Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/testdouble/han/code-overviewnpx skills add testdouble/han --skill code-overviewgit clone --depth 1 https://github.com/testdouble/hanWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00214 | $0.07603 |
| Opus 5 | $0.00107 | $0.03802 |
| Sonnet 5 | $0.00043 | $0.01521 |
| Haiku 4.5 | $0.00021 | $0.00760 |
Grade A, and why
code-overview scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 416 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Project Context
- git installed: !
which git 2>/dev/null || echo "not installed" - gh installed: !
which gh 2>/dev/null || echo "not installed" - CLAUDE.md: !
find . -maxdepth 1 -name "CLAUDE.md" -type f - project-discovery.md: !
find . -maxdepth 3 -name "project-discovery.md" -type f - personal config directory: !
bash "${CLAUDE_PLUGIN_ROOT}/scripts/han-config-dir.sh" 2>/dev/null || echo "$HOME/.claude" - project .han/config.md: !
cat .han/config.md 2>/dev/null || echo ""
As your first action, use the Read tool on .han/config.md inside the personal config directory path above. A read
that returns no file is no personal configuration: continue silently. When that file or the project .han/config.md
probe supplies content, apply it per config-rule.md, which governs precedence
between the two files, relative-path resolution, and what to do with a file that reads but cannot be used.
Operating Principles
Read these before doing anything. They constrain every step below.
- "Why" is the organizing question. The overview exists to answer one question first: why does this code exist? — and the answer is the real problem it solves or the goal it accomplishes for the business or a user, never the technical mechanics. Why it exists, why it works the way it does, why it is the current solution to a real need: that is the spine of the whole document. Everything else the overview carries — what it does, how it flows, where it connects, where to start — flows out of the why and exists to give the reader the context to understand it. "What", "how", "where", and "when" are not dropped or diminished; they are framed by and subordinated to the "why" they serve. BECAUSE a reader who knows what code does but not why it exists cannot make sound decisions about it — the why is the load-bearing understanding, and the rest is scaffolding around it. State the why as a solution to a need, and never invent a business rationale the evidence does not support; when the why can only be inferred, mark it as inferred.
- The skill orchestrates and synthesizes; the agents discover, validate, then refine. The skill resolves the target,
classifies size, dispatches exploration, and writes the overview.
han-core:codebase-exploreragents gather the surrounding code and context the synthesis draws on — they do not write the overview. After the draft is written,han-core:adversarial-validatorre-reads the code to challenge the draft's claims for accuracy, andhan-communication:readability-editorrewrites the corrected draft against the shared readability standard, preserving every fact; the skill applies the validator's corrections and the editor's rewrite. The skill itself produces the grouping, the charts, the orientation, and the final rewrite. - The overview applies the shared readability standard. As it writes and refines the overview, the skill sources the
standard by invoking
han-communication:readability-guidance(Step 5) and applies it, holding the default audience frame: a capable reader who did not do this work and lacks the author's context. The standard governs how the overview reads (main point first, descriptive headings, one idea per paragraph, progressive disclosure), never whether a required fact about the code appears. Its dedicatedhan-communication:readability-editorpass (Step 7) replaces the older information-architect / junior-developer readability review; the accuracy validator is a separate pass and stays. - Diagram legibility is this skill's job, not the editor's. The readability rewrite pass is barred from touching diagram bodies, so nothing but this skill checks whether a chart can be read. Apply the template's diagram rule as you draw each chart: boxes name components and boundaries, and fields, types, and technical annotations go into the prose beneath. BECAUSE the exemption is right for accuracy — an editor free to reword a box could silently change what the chart claims about the code — and the reading load it leaves behind has to land on someone.
- Read-only, always. The skill explains; it never edits the target. It writes only its own scratch overview file. BECAUSE the job is understanding, not modification — this keeps the skill safe to point at unfamiliar code.
- Accurate to the code, always. Every claim the overview makes — the why it states (grounded in commit and PR/issue intent, comments, and what the code visibly does toward a goal), what the code does, each flow step, each named entry point, each change grouped by intent — must be grounded in the actual code and its intent, never inferred past the evidence or invented. BECAUSE a confidently wrong overview is worse than none: it sends the reader to the wrong file with false confidence and silently corrupts the mental model the skill exists to build. The adversarial validation pass (Step 7) exists to catch this. It is accuracy control on the description, NOT a quality judgment about the code — the two are different lines, and crossing into the second is still forbidden.
- No quality judgment, ever. The overview raises no findings, severities, or recommended changes — including in the
PR-mode "what to watch" section, which is navigational only. BECAUSE reviewing a PR's quality is
code-review's job; this skill only helps the reader understand the PR before they review it. Crossing this line collapses the boundary between the two skills. Saying the code does not support a change's stated reason is not a crossing: the claim under test there is the document's own leading claim about the reason, which this skill already owns and already validates, not a judgment about the code's quality. - No PR statistics, ever. The overview never states lines changed, files changed, additions/deletions, commit counts, or any other diff-stat figure — not in the intro, not in a section, not anywhere. BECAUSE these numbers go stale the instant the PR is updated and add no understanding; describe what changed and why, never how big the diff is.
- Every overview cites its context. The overview lists every source it drew on in a
Context usedsection placed directly after the lead why section — linked directly when the source has an address (a repository file path, a PR / issue / commit URL), stated in one plain sentence when it does not (an uncommitted diff, the branch's commit messages, context supplied in conversation). BECAUSE the reader should be able to walk the same evidence the overview was built from, and a fabricated or broken link poisons that trust — never invent a URL or link a path that does not exist. - Ephemeral, not documentation. The overview is an understand-now orientation aid, not durable documentation,
BECAUSE durable feature and system docs are
project-documentation's job. That is why the skill's own default destination sits outside the repository, and why the skill never commits the file. This principle governs the skill's default only, not what a person configures: a configured output directory wins wherever it points, and the run says nothing about it (Step 6). - Default to small. Start size classification at small and escalate only when a higher-band signal is clearly present. BECAUSE under-dispatching is recoverable by re-running larger; over-dispatching burns tokens and dilutes the overview.
- Minimal technical detail, scoped per section. Keep the why, flow, and context sections at the level of why the code exists and what it does — the why is told as a problem solved or goal met, not as technical mechanics. The where-to-start / what-to-watch handoff is the one exception — it must name concrete entry points or it is not actionable.
- The output template lives at references/overview-template.md. Render that template; do not invent a structure inline.
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 416 lines · 214 tokens per session scan A a5bbeb26b3f1
code-overview is a skill published in the GitHub repository testdouble/han (247 stars, last pushed 3d ago), licensed MIT. It adds 214 tokens to every session and 7,603 once invoked, about $0.0011 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
golden-rss
Use when testing the rss golden build.
golden-chat-topics
Use when testing the goldenchattopics golden build.
golden-chat-single
Use when testing the goldenchatsingle golden build.
decided-import
Reformat ONE existing document (a decision, requirement, design, roadmap, or prompt) into ONE valid RAC (requirements-as-code) artifact, with a mandatory human-review step before any file is written and decided validate as the deterministic close. Use when a user wants to add or import a single existing decision or…
keep-the-why
Preserves or recovers the reasoning behind a codebase - architectural decisions, rejected alternatives, workarounds, incident learnings, operational constraints, and historical context the code itself cannot explain. Use when implementing or reviewing a non-trivial change involving a design decision, workaround…
summarize
Summarize conversations, logs, docs, or investigation notes into action-oriented text with evidence tags. Use for recap, handoff, CI failure digest, or MEMORY. Triggers: 总结, 汇总, summarize, 交接, 复盘, 调试总结.