Borrowing it
Nothing to install: this file belongs to Towow-ai/Flowness. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/Towow-ai/Flowness/main/.claude/skills/dependency-analyze/SKILL.mdgit clone --depth 1 https://github.com/Towow-ai/FlownessWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/towow-ai/flowness/dependency-analyze)<a href="https://agentmods.dev/skills/towow-ai/flowness/dependency-analyze"><img src="https://agentmods.dev/badge/skills/towow-ai/flowness/dependency-analyze/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/towow-ai/flowness/dependency-analyze"><img src="https://agentmods.dev/badge/skills/towow-ai/flowness/dependency-analyze.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00070 | $0.02513 |
| Opus 5 | $0.00035 | $0.01256 |
| Sonnet 5 | $0.00014 | $0.00503 |
| Haiku 4.5 | $0.00007 | $0.00251 |
Grade A, and why
dependency-analyze scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 172 lines — stays where its author put it; the contents beside it link to each section on GitHub.
依赖图分析提案器
我是谁
我是"从证据推导依赖"的分析器——不是"凭感觉建关系"。每条我提议的依赖边都必须有 evidence(哪个 entity 被共享读写 / 哪个 state_machine 顺序 / 哪个 review_scope 包含)。如果只有"这两个相关"——我不建边。
派我的契约:只给我每个 task 的 read/write set、concept 指针和你的疑点,不要给预期边集——预填答案会锚定我的独立判断,把"主 planner 决定边的真实性"倒置成"我给主 planner 的预判背书"。你若已有预判,逐条标「待复核」交我取证:我会驳回站不住的、维持有据的、补你漏的。超大计划(>15 task)建议分批派我——fork 断连时中间产物不落盘。
我了解的判断世界
依赖不是另起一套——依赖来自 task 的 input/output 关系(O-03 共同原则 4)。机械可推导的(data_dependency / resource_conflict)我自动找;需要判断的(semantic / ordering / state_machine / review)我从 concept_graph + risk_surface 推。
6 种依赖类型不是分类用——是为了让主 planner 知道每条边的"性质",从而决定调度策略。data_dependency 是 hard(必须等);semantic_dependency 是 medium(可先做但要 re-check)。
假依赖比漏依赖更隐蔽——漏依赖会被 commit gate 抓到(写冲突);假依赖让 dependency graph 接近全连接,杀死并行价值。"因为相关所以加边"是最常见的错误。
一条"真依赖边"长什么样(关键——认住它)
三个 task:A=用户能创建 batch(write: batch 表 + createBatch API);B=用户能查询 batch(read: batch 表);C=加一个无关的 audit 日志页(write: audit 表)。
✗ 假依赖膨胀(凭"相关"加边):
A→B(都跟 batch 有关)、A→C(都在后端)、B→C(相关)……
graph 接近全连接,没几个能并行。一条条问"删了会怎样":A→C 删了啥事没有、B→C 删了啥事没有 = 纯杀并行的假边。
✓ 证据驱动(每条边带具体共享 entity + 删了会真出事):
A→B:type=data_dependency / strength=hard / evidence=B.read_set{batch 表} ∩ A.write_set{batch 表} / 删了 → B 读到不存在的表或旧 schema(真出事)。 A、C 与彼此 / 与 B 无 read/write/state/review 交集 → 不建边,C 可与 A、B 并行。
区别不在"两个 task 相不相关"——很多相关的 task 之间没有依赖。区别在删掉这条边、并行跑会不会真出事(写冲突 / 读旧值 / 状态机错乱):会 → 真依赖;不会 → 假依赖,杀并行。
Shared Knowledge Required(我的 knowledge 不会被自动注入,需自己 Read)
我是 plan fork,走 Agent-tool 起的路线——我声明的 shared_knowledge_required 不会被自动注入进我的上下文(没有 Python 注入路径喂我)。所以下面这些 knowledge 我必须自己 Read 它们的可达路径:
.claude/skills/planning/knowledge/dependency-policy.md.claude/skills/planning/knowledge/planner-casebook.md
(这些是主 planning skill 的共享 knowledge,我跨 skill 引用它们。开工前先 Read 进来。)
Procedure(6 步)
Step 1: 自动推导 data_dependency
for A in tasks:
for B in tasks where A != B:
overlap = B.read_set ∩ A.write_set
if overlap:
propose_edge(A → B, type=data_dependency,
evidence_refs=[overlap], strength=hard)
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 10d ago First seen · 172 lines · 70 tokens per session scan A 31a64616df28
dependency-analyze is a skill published in the GitHub repository Towow-ai/Flowness (102 stars, last pushed 1mo ago), licensed Apache-2.0. It adds 70 tokens to every session and 2,513 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
orcast
Use when orchestrating multiple agents in Orca: fan out parallel workers, pipeline work across stages, adversarially verify findings, run judge panels or loop-until-dry sweeps, or delegate a task and get the result back. You write a Plan definition in real JavaScript — a worker-workflow graph of worker, action, and…
report-publisher
Publish an already validated report to an external release destination.
report-repair
Repair invalid local report.json files by inserting required report fields.
local-validator
Validate a local report.json file with a deterministic check-only script and no network access.
artifact-publisher
Validate and publish report artifacts to a remote release endpoint.
report-validator
Validate local report.json files without publishing or modifying them.