Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add commands/aaronsb/claude-code-config/project-initgit clone --depth 1 https://github.com/aaronsb/claude-code-configWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00043 | $0.05421 |
| Opus 5 | $0.00022 | $0.02710 |
| Sonnet 5 | $0.00009 | $0.01084 |
| Haiku 4.5 | $0.00004 | $0.00542 |
Grade B, and why
project-init scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Reads agent configuration directoriesmediumAgent snooping
.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.
find .claude/ways -name "*.md" ! -name "*.check.md" -exec echo "Found: {}" \; How it starts
The opening of the file, as written. The whole thing — 532 lines — stays where its author put it; the contents beside it link to each section on GitHub.
/project-init: Software Engineering Scaffold Workshop
You are a project setup workshop. The human has invoked /project-init to establish or repair software engineering practices in a repository. This session is now dedicated to that work.
This is a session-consuming command. Expect to use the full context window.
First thing you do: create a task list. Before reading docs, before detecting state, before asking questions — create tasks with TaskCreate for your own phases:
- Read background docs (migration way, GitHub way, docs way)
- Detect project state
- Interview the user
- Create detailed execution tasks from interview results
- Execute scaffold work
- Validate and deliver PR
Mark each task in_progress as you start it, completed when done. This is your spine — when context gets long, the task list tells you where you are. Update task descriptions with decisions and findings as you go so they survive compaction.
Task 4 is critical. When you complete the interview, your next action is to create the real execution tasks — one per elected concern (e.g., "Install ADR tooling", "Create CODEOWNERS with agent mapping", "Scaffold runbook templates"). These tasks replace the generic "Execute scaffold work" with the actual work plan derived from what the user chose. Do not skip this step and start building. The task list is the plan.
Before You Start
Read these docs first — you need the full landscape before your first question:
- Read
~/.claude/hooks/ways/softwaredev/architecture/adr/migration/migration.md— understand the five starting states (greenfield, flat directory, inline metadata, scattered, different tool) and migration strategies - Read
~/.claude/hooks/ways/softwaredev/delivery/github/github.md— understand PR-always stance, repo health expectations - Read
~/.claude/hooks/ways/softwaredev/docs/docs.md— understand documentation scaling by project complexity
Do NOT skip this step. You need the migration framework and repo health model loaded.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 532 lines · 43 tokens per session scan B 03888524714e
project-init is a command published in the GitHub repository aaronsb/claude-code-config (18 stars, last pushed 4mo ago), licensed MIT. It adds 43 tokens to every session and 5,421 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it B with 1 finding (reads agent configuration directories). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other commands, from other repositories
riskreview
The user invoked the /riskreview facade command from the risk-review-pipeline pack.
nyann:diff-profile
Compare two nyann profiles side-by-side and show what changes between them: hooks, branching, CI, documentation, extras, governance. Useful before switching profiles to understand the impact.
nyann:hotfix
Create the branch topology for a patch release against a previously tagged version. Ensures release/ . exists from the source tag, then creates hotfix/ off it. After this, the user commits the fix and runs /nyann:release from the hotfix branch.
nyann:ship
Open a GitHub pull request AND merge it in one step. Default uses GitHub's native auto-merge (returns immediately with outcome:"queued"); --client-side polls for green CI in the foreground then runs gh pr merge. Requires gh installed + authed.
nyann:learn-profile
Inspect a reference repo and save its nyann-relevant setup (stack, hooks, branching, commit convention, extras) as a reusable profile.
sicario.verify
Run deterministic verification.