tech-stack-detective

tech-stack-detective is a skill for Claude Code, Codex from tinyfish-io/tinyfish-cookbook. It costs 115 tokens per session (2,222 once invoked), scanned A, original, MIT.

A research workflow for identifying the technologies a company uses from public sources such as job listings, GitHub, engineering blogs, StackShare, and its website.

In plain words
What is it for?
Use it to investigate a company’s frontend, backend, data, authentication, or broader engineering stack.
Why use it?
It helps separate publicly supported evidence about a company’s actual technology stack from guesswork.

Skill for Claude CodeCodex

Written for no agent in particular: nothing here depends on one.

Good fit Use it to investigate a company’s frontend, backend, data, authentication, or broader engineering stack.

Compare 6 skills from other repositories ↓
Install with agentmods
npx agentmods add skills/tinyfish-io/tinyfish-cookbook/tech-stack-detective
About the project

TinyFish Cookbook is a collection of example applications, recipes, and automations built with TinyFish, a web service that lets AI agents search the live web, read pages, and perform browser-based tasks. Developers use it to learn how to build web agents and connect them with workflows such as research, monitoring, and data collection. The catalogue entries provide agent skills and integrations for working with these examples and TinyFish endpoints.

tinyfish-io/tinyfish-cookbook · 2,254 stars · on GitHub · tinyfish.ai

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent
npx skills add tinyfish-io/tinyfish-cookbook --skill tech-stack-detective
Clone the repo
git clone --depth 1 https://github.com/tinyfish-io/tinyfish-cookbook

Made for: Claude Code, Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for tech-stack-detective

README.md
[![agentmods](https://agentmods.dev/badge/skills/tinyfish-io/tinyfish-cookbook/tech-stack-detective/github.svg)](https://agentmods.dev/skills/tinyfish-io/tinyfish-cookbook/tech-stack-detective)
Your own site
<a href="https://agentmods.dev/skills/tinyfish-io/tinyfish-cookbook/tech-stack-detective"><img src="https://agentmods.dev/badge/skills/tinyfish-io/tinyfish-cookbook/tech-stack-detective/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for tech-stack-detective

Your own site · 80×15
<a href="https://agentmods.dev/skills/tinyfish-io/tinyfish-cookbook/tech-stack-detective"><img src="https://agentmods.dev/badge/skills/tinyfish-io/tinyfish-cookbook/tech-stack-detective.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 115 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 2,222 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe. Third-party audits
  • NVIDIA SkillSpector pass 7 Sept 2026
How audits are shown
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00115 $0.02222
Opus 5.5 $0.00046 $0.00889
Sonnet 5.5 $0.00023 $0.00444
Haiku 4.5 $0.00012 $0.00222

Measured 1mo ago against content hash 31da3882fae9, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

tech-stack-detective scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

skills/tech-stack-detective/SKILL.md · 226 lines

How it starts

The opening of the file, as written. The whole thing — 226 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Tech Stack Detective

Reverse-engineer any company's tech stack from public signals — job listings, StackShare, GitHub, engineering blog, and their live website — then return a layered map of what they actually run.

Pre-flight Check (REQUIRED)

Before making any TinyFish call, always run BOTH checks:

1. CLI installed?

which tinyfish && tinyfish --version || echo "TINYFISH_CLI_NOT_INSTALLED"

If not installed, stop and tell the user:

Install the TinyFish CLI: npm install -g @tiny-fish/cli

2. Authenticated?

tinyfish auth status

If not authenticated, stop and tell the user:

You need a TinyFish API key. Get one at: https://agent.tinyfish.ai/api-keys

Then authenticate:

tinyfish auth login

Do NOT proceed until both checks pass.


Step 1 — Gather inputs

You need:

  • Company name — e.g. Stripe, Linear, Vercel, Notion
  • Company domain — e.g. stripe.com (infer from company name for well-known companies, ask if unsure)

Optional:

  • Area of interest — e.g. "just the frontend", "their data pipeline", "what they use for auth" (if specified, focus the output on that layer)

Step 2 — Parallel research

Fire all 5 agents simultaneously.

# Agent 1 — StackShare profile
tinyfish agent run \
  --url "https://stackshare.io/{COMPANY_SLUG}" \
  "You are on the StackShare profile for {COMPANY}.
   Extract their full tech stack as listed:
   - All tools and services listed under each category
   - Category names (e.g. Languages, Frameworks, Data Stores, DevOps, etc.)
   - Any tools listed as 'used by' this company
   STRICT RULES:
   - Do NOT click any tool links
   - Do NOT navigate away
   - Read only what is visible on this page
   - If the page returns 404 or no company found, return {found: false}
   Return JSON: {found: bool, stack: [{category, tools: []}]}" \
  --sync > /tmp/tsd_stackshare.json &

# Agent 2 — Job listings (tech signals from requirements)
tinyfish agent run \
  --url "https://www.linkedin.com/jobs/search/?keywords={COMPANY_ENCODED}+engineer" \
  "You are on LinkedIn job listings for {COMPANY}.
   Read the job titles and visible snippets for engineering roles.
   Extract all technologies, languages, frameworks, and tools mentioned in:
   - Job titles
   - Visible job description snippets
   Focus on: programming languages, frameworks, databases, cloud providers, tooling.
   STRICT RULES:
   - Do NOT click any job listing
   - Read only titles and visible preview text
   - Maximum 15 listings then stop
   - Deduplicate — list each technology once
   Return JSON: {technologies: [{name, category, mention_count}]}" \
  --sync > /tmp/tsd_linkedin.json &

# Agent 3 — GitHub organization
tinyfish agent run \
  --url "https://github.com/{COMPANY_SLUG}" \
  "You are on the GitHub organization page for {COMPANY}.
   Extract signals about their tech stack from public repositories:
   - Top 6 pinned or most-starred repositories
   - Primary programming languages used across repos (visible in language bars)
   - Any infrastructure or tooling repos (e.g. terraform, kubernetes configs, SDKs)
   - Any open source projects that reveal their internal stack
   STRICT RULES:
   - Do NOT click into any repository
   - Read only what is visible on the org page
   - If no org found, return {found: false}
   Return JSON: {found: bool, top_repos: [{name, description, language, stars}], languages: [], infra_signals: []}" \
  --sync > /tmp/tsd_github.json &

# Agent 4 — Engineering blog
tinyfish agent run \
  --url "https://www.google.com/search?q=site:{COMPANY_DOMAIN}+engineering+OR+blog+OR+tech" \
  "You are on Google search results for the engineering blog of {COMPANY} at {COMPANY_DOMAIN}.
   Find the engineering or tech blog URL, then read the visible post titles and snippets.
   Extract:
   - Technologies, tools, or architectural decisions mentioned in post titles and snippets
   - Any posts about infrastructure, scaling, or architecture decisions
   - Any open source tools they built or adopted
   STRICT RULES:
   - Do NOT click any links
   - Read only titles and snippets visible in search results
   - Maximum 10 results then stop
   Return JSON: {blog_url, tech_signals: [{technology, context}], architecture_posts: [{title, snippet}]}" \
  --sync > /tmp/tsd_blog.json &

# Agent 5 — Live website analysis
tinyfish agent run \
  --url "https://{COMPANY_DOMAIN}" \
  "You are on {COMPANY}'s homepage at {COMPANY_DOMAIN}.
   Analyze the page for frontend technology signals:
   - JavaScript framework clues (React, Vue, Angular, Svelte, etc.) — look for script tags, __NEXT_DATA__, __nuxt, ng-, data-reactroot, etc.
   - CSS framework signals (Tailwind classes, Bootstrap, etc.)
   - Analytics tools (Google Analytics, Segment, Mixpanel, etc.)
   - CDN or hosting signals (Vercel, Cloudflare, Fastly, etc.)
   - Any visible 'built with' or 'powered by' badges
   - Meta tags that reveal framework or CMS
   STRICT RULES:
   - Do NOT navigate away from the homepage
   - Read source signals from the visible page
   - Return only what you can confidently infer — do not guess
   Return JSON: {frontend_framework, css_framework, analytics: [], cdn_hosting, other_signals: []}" \
  --sync > /tmp/tsd_website.json &

wait

echo "=== STACKSHARE ===" && cat /tmp/tsd_stackshare.json
echo "=== JOBS ===" && cat /tmp/tsd_linkedin.json
echo "=== GITHUB ===" && cat /tmp/tsd_github.json
echo "=== BLOG ===" && cat /tmp/tsd_blog.json
echo "=== WEBSITE ===" && cat /tmp/tsd_website.json

Read the full file on GitHub · 226 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 1mo ago First seen · 226 lines · 115 tokens per session scan A 31da3882fae9

Subscribe to this mod's changes

tech-stack-detective is a skill published in the GitHub repository tinyfish-io/tinyfish-cookbook (2,254 stars, last pushed 9d ago), licensed MIT. It adds 115 tokens to every session and 2,222 once invoked, about $0.0005 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Related

Other skills, from other repositories

12-cook

Manages project recipes and practical guides. Use when the user wants to find a recipe, document a technique, research improvements, follow an existing guide, or check that its steps are usable.

ai-driven-dev/framework · 42 tokens

05-improve

Reads complete conversation evidence, measures visible cost, and recommends minimal improvements. Use when the user wants to improve a conversation, reduce wasted time or tokens, or choose files to revise. Not for delivery review or automatic edits.

ai-driven-dev/framework · 48 tokens

typescript-strict

TypeScript strict mode patterns with interfaces, type guards, generics, and utility types. Use when defining types, creating type-safe functions, handling nullable values, or implementing generic components.

BlackBeltTechnology/pi-agent-dashboard · 41 tokens

apple-tools

Reach Apple PIM data (Calendar, Contacts, Reminders, Messages, Location, Maps, Weather) from a pi session via iMCP + pi's built-in MCP on macOS. Use when the user asks to read/search their Apple Calendar, Contacts, Reminders, iMessages, current Location, Maps, or Weather. Does NOT cover Apple Mail — iMCP exposes no…

BlackBeltTechnology/pi-agent-dashboard · 92 tokens

pi-dashboard-bootstrap

Make sure the local pi-dashboard server is running before any pi-dashboard action. Use FIRST whenever the user mentions the pi dashboard, pi sessions or pi agents, or asks to start/open the dashboard; also when a dashboard call fails with "connection refused".

BlackBeltTechnology/pi-agent-dashboard · 54 tokens

09-for-sure

Run an iterative agent loop that retries until a runnable success condition passes. Use when the user says "for sure", "keep trying until", or wants guaranteed completion against a success command. Not for one-shot tasks or uncheckable goals.

ai-driven-dev/framework · 53 tokens