Code & Engineering

CodeTour File Builder

Turns a code tour described in words, plus the list of files with their line counts, into one valid CodeTour file (JSON with a title and steps, each step holding a file, a line and a description) and nothing else. It keeps file paths relative and exactly as listed, checks every line number against the length of its file, and leaves out a step whose file is not in the list or whose line lies past the end, naming each skipped step in the description of the tour in one fixed form. A tour with only valid steps carries no mention of skipping. Use to turn a walkthrough of a code base into a tour file for the CodeTour editor extension, to draft onboarding tours, or to rebuild a tour after files were renamed.

CodeTour File Builder is a tested SKILL.md that turns a code tour described in words, plus the list of files with their line counts, into one valid CodeTour file (JSON with a title and steps, each step holding a file, a line and a description) and nothing else; an agent buys it once for $0.01 over x402.

Tested 2026-10-19No code, no hidden instructionsv1.0.0 · 5.2 KB · perpetual license

Not for

Reading the code to write better step text, tour options such as a branch reference or a primary flag, and multi-root workspaces. It sees only the request and the file list, so every step text comes from the request.

Tested, honestly

Tested 2026-10-19 with a strong and a weak model.

SonnetStrong model, claude-sonnet-5-5
Right on all 3 cases, read by hand. On a login walkthrough it kept three steps, left out the stop whose file is not in the list without guessing the similar logger file, and named it in the description in the fixed form. On a billing walkthrough it cleaned the leading dot and the backslashes, kept the steps in order and skipped only the line past the end. On a clean tour it kept the step on the last line, left out the line for the step that had none and added no description. Every answer was bare JSON.
HaikuWeak model, claude-haiku-5-5
Right on all 3 cases, read by hand. Its three answers were identical in content to the strong model: the missing file named in the fixed form, the path spellings cleaned, the last line kept and no description on the clean tour. Bare JSON each time. The inputs resemble the example inside the skill, so this is a light confirmation, not a hard test.

Full test summary

Example

Our own test text, before and after the skill ran. Excerpts only.

English · claude-sonnet-5-5

Before

Request: Make a tour called "How login works" with four stops, in this order. 1. src/routes/login.ts, line 12: the login route receives the form and calls the verifier. 2. src/auth/verify.ts, line 40: the password hash is compared here. 3. src/auth/session.ts, line 77: a session id is stored here. 4. src/audit/log.ts, line 5: every login attempt is written to the audit log. File list:…

After

{"title": "How login works", "description": "Skipped: src/audit/log.ts:5 (missing file)", "steps": [{"file": "src/routes/login.ts", "line": 12, "description": "The login route receives the form and calls the verifier."}, {"file": "src/auth/verify.ts", "line": 40, "description": "The password hash is compared here."}, {"file": "src/auth/session.ts", "line": 77, "description": "A session id is…

What is in the file

  • The input
  • The answer
  • Skipped stops
  • Rules
  • Work in this order
  • Short example

Languages

English. Tried in: English.

License

Perpetual, non-exclusive; use and modify for yourself incl. paid work; no resale or republishing. Holder: Georgi Kalchev, aiskills402.com. Full terms.

Versions

Current version 1.0.0, updated 2026-10-19. Whoever bought an earlier version gets new ones free through the same re-download token.

  1. v1.0.0 · 2026-10-19

    First release, written in the light-test batch of 19 October 2026 (three cases, price $0.01). The idea is ours; no foreign skill was opened, facts come from public documentation (see notes/ideas.md). Output: see the skill description.

    Test: three cases written by hand (two planted, each with a safe look-alike, one clean control), one run on Claude Sonnet and one on Claude Haiku, no run without the skill, no iteration on the skill text after the runs. `test/control.mjs` shows that the checks pass on the ideal answers and fail on realistic wrong ones. See `test-summary.json` for the verdicts read by hand.

FAQ

Missing file in the list: what happens to that stop?

A stop whose file is not in your list would open an error in the editor, so the skill leaves it out of the steps and names it in the tour description in one fixed form, for example Skipped: src/audit/log.ts:5 (missing file). It never swaps in a similar name from the list, and a tour with no skipped stops has no description key at all.

Is a step on the very last line of a file kept?

Yes. Lines count from 1 and the last line is valid, so line 77 of a 77-line file is a good target, while line 240 of a 200-line file is skipped as a line past the end. A stop that gives no line gets no line key.

Which requests went into the test?

The test used a login walkthrough with one file absent from the list, a billing walkthrough whose paths carry a leading dot and backslashes and whose tax stop lies past the end of its file, and a clean start-up tour with a step on the last line. Each request went once to Claude Sonnet and once to Claude Haiku; read by hand, both models matched every expectation.

What does the reply look like?

A single JSON object with no fence, no greeting and no closing remark, so a script can write it to disk unchanged. Keys of a step follow a fixed order, and the only optional top-level key is the description that lists skipped stops.

Share

Read this page as Markdown: /skills/codetour-file.md.

More in Code & Engineering

  • HTML Email Compatibility Review

    Code & Engineering

    SKILL.md · v1.0.0 · 7.4 KB

    Reviews ONE HTML email (the source of a newsletter, a receipt or a notice) for the four mistakes that make it fall apart in common mail clients, and lists only those, one line each with a fixed code, the place, which client breaks it and the fix - or exactly No findings. It catches flex or grid used to lay out columns, layout rules that exist only in a style block in the head, images with no alt attribute, and a CSS background image with no colour fallback behind the text. It leaves out the safe look-alikes, such as a style block used only for media queries and an empty alt on a decorative spacer. Use before an email goes to a sending tool, to audit a template someone else built, or to find out why a message looks broken in Outlook for Windows or in a webmail that strips styles.

    $0.01once

    • x402
    • USDC
    • Base
    Get skill

    Tested with Sonnet and Haiku, 19 Oct 2026

  • Stripe Webhook Review

    Code & Engineering

    SKILL.md · v1.0.0 · 8.0 KB

    Reviews ONE Stripe webhook handler (the route code, in any language or framework) for the five mistakes that let a forged or repeated event move money, grant access or ship goods, and lists only those, one line each with a fixed code, the place, why it is dangerous and the fix - or exactly No findings. It catches a body parsed or re-serialized before the signature is checked, a handler that never checks the signature, a recency tolerance switched off or set huge, no record of event ids so a retry repeats the side effect, and slow work done before the 2xx answer. It leaves out the safe look-alikes, such as a raw body kept on the webhook route while the other routes parse JSON, and the default tolerance. Use to review a webhook route before going live, to audit one that someone else wrote, or to find out why signature checks fail or orders are fulfilled twice.

    $0.01once

    • x402
    • USDC
    • Base
    Get skill

    Tested with Sonnet and Haiku, 19 Oct 2026

  • GitHub Actions Security Review

    Code & Engineering

    SKILL.md · v1.0.0 · 8.3 KB

    Reviews ONE GitHub Actions workflow file (YAML) for the five mistakes that let an outsider run code or read secrets in your pipeline, and lists only those, one line each with a fixed code, the place, why it is dangerous and the fix - or exactly No findings. It catches text from an issue, pull request, comment or branch name pasted straight into a shell step, a pull_request_target or workflow_run job that checks out and runs the code of the pull request, a third-party action pinned to a tag or branch instead of a full commit hash, a missing or too wide permissions block, and a secret that is printed or handed to code you do not control. It leaves out the safe look-alikes, such as untrusted text passed through an env variable and quoted, or first-party actions pinned to a version tag. Use to review a workflow before merging it, to audit the pipelines of a repository, or to gate a pull request that edits a workflow file.

    $0.01once

    • x402
    • USDC
    • Base
    Get skill

    Tested with Sonnet and Haiku, 19 Oct 2026

  • API Breaking Change Check for OpenAPI

    Code & Engineering

    SKILL.md · v1.0.1 · 10.7 KB

    Compares two versions of one API description (OpenAPI 3.0 or 3.1 in YAML or JSON, or two JSON Schemas of one request or response) and lists ONLY the changes that break clients written against the old version, one line each with a fixed code, the place, old and new, and who breaks - or exactly No breaking changes. The skill judges by direction - a request may widen safely and breaks when it narrows, a response may narrow safely and breaks when it widens - and it follows each $ref and allOf to the operations that use it, so a change made only in a shared schema is still found, while a renamed path variable, a new optional field, a reformatted file and a field moved between allOf branches are left out. Use to check an API change before release, review a pull request that edits an OpenAPI file, or gate a pipeline on breaking changes.

    $0.03once

    • x402
    • USDC
    • Base
    Get skill

    Tested with Sonnet and Haiku, 18 Oct 2026