to account balances, check evidence completeness, score readiness using a Red/Amber/Green framework, and generate a remediation timeline. Aligned with SOX, IFRS, and GAAP audit standards. Use before scheduled audits or when…

hoavdc/CodexKit · 75 tokens

codexkit-business-case-writer

Write structured business cases with problem framing, options analysis, financial modeling (NPV/ROI/Payback), risk assessment, and implementation roadmap. Follows HBR business case structure. Use when seeking budget approval, proposing new initiatives, or justifying investment decisions.

hoavdc/CodexKit · 61 tokens

codexkit-campaign-brief-writer

Write agency-standard creative briefs for marketing campaigns. Structure Background, Objective (SMART), Target Audience persona, Key Message, Mandatories, KPIs, Timeline, and Budget Allocation. Use when briefing agencies, creative teams, or internal marketing on a new campaign.

hoavdc/CodexKit · 61 tokens