Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/yulaiz/interactive-code-map/skillnpx skills add YuLaiZ/interactive-code-map --skill skillgit clone --depth 1 https://github.com/YuLaiZ/interactive-code-mapWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00063 | $0.01747 |
| Opus 5 | $0.00032 | $0.00873 |
| Sonnet 5 | $0.00013 | $0.00349 |
| Haiku 4.5 | $0.00006 | $0.00175 |
Grade A, and why
interactive-code-map scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 75 lines — stays where its author put it; the contents beside it link to each section on GitHub.
interactive-code-map
Use this skill to create a concise, evidence-backed interactive code map. It produces one HTML file and never opens a browser automatically. Besides a codebase, a described non-code business process can be mapped the same way.
Chinese reading version: SKILL.zh-CN.md. This
SKILL.mdis the sole executable entry; if the two files differ, this file takes precedence.
Workflow
- Establish the input boundary. Obtain either a repository directory plus the question to answer, or a described non-code business process plus, when available, a directory of supporting documents. Ask for missing scope; do not infer facts outside the supplied directory or the user's description.
- Confirm the optional interaction profile before generating. Ask: “Should keyboard operation and small-viewport usability be included in this HTML map’s acceptance scope? (Recommended)” An explicit preference already given by the user counts as confirmation. If the user does not confirm, continue with the map but treat these capabilities as out of scope for this delivery; do not claim or test them as accepted behavior. Do not remove renderer capabilities merely because they are unselected. The generated controls guide shows the primary commands: click a card for details, click a relationship line to pin or unpin its hover-identical highlight,
Tabto select,Enterto open or pin, andEscto close and clear pins; node button semantics also acceptSpaceto open. - Choose the CDN delivery profile. Default to
global; usechina-friendlyonly when the user explicitly prefers China-mainland delivery or identifies that audience. Treat conversation language as a weak signal, not a location fact. Only use a live speed measurement when the current environment represents the target audience and the user agrees to network probing. Select only a bundled profile; never add arbitrary CDN URLs or bypass SRI. Report the selected profile and rationale. - Inspect only within that boundary: code for repository inputs, or the user's supplied documents and statements for business-process inputs. Mark every MapSpec claim as verified, inferred, or unconfirmed.
- Form a MapSpec. Use mapspec-v1.schema.json as the authoritative structure. Every verified evidence item needs a real relative path and an inspected line range resolved against
--repo-root: code lines for repository inputs, or document lines (for example a requirements or process markdown file) for business-process inputs. A statement that comes only from the user's verbal description, with no inspectable file, must be marked inferred or unconfirmed — never verified. Set the optionalmeta.uiLocaledeliberately for each delivered map: useenfor the English Demo, and usezh-CNby default when the user is conversing in Chinese (unless they request English output). The fixed renderer UI copy—document language, graph region name, dependency-failure page, reading guide, relationship keys, condition marker, evidence-status caption, and controls guide—must consistently follow this value; never leave a mixed-language legend. Each node must expose its localized claim state with the renderer's small upper-left, legend-matched status dot as well as the border treatment.languageProfiledescribes the code or business source and does not select UI language. Preserve the supplied language of business node, group, and edge text; only translate business content when the user explicitly asks. - Read visual-quality-contract.md before generating or revising a multi-group map. Apply its relationship semantics, routing limits, label placement, locale, and visual-acceptance rules. Do not repair a complex graph by repeatedly layering ad-hoc routing changes; retain Mermaid's node-to-node corridor and make only the documented local adjustments.
- Validate and generate the artifact. First verify node --version is at least 20. If it is not, report that Node.js 20 or newer is required and retain the MapSpec for the user instead of attempting generation.
- Report the generated relative HTML path, the evidence-state limits, the confirmed interaction and CDN profiles, and any manual browser verification performed. Do not report browser behavior as verified unless it was actually checked.
What ships with it
13 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- references/mapspec-v1.build-rules.json 9.5 KB
- references/mapspec-v1.schema.json 8.5 KB
- references/visual-quality-contract.md 5.1 KB
- references/visual-quality-contract.zh-CN.md 4.1 KB
- renderer/build-html.mjs 11 KB runs code
- renderer/deps.config.mjs 3.6 KB runs code
- renderer/mapspec-to-mermaid.mjs 3.7 KB runs code
- renderer/mermaid-encoder.mjs 1.2 KB runs code
- renderer/render.js 141 KB runs code
- renderer/styles.css 29 KB
- renderer/template.html 1.1 KB
- renderer/validate-map-spec.mjs 25 KB runs code
- SKILL.zh-CN.md 7.3 KB
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 75 lines · 63 tokens per session scan A b030217a7140
interactive-code-map is a skill published in the GitHub repository YuLaiZ/interactive-code-map (7 stars, last pushed 14d ago), licensed MIT. It adds 63 tokens to every session and 1,747 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
code-to-diagram
Analyze codebases and automatically generate architecture diagrams, flowcharts, and org charts. Uses AST parsing to map import dependencies for Python, JS/TS, Go, and Java, outputting Mermaid or SVG files. Triggered when users ask to visualize code architecture, understand dependencies, draw a flowchart, or create a…
markstream-install
Install and wire markstream-vue, markstream-react, markstream-vue2, markstream-angular, or markstream-svelte into an existing repository. Use when Codex needs to choose the right package, install the smallest framework-specific peer-dependency set, fix CSS/reset order, choose Vue 3 renderer mode and built-in, plain…
markstream-vue
Integrate markstream-vue into a Vue 3 app. Use when Codex needs to add the Vue 3 renderer, import CSS in the right order, choose renderer and DOM modes, choose built-in, plain, or custom code-block paths, choose between content and nodes, coordinate long AI timelines with MarkstreamVirtualTimeline…
markstream-migration
Audit and migrate existing Markdown rendering to Markstream, or upgrade a markstream-vue 1.x integration to 2.x. Use when Codex needs to replace another renderer, classify direct vs custom vs plugin-heavy adoption, preserve behavior during adoption, migrate custom renderers into scoped Markstream overrides, decide…
markstream-nuxt
Integrate markstream-vue into a Nuxt 3 or Nuxt 4 app. Use when Codex needs client-only boundaries, SSR-safe setup, browser-only peer gating, worker-aware initialization, renderer mode selection, or a safe MarkdownRender integration inside pages, components, or Nuxt plugins.
markstream-react
Integrate the beta markstream-react package into a React 18+ or Next app. Use when Codex needs to add the React renderer, choose the root, next, or server entrypoint, import CSS correctly, choose between content and nodes, keep client boundaries safe, add renderer-local streamingComponents or htmlComponents, use…