Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add will-pagane/claude-superdev-harness --skill code-ultragraph-reviewgit clone --depth 1 https://github.com/will-pagane/claude-superdev-harnessWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/will-pagane/claude-superdev-harness/code-ultragraph-review)<a href="https://agentmods.dev/skills/will-pagane/claude-superdev-harness/code-ultragraph-review"><img src="https://agentmods.dev/badge/skills/will-pagane/claude-superdev-harness/code-ultragraph-review/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/will-pagane/claude-superdev-harness/code-ultragraph-review"><img src="https://agentmods.dev/badge/skills/will-pagane/claude-superdev-harness/code-ultragraph-review.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00000 | $0.04318 |
| Opus 5 | $0.00000 | $0.02159 |
| Sonnet 5 | $0.00000 | $0.00864 |
| Haiku 4.5 | $0.00000 | $0.00432 |
Grade A, and why
code-ultragraph-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 127 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Code Ultragraph Review
Overview
A deep, whole-codebase review is too large for one context to do well. This skill runs it as a graph-informed, multi-agent ultracode workflow: the committed knowledge graph partitions the codebase and surfaces hotspots; dozens of subagents review slices across every finding class; each finding is adversarially verified before it survives; results are deduped and severity-ranked into one report.
Two hard rules:
- No graph → no run. This skill only operates on a project that already has a committed knowledge graph.
- Always ultracode. The review MUST run via the Workflow tool. Never do it inline, and never with ad-hoc
Agentteammates — defaulting to a handful of inline teammates is the exact failure mode this skill exists to prevent.
Invocation & modes
/code-ultragraph-review <category>→ read-only review (current behavior). Writes a report, stops./code-ultragraph-review <category> --autopilot→ fully autonomous WRITE pipeline, category-driven bylib/categories.mjs: worktree → runtime signals (skipped when the mission has no signal provider) → deep-dive workflow → report → headless Codex refine → classify → apply (parallel + SDD) → verify+auto-repair → Pull Request. NO human gates. Opt-in only; without--autopilotthe skill never writes.- Supported missions (the
<category>arg):performance,security,correctness,cleanup,code-health. Each is one entry inlib/categories.mjs(includeCategories,signals,branchPrefix,prTitlePrefix). Adding a mission = adding one registry entry. Default<category>isperformance.
Resolve <category> (default performance) and the --autopilot flag from the skill args first. Record the skill's base directory (reported on load) — every script below is referenced relative to it as <BASE>.
Activation gate (do this FIRST)
Detect a knowledge graph — look for graphify-out/, .graphify/, or any directory holding both graph.json and GRAPH_REPORT.md:
What ships with it
12 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- apply-workflow.js 1.8 KB runs code
- lib/categories.mjs 2.2 KB runs code
- lib/categories.test.mjs 1.6 KB runs code
- lib/classify-fixes.mjs 1.9 KB runs code
- lib/classify-fixes.test.mjs 1.9 KB runs code
- lib/codex-refine.sh 1.7 KB runs code
- lib/normalize-signals.mjs 3.0 KB runs code
- lib/normalize-signals.test.mjs 2.8 KB runs code
- lib/pr-body.mjs 2.3 KB runs code
- lib/pr-body.test.mjs 1.7 KB runs code
- lib/verify.sh 1.5 KB runs code
- review-workflow.js 25 KB runs code
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 127 lines · 0 tokens per session scan A 75c0d444140d
code-ultragraph-review is a skill published in the GitHub repository will-pagane/claude-superdev-harness (4 stars, last pushed 5d ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 4,318 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
sol-luna-router
Route substantial coding or repository-review work through a two-stage Sol commander/verifier and separate Luna Max CLI worker. Use when the user explicitly asks Sol to direct or supervise Luna, explicitly requests this router, needs an isolated auditable Luna-owned implementation with a Sol review loop, or asks to…
idea-team
A structured group discussion for exploring a product idea through three roles: researcher, critic, and analogy finder. The roles look for evidence, weaknesses, and useful comparisons.
codebase-audit
A read-only method for auditing an entire codebase across contracts, data integrity, errors, security, architecture, technical debt, configuration, and caching. It produces prioritized findings and a repair roadmap.
codex-agent
Use when you want a second-opinion review via Codex CLI, cross-verification after another agent implements changes, debugging help, or alternative implementation proposals. Requires Codex CLI to be installed and authenticated.
project-health-auditor
Comprehensive codebase health analysis. Use when reviewing code quality, identifying technical debt, checking dependencies, or assessing project structure.
review-gate
Use before an agent-produced diff is committed, pushed, opened as a PR, merged, landed, or applied to user files when explicit implementation approval is missing. Trigger for review gate, review pack, approve before landing, diff first then land, human approval, merge gate, commit gate, push gate, or PR readiness.…