Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/telagod/code-abyss/indexing-codenpx skills add telagod/code-abyss --skill indexing-codegit clone --depth 1 https://github.com/telagod/code-abyssWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00050 | $0.01834 |
| Opus 5 | $0.00025 | $0.00917 |
| Sonnet 5 | $0.00010 | $0.00367 |
| Haiku 4.5 | $0.00005 | $0.00183 |
Grade D, and why
indexing-code scanned grade D with 3 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Downloads and executes remote codehighSupply chain
curl | sh runs whatever the server returns today, which is not necessarily what it returned when this was reviewed.
> - `--with-abyss` **已移除**(Agent OS v5.1)。请用 `curl -fsSL https://raw.githubusercontent.com/telagod/abyss/main/install.sh | bash`;claude/codex/gemini graph hooks 用 `abyss attach <host>` Reads agent configuration directoriesmediumAgent snooping
.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.
abyss attach claude # → ~/.claude/settings.json Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
> - `--with-abyss` **已移除**(Agent OS v5.1)。请用 `curl -fsSL https://raw.githubusercontent.com/telagod/abyss/main/install.sh | bash`;claude/codex/gemini graph hooks 用 `abyss attach <host>` How it starts
The opening of the file, as written. The whole thing — 149 lines — stays where its author put it; the contents beside it link to each section on GitHub.
代码关系图 · abyss
不是搜索工具,是代码的调用图 + 时间智能。通过 shell 调用
abyssCLI。
前置
进入项目时,检查并初始化索引:
command -v abyss >/dev/null && [ ! -f .code-abyss/index.db ] && abyss index
核心行为
改文件前:跑 abyss context
即将修改任何代码文件时,先获取该文件的完整上下文(不需要知道函数名):
abyss context <要修改的文件路径> --json
返回:该文件所有函数的外部调用方、依赖的类型和函数、热点评分、耦合文件。
根据返回结果:
- 有 production callers:检查改动是否会破坏调用方,改完逐个同步
- hotspot score > 5000:高风险文件,跑
abyss impact <func> --json深入分析 - impact risk > 7/10:跟用户确认方案后再改
- 有 uncovered paths:提醒用户补测试
- 有 coupled files:检查耦合文件是否需要同步修改
其他场景
| 场景 | 命令 |
|---|---|
| 初识项目架构 | abyss map --json |
| 追查 bug 来源 | abyss history <file> --symbol <func> --json |
| 搜索代码(比 grep 好) | abyss search "关键词" --json |
输出说明
--json 输出结构化 JSON,agent 直接解析。不加 --json 输出人类可读文本。
context 输出关键字段
{
"symbols_with_external_callers": [
{ "symbol": "SetError",
"external_callers": [
{ "file": "handler.go", "line": 42, "caller": "HandleRequest",
"confidence": 0.95, "is_test": false }
],
"possible_callers": []
}
],
"dependencies": [{ "name": "Account", "file": "types.go", "kind": "type_ref" }],
"hotspot": { "score": 5200, "changes_30d": 12, "complexity": 433 },
"coupled_files": [{ "file": "gateway.go", "co_changes": 13, "coupling": "65%" }]
}
external_callers:confidence ≥ 0.7 的可信调用方,按解析档位标注(1.0 同文件 / 0.95 同包 / 0.9 import 限定 / 0.8 全局唯一)possible_callers:confidence < 0.7 的歧义匹配——参考线索,不是事实,勿据此改调用方
impact 输出关键字段
{
"direct_callers": 17,
"transitive_callers": 521,
"uncovered_paths": ["handler.go:DoSomething"],
"risk_score": 8.5,
"risk_factors": ["high blast radius", "319 paths without test coverage"]
}
CLI 速查
abyss index # 建索引(~5s)
abyss context <file> [--json] # 文件完整上下文(改代码前用这个)
abyss callers <symbol> [--json] # 谁调了这个函数(默认隐藏 confidence < 0.7)
abyss callers <symbol> --min-confidence 0 # 连歧义匹配一起看
abyss impact <symbol> [--json] # 改了会影响什么(低置信边被排除时会在 risk_factors 标注)
abyss hook pre-edit # agent hook:stdin 读 tool JSON,增量刷新索引后输出警告
abyss hook post-edit # agent hook:编辑后增量刷新索引
abyss search "query" [--json] # 搜索代码
abyss map [--json] # 项目热点+耦合
abyss history <file> [--symbol X] # 变更历史
abyss stats # 索引统计
What ships with it
10 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- hooks/claude/hooks.json 468 B
- hooks/codex/hooks.json 562 B
- hooks/common/install-hooks.sh 6.2 KB runs code
- hooks/common/pre-edit-check.sh 2.3 KB runs code
- hooks/common/session-init.sh 786 B runs code
- hooks/gemini/hooks.json 684 B
- hooks/hermes/hooks.yaml 226 B
- hooks/hermes/plugin.py 1.2 KB runs code
- hooks/openclaw/plugin.js 1.2 KB runs code
- hooks/pi/hooks.json 489 B
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 149 lines · 50 tokens per session scan D aea381957e88
indexing-code is a skill published in the GitHub repository telagod/code-abyss (240 stars, last pushed 1mo ago), licensed MIT. It adds 50 tokens to every session and 1,834 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it D with 3 findings (downloads and executes remote code, reads agent configuration directories, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
codexkit-a-b-test-planner
Design rigorous A/B test plans with hypothesis, sample size calculation, Minimum Detectable Effect (MDE), randomization strategy, and decision rules. Includes guardrail metrics and rollout playbook. Use when planning product experiments, conversion optimization, or data-driven feature decisions.
codexkit-api-design-reviewer
Review REST and GraphQL API designs for consistency, usability, and best practices. Covers naming conventions, versioning strategy, error format, pagination, authentication patterns, and breaking change detection. Use when reviewing API specs, designing new APIs, or auditing existing endpoints.
codexkit-architecture-decision-writer
Write Architecture Decision Records (ADRs) following the Michael Nygard format. Captures context, options considered, decision rationale, and consequences. Use when making technology choices, framework selections, or any architectural decision that future developers need to understand.
codexkit-audit-readiness-checker
Assess organizational readiness for financial audits (internal or external). Map assertions to account balances, check evidence completeness, score readiness using a Red/Amber/Green framework, and generate a remediation timeline. Aligned with SOX, IFRS, and GAAP audit standards. Use before scheduled audits or when…
codexkit-business-case-writer
Write structured business cases with problem framing, options analysis, financial modeling (NPV/ROI/Payback), risk assessment, and implementation roadmap. Follows HBR business case structure. Use when seeking budget approval, proposing new initiatives, or justifying investment decisions.
codexkit-campaign-brief-writer
Write agency-standard creative briefs for marketing campaigns. Structure Background, Objective (SMART), Target Audience persona, Key Message, Mandatories, KPIs, Timeline, and Budget Allocation. Use when briefing agencies, creative teams, or internal marketing on a new campaign.