code-tour

A guide for creating file-linked code walkthroughs for a specific audience. A code tour explains how a codebase works by arranging real files and lines into a narrative.

In plain words
What is it for?
Use it for onboarding guides, architecture explanations, pull-request tours, debugging explanations, contributor guides, and security reviews.
Why use it?
It turns an unfamiliar project into a structured path through the important code. This is useful when a reader needs context instead of isolated file descriptions.

Skill for Claude CodeCodex

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add skills/tmj-90/gaffer/code-tour
Any agent
npx skills add tmj-90/gaffer --skill code-tour
Clone the repo
git clone --depth 1 https://github.com/tmj-90/gaffer

Made for: Claude Code, Codex.

Per session 102 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 1,253 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00102 $0.01253
Opus 5 $0.00051 $0.00626
Sonnet 5 $0.00020 $0.00251
Haiku 4.5 $0.00010 $0.00125

Measured 2d ago against content hash 74fb90ee22d6, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

code-tour scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

runner/skills/code-tour/SKILL.md · 91 lines

How it starts

The opening of the file, as written. The whole thing — 91 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Create persona-targeted, file-anchored code tours

A great tour is a narrative — a story told to a specific person about what matters, why it matters, and what to do next. Every file path and line number must be real and verified.

Persona selection

Infer silently from the request:

User says Persona Depth
"tour for this PR" pr-reviewer standard
"why did X break" / "RCA" rca-investigator standard
"onboarding" / "new joiner" new-joiner standard
"quick tour" / "vibe check" vibecoder quick
"architecture" architect deep
"security" / "auth review" security-reviewer standard
(no qualifier) new-joiner standard

Depth guidelines:

  • Quick: 5–8 steps, high-level, 1–2 sentences per step.
  • Standard: 10–20 steps, full narrative, 3–5 sentences per step.
  • Deep: 20–40 steps, links between steps, covers edge cases and design rationale.

Tour file format

{
  "$schema": "https://aka.ms/codetour-schema",
  "title": "Tour title — persona",
  "description": "One sentence: what this tour covers and who it's for.",
  "steps": [
    {
      "file": "src/index.ts",
      "line": 1,
      "title": "Entry point",
      "description": "The application starts here. The `main()` function wires together the three primary subsystems..."
    }
  ]
}

Tours live in .tours/<name>.tour in the repo root.

Markdown fallback. The .tour JSON is the primary output. When the CodeTour extension or VS Code isn't available (CI, a headless agent, a reviewer reading on GitHub), also emit — or fall back to — a plain-markdown version: a numbered list of path/to/file.ts:42 — one-line description of what happens here, one entry per step, in the same order as the tour. It carries the same narrative and is readable anywhere, so the tour is never blocked on a specific editor being installed.

Step writing principles

  1. Start with the entry point. Request handling / server startup / CLI entry / main module — wherever execution begins.
  2. Follow the call graph. Each step ends by saying where the tour goes next and why. No teleporting.
  3. Name what matters. Call out non-obvious decisions ("this uses a singleton because…"); don't describe what the code literally says.
  4. Speaker notes for complexity. For a step covering a subtle invariant, write it as if you're pair-programming — "Watch out for X here because Y."
  5. End with a summary step. "You've seen the full request lifecycle. The key files are A, B, and C. Start with A when you need to change X."

Read the full file on GitHub · 91 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2d ago First seen · 91 lines · 102 tokens per session scan A 74fb90ee22d6

Subscribe to this mod's changes

code-tour is a skill published in the GitHub repository tmj-90/gaffer (2 stars, last pushed 7d ago), licensed Apache-2.0. It adds 102 tokens to every session and 1,253 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.