Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add ZaxbyHub/opencode-swarm --skill safe-extractiongit clone --depth 1 https://github.com/ZaxbyHub/opencode-swarmWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/zaxbyhub/opencode-swarm/safe-extraction)<a href="https://agentmods.dev/skills/zaxbyhub/opencode-swarm/safe-extraction"><img src="https://agentmods.dev/badge/skills/zaxbyhub/opencode-swarm/safe-extraction/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/zaxbyhub/opencode-swarm/safe-extraction"><img src="https://agentmods.dev/badge/skills/zaxbyhub/opencode-swarm/safe-extraction.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00060 | $0.02429 |
| Opus 5.5 | $0.00024 | $0.00972 |
| Sonnet 5.5 | $0.00012 | $0.00486 |
| Haiku 4.5 | $0.00006 | $0.00243 |
Grade A, and why
safe-extraction scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Runs shell commandslowCapability
Expected in a hook, worth knowing in a rule or an instructions file.
- **subprocess-safety**: Relevant if the extracted code calls spawn/spawnSync — ensure the _internals proxy preserves timeout/kill semantics. How it starts
The opening of the file, as written. The whole thing — 259 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Safe Extraction Protocol
Follow every step in order. Do not skip steps.
When to use this skill
- A source file exceeds team-agreed size thresholds (this repo uses <2000 lines per file per FR-005) and needs splitting
- A subsystem (destructive-command, worktree-isolation, etc.) is being extracted to its own file
- Code is being moved from one module to another without changing behavior
Benefit: Prevents the three most common extraction failure modes:
- CI invariant check failures (new file paths not in allowlists)
- Broken _internals DI seams (test mocks stop working)
- Cross-file test regressions (other test files that consume the module)
Step 0 — Pre-extraction audit
Before moving ANY code, inventory every path-scoped artifact that references the source file:
0a. CI invariant scripts
grep -rn "<source-file-path>" scripts/ .github/workflows/
Check:
LEGACY_EXEMPTSarrays (e.g.,check-invariants.sh)- Path-scoped lint/scan configurations
- GitHub Actions path filters
0b. Mock allowlists
grep -rn "<source-file-path>" scripts/mock-allowlist.txt
0c. Test file inventory
grep -rln "from.*<source-module>" src/ tests/ --include="*.test.ts"
grep -rln "vi.spyOn.*<source-module>" src/ tests/ --include="*.test.ts"
grep -rln "_internals.*<source-module>" src/ tests/ --include="*.test.ts"
Record EVERY test file that imports or spies on the source module. These must all pass after extraction.
Prefer the imports tool or repo_map action for comprehensive consumer discovery. Grep catches direct string matches but misses require() imports, dynamic import(), and re-exports through intermediate modules. Use grep as a secondary cross-check.
0d. Import graph
Use the imports tool or repo_map to find all consumers of exports from the source file.
Step 1 — Create the extracted module
- Move the code block(s) to the new file(s)
- Move all supporting types, constants, and helper functions used exclusively by the extracted code
- Add necessary imports to the new file (from external dependencies)
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 6d ago Changed · +1 lines ab05f1e5b892
- 1mo ago First seen · 258 lines · 60 tokens per session scan A 9d75695485f5
safe-extraction is a skill published in the GitHub repository ZaxbyHub/opencode-swarm (508 stars, last pushed today), licensed MIT. It adds 60 tokens to every session and 2,429 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 1 finding (runs shell commands). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
e2e-testing
Guide for running end-to-end tests of the Qwen Code CLI, including headless mode, MCP server testing, and API traffic inspection. Use this skill whenever you need to verify CLI behavior with real model calls, reproduce user-reported bugs end-to-end, test MCP tool integrations, or inspect raw API request/response…
agent-reproduce-align
Use after a Codex or Claude Code feature has been implemented in Qwen Code to run the selected reference agent and Qwen Code under the same scenario, capture HTTP and terminal traces, compare request bodies, tool/function schemas, outputs, and iterate until the reproduced behavior is close enough.
create-issue
Draft and submit a GitHub issue from a user idea or bug description, with bilingual body and correct labels.
codew-release-qa-sweep
Use before claiming Codewhale release work is done: run the full gate sweep and list the manual QA targets.
docs-update-from-diff
Review local code changes with git diff and update the official docs under docs/ to match. Use when the user asks to document current uncommitted work, sync docs with local changes, update docs after a feature or refactor, or when phrases like "git diff", "local changes", "update docs", or "official docs" appear.
prepare-pr
Prepare GitHub pull request title and body files from the current branch diff, especially for non-interactive CI/autofix flows that must follow the repository PR template without pushing or creating the PR.