Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add VioletCranberry/coco-search --skill cocosearch-commitgit clone --depth 1 https://github.com/VioletCranberry/coco-searchWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/violetcranberry/coco-search/cocosearch-commit)<a href="https://agentmods.dev/skills/violetcranberry/coco-search/cocosearch-commit"><img src="https://agentmods.dev/badge/skills/violetcranberry/coco-search/cocosearch-commit/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/violetcranberry/coco-search/cocosearch-commit"><img src="https://agentmods.dev/badge/skills/violetcranberry/coco-search/cocosearch-commit.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Anti-Refusal · line 37 Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.Fix: Remove instructions that suppress warnings, disclaimers, or ethical commentary. Let the agent surface safety-relevant caveats to the user.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00053 | $0.02965 |
| Opus 5.5 | $0.00021 | $0.01186 |
| Sonnet 5.5 | $0.00011 | $0.00593 |
| Haiku 4.5 | $0.00005 | $0.00297 |
Grade A, and why
cocosearch-commit scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 337 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Smart Commit with CocoSearch
A structured workflow for generating comprehensive commit messages. Uses CocoSearch's semantic search and dependency analysis to understand what changed, why it matters, and what it affects — producing commit messages that go far beyond surface-level diff summaries.
What this adds over generic commit message generators:
- Semantic understanding: Knows what the changed code does, not just what lines changed
- Blast radius awareness: Flags when changes affect high-impact files with many dependents
- Dependency context: Understands what the changed code relies on
- Cross-cutting synthesis: Detects when changes span multiple subsystems and summarizes coherently
- Conventional Commits: Automatically determines type, scope, and breaking changes
Pre-flight Check
-
Resolve index name (use the resolved name for all operations):
- Try
cocosearch.yamlforindexNamefield -- if found, use it - If no config file, call
list_indexes()and match the current project's directory name against available indexes. The MCP tools auto-derive index names from directory paths (e.g.,my-project/->my_project), so a match is likely if the repo was indexed without a config file. - If no match found, the project is genuinely not indexed -- warn: "No CocoSearch index found. I'll generate a commit message from diffs alone, but semantic analysis won't be available. Want me to index first?" Do NOT abandon CocoSearch tools just because
cocosearch.yamlis missing.
- Try
-
list_indexes()to confirm project is indexed -
index_stats(index_name="<resolved-name>")to check freshness- Stale (>7 days) -> warn: "Index is X days old -- semantic context may not reflect recent changes."
-
Check dependency freshness -- call
get_file_dependencieson any known file:get_file_dependencies(file="<any-known-file>", depth=1)- If response contains
warningswith typedeps_outdatedordeps_branch_drift: Note: "Dependency data is outdated -- impact analysis may be incomplete." - If response contains
warningswith typedeps_not_extracted: Note: "No dependency data found. Blast radius analysis will be skipped." - If no warnings: Proceed with full analysis.
- If response contains
-
Linked index health (if
cocosearch.yamlhaslinkedIndexes):- Check the
warningsarray fromindex_stats()for entries starting with "Linked index" - If stale/missing: note — "Linked index 'X' is stale/missing. Cross-project context may be limited."
- Check the
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 337 lines · 53 tokens per session scan A 493ad1a66fd5
cocosearch-commit is a skill published in the GitHub repository VioletCranberry/coco-search (37 stars, last pushed 4d ago), licensed MIT. It adds 53 tokens to every session and 2,965 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
eb-activity-summary
Summarize activity for the Ephemeral Buffer MCP repository, including commits, pull requests, issues, releases, and CI. Use for EB weekly or custom-period activity reports; do not use for implementing repository changes.
commit-guard
Format, lint, typecheck and test before a commit lands. Use when the task involves: commit, pre-commit, hook, staged, format, lint.
refactor-rfc
Name the smell, the target shape, and the order to get there. Use when the task involves: refactor, rfc, debt, cleanup, restructure, smell.
autofix-pr
Watch a pull request and fix it from a worktree of its own - CI failures, review feedback from trusted authors and merge conflicts are fixed, pushed to the PR branch and answered on the PR under the user's git and gh identity. Usage - /autofix-pr [ | ] [--once] [--every ] [--no-reply] [--yes] [instructions]…
cw-land
Use when turning verified Codewhale work into commits, branches, or a merge: choosing direct-main vs. worktree vs. integration branch, preserving contributor credit, and honoring the gate artifact before merging.
git-commit
Analyze changes with Git only and auto-generate conventional commit messages with optional emoji; suggests splitting commits when needed, runs local Git hooks by default (use --no-verify to skip).