Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/vibgrate/cli/vgnpx skills add vibgrate/cli --skill vggit clone --depth 1 https://github.com/vibgrate/cliWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00026 | $0.00826 |
| Opus 5 | $0.00013 | $0.00413 |
| Sonnet 5 | $0.00005 | $0.00165 |
| Haiku 4.5 | $0.00003 | $0.00083 |
Grade C, and why
vg scanned grade C with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Hidden instructionshighPrompt injection
Directives inside HTML comments, invisible characters or bidirectional overrides are read by the model and not by the person reviewing the file.
<!-- vg:v2 · managed by `vg install` — auto-refreshed when these instructions evolve; remove this line to opt out --> How it starts
The opening of the file, as written. The whole thing — 67 lines — stays where its author put it; the contents beside it link to each section on GitHub.
vg — the code map
This repo has a deterministic code graph built by vg. Prefer it over reading or
grepping many files — it is smaller, more relevant context, and free.
Use the MCP tools — not the CLI
When the vg MCP server is registered (it is after vg install), always call
its read-only tools instead of shelling out to the CLI. The server keeps the
map parsed, the relation index warm, and the embedding model loaded across
calls, so an MCP call answers in milliseconds — while every CLI invocation pays
Node startup plus a fresh map parse, hundreds of times more. Tools:
query_graph, get_node, impact_of, find_path, list_hubs, list_areas,
get_graph_summary, search_symbols. They are side-effect-free and
auto-approvable, and the server records which client is calling automatically.
Reach for the CLI only when the MCP server is genuinely unavailable — never as
the first resort.
CLI fallback — only when the MCP server is unavailable
If (and only if) no vg MCP server is available, use the CLI — and always
pass --client=claude so your calls are counted (that's how the CLI-vs-MCP split is
measured and the tools improved):
- Understand code:
vg "<question>" --client=claude— a budget-bounded, fact-annotated context block. - Find a symbol:
vg show <name> --client=claude— what it is, what it calls, what calls it. - Before changing something:
vg impact <name> --client=claude— what breaks if you change it. - Navigate:
vg path <A> <B> --client=claude,vg tree <name> --client=claude.
Dependencies & library docs
- Upgrade drift:
vg driftlists what is outdated across dependencies (offline;--onlinefor currency).vg scanscores upgrade drift andvg reportrenders it (text | json | sarif | md). - Version-correct docs:
vg lib <name>returns drift-annotated, version- specific usage docs for a library — inject these instead of guessing an API.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 67 lines · 26 tokens per session scan C 0255fb5b326a
vg is a skill published in the GitHub repository vibgrate/cli (3 stars, last pushed 2d ago), licensed Apache-2.0. It adds 26 tokens to every session and 826 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it C with 1 finding (hidden instructions). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
understand-dashboard
Launch the interactive web dashboard to visualize a codebase's knowledge graph.
understand-diff
Use when you need to analyze git diffs or pull requests to understand what changed, affected components, and risks.
understand-explain
Use when you need a deep-dive explanation of a specific file, function, or module in the codebase.
understand-onboard
Use when you need to generate an onboarding guide for new team members joining a project.
understand
Analyze a codebase to produce an interactive knowledge graph for understanding architecture, components, and relationships.
understand-knowledge
Analyze a Karpathy-pattern LLM wiki knowledge base and generate an interactive knowledge graph with entity extraction, implicit relationships, and topic clustering.