Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add vibgrate/cli --skill vggit clone --depth 1 https://github.com/vibgrate/cliWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/vibgrate/cli/vg)<a href="https://agentmods.dev/skills/vibgrate/cli/vg"><img src="https://agentmods.dev/badge/skills/vibgrate/cli/vg/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/vibgrate/cli/vg"><img src="https://agentmods.dev/badge/skills/vibgrate/cli/vg.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00026 | $0.00916 |
| Opus 5.5 | $0.00010 | $0.00366 |
| Sonnet 5.5 | $0.00005 | $0.00183 |
| Haiku 4.5 | $0.00003 | $0.00092 |
Grade C, and why
vg scanned grade C with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Hidden instructionshighPrompt injection
Directives inside HTML comments, invisible characters or bidirectional overrides are read by the model and not by the person reviewing the file.
<!-- vg:v5 · managed by `vg install` — auto-refreshed when these instructions evolve; remove this line to opt out --> How it starts
The opening of the file, as written. The whole thing — 71 lines — stays where its author put it; the contents beside it link to each section on GitHub.
vg — the code map
This repo has a deterministic code graph built by vg. Prefer it over reading or
grepping many files — it is smaller, more relevant context, and free.
Use the MCP tools — not the CLI
When the vg MCP server is registered (it is after vg install), always call
its read-only tools instead of shelling out to the CLI. The server keeps the
map parsed, the relation index warm, and the embedding model loaded across
calls, so an MCP call answers in milliseconds — while every CLI invocation pays
Node startup plus a fresh map parse, hundreds of times more. Tools:
query_graph, get_node, impact_of, find_path, list_hubs, list_areas,
get_graph_summary, search_symbols. They are side-effect-free and
auto-approvable, and the server records which client is calling automatically.
Reach for the CLI only when the MCP server is genuinely unavailable — never as
the first resort.
CLI fallback — only when the MCP server is unavailable
If (and only if) no vg MCP server is available, use the CLI — and always
pass --client=claude so your calls are counted (that's how the CLI-vs-MCP split is
measured and the tools improved):
- Understand code:
vg "<question>" --client=claude— a budget-bounded, fact-annotated context block. - Find a symbol:
vg show <name> --client=claude— what it is, what it calls, what calls it. - Before changing something:
vg impact <name> --client=claude— what breaks if you change it. - Navigate:
vg path <A> <B> --client=claude,vg tree <name> --client=claude.
Dependencies & library docs
- Upgrade drift:
vg driftlists what is outdated across dependencies (offline;--onlinefor currency).vg scanscores upgrade drift (text,json,sarif, ormd).vg reportrenders a saved scan astext,md,json, orhtml(a self-contained page). - Version-correct docs:
vg lib <name>returns drift-annotated, version- specific usage docs for a library — inject these instead of guessing an API.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago Changed 0be0ac02ec10
- 7d ago Changed · +1 lines 42f49f5c897c
- 24d ago Changed · +3 lines deb589b6601b
- 1mo ago First seen · 67 lines · 26 tokens per session scan C 0255fb5b326a
vg is a skill published in the GitHub repository vibgrate/cli (5 stars, last pushed 2d ago), licensed Apache-2.0. It adds 26 tokens to every session and 916 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it C with 1 finding (hidden instructions). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
scip-integrity-audit
Investigate whether a feature fulfills its promised behavior through live consumers. Find partial implementations, decorative checks, ineffective parser migrations, competing implementations, misleading results, and tests validating their own assumptions.
scip-query
Use code relationships, module structure, quality findings and change impact to plan and review changes alongside ordinary source-reading tools.
scip-explore
Understand existing implementation paths, callers, consumers and dependencies with targeted relationship queries and ordinary source reads.
scip-setup
Install, diagnose, index, watch, repair, or clean up scip-query for a repository. Use for setup, freshness, cache ownership, worktrees, watcher behavior, and operational failures—not ordinary code exploration.
code_explorer
Explores the repository to locate primary source files, coupled UI components, and test files for bug reports or feature requests.
test-failure-explorer
Import and query an existing Vitest 3.2 JSON report to explore test failures, file-level errors and original diagnostic evidence.