Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/byerlikaya/claude-starter-kitWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/commands/byerlikaya/claude-starter-kit/doctor-csk)<a href="https://agentmods.dev/commands/byerlikaya/claude-starter-kit/doctor-csk"><img src="https://agentmods.dev/badge/commands/byerlikaya/claude-starter-kit/doctor-csk/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/commands/byerlikaya/claude-starter-kit/doctor-csk"><img src="https://agentmods.dev/badge/commands/byerlikaya/claude-starter-kit/doctor-csk.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00025 | $0.00876 |
| Opus 5.5 | $0.00010 | $0.00350 |
| Sonnet 5.5 | $0.00005 | $0.00175 |
| Haiku 4.5 | $0.00003 | $0.00088 |
Grade A, and why
doctor-csk scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
/doctor-csk
Verify the kit is actually active in this project (not just present on disk):
- Run
bash .claude/eval/doctor.sh. - Read its report. It checks: VERSION present · every hook executable · the required git hooks (pre-commit,
commit-msg) present · guard-bash actually blocks a force-push (catches a hook that is present but neutered) ·
core.hooksPathpoints at.claude/hooks(else the §4.1/§4.2 commit trace + secret/bloat scan never runs) ·settings.jsonvalid and wiring the PreToolUse / UserPromptSubmit / Stop gates to non-empty hook arrays (an empty[]wires nothing); SessionStart (rehydration) is reported as a warning if absent ·./CLAUDE.mdactually imports.claude/DISCIPLINE.md— without that line the discipline sits on disk and never loads, which every other check is blind to. - For each ❌, apply the printed fix. Anything that changes git config or file permissions needs approval first — show the exact command and wait.
- Read the Readiness block too. It is advisory (never changes the verdict) and asks a different question — is this project set up to be worked on by agents: CLAUDE.md project section filled in · a project-specific skill alongside the kit's generic ones · a devcontainer to sandbox agent commands · an MCP server · CLAUDE.md not drifted behind the code. Report the gaps as suggestions, not as failures, and never "fix" them unasked — adding a devcontainer or an MCP server is the user's call.
- Summarise: healthy, or the precise fixes applied/needed, plus the readiness score. If it's not a git repo,
note that the commit-time gates need
git init+git config core.hooksPath .claude/hooks.
If .claude/eval/doctor.sh doesn't exist, this is not a full (start.sh / adopt.sh) install — the kit is likely
running as a plugin, whose hooks are managed by Claude Code itself; there's nothing for the doctor to check.
The eval scripts are installer-only, by decision. eval/ — doctor.sh, smoke-test.sh, routing-eval.sh,
scan-skill.sh, utilization.sh — ships with start.sh and adopt.sh and NOT with the plugin edition. The eval
scripts are developer instruments: they inspect an installation from outside it, and the plugin edition has no
installation to inspect. Say this plainly when someone asks why /doctor-csk reports nothing on a plugin install,
rather than treating it as a defect. The Studio panel is not in that group: both editions carry it, and
/studio-csk finds it in either. A plugin install puts no .claude/VERSION, kit.conf or kit scripts into a
project, so that project's row in the panel has no kit badge, and for the project the panel was opened from, the
inspector's gates, stats and board tabs say "Not measured" with the reason. The gates tab can still list observed
entries below that. The plugin's Bash guard logs its blocks, approval prompts and CLAUDE_GIT_OK pre-authorised
git actions, and its gate-file write guard logs its blocks, to .claude/gate-log.tsv when the project has a
.claude/ directory and the file is git-ignored or the project is not a repo. With CSK_GATE_LOG set they write
wherever it points instead, and the panel reads only the project's own .claude/gate-log.tsv, so a log sent
anywhere else does not show. The commit scan and the board gate refuse without writing a line.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago Changed · +6 lines 076a326854f0
- 1mo ago Changed · +2 lines a8e980541c36
- 1mo ago First seen · 33 lines · 25 tokens per session scan A 633da8bb7f7a
doctor-csk is a command published in the GitHub repository byerlikaya/claude-starter-kit (24 stars, last pushed 29d ago), licensed MIT. It adds 25 tokens to every session and 876 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other commands, from other repositories
workflow-classify
Classify task size (S/M/L/XL) and recommend the appropriate workflow pipeline.
pull-repos
Pull all repos (parent + marketplace clones + configured project repos).
worktree-cleanup
A command for removing a Git worktree, which is a separate working folder linked to the same repository, after its pull request is merged.
sonarqube
Analyze SonarCloud quality issues for a specific PR.
plan-start
5-phase planning command: PRD analysis, design review, technical decisions, dynamic research team, metrics. Produces a complete implementation plan + ADRs before any code is written.
refactor
Analyze code for SOLID violations and suggest targeted improvements.