Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/byerlikaya/claude-starter-kitnpx agentmods add commands/byerlikaya/claude-starter-kit/skill-cskWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/commands/byerlikaya/claude-starter-kit/skill-csk)<a href="https://agentmods.dev/commands/byerlikaya/claude-starter-kit/skill-csk"><img src="https://agentmods.dev/badge/commands/byerlikaya/claude-starter-kit/skill-csk/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/commands/byerlikaya/claude-starter-kit/skill-csk"><img src="https://agentmods.dev/badge/commands/byerlikaya/claude-starter-kit/skill-csk.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00024 | $0.00979 |
| Opus 5 | $0.00012 | $0.00490 |
| Sonnet 5 | $0.00005 | $0.00196 |
| Haiku 4.5 | $0.00002 | $0.00098 |
Grade A, and why
skill-csk scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 61 lines — stays where its author put it; the contents beside it link to each section on GitHub.
/skill-csk
AGENT_TEMPLATE.md states the contract for a component. It ships with a start.sh install — adopt.sh and the
plugin edition do not carry it. The discipline names it in passing, but no gate checks that anyone reaches it:
§3b iterates skills and agents only, so this doc can go stale unread. This command is the deliberate route, and
it ends in the gates rather than in a claim.
A component is not finished when it is written. It is finished when the suite says so.
1. Decide the shape before writing anything
Read .claude/AGENT_TEMPLATE.md. Then answer, in one line each:
- What is the smallest form that works? A rule in an existing skill's body beats a new skill; a new skill beats a new agent. Every new skill costs its NAME in every session, forever, for every user — and its description too, until the listing overflows its budget, at which point descriptions start being dropped from the skills you invoke least. Say what that buys.
- Who reaches it? An agent, a command, or the discipline's trigger map. If the answer is "the model will notice the description", stop — that is the dark component §3b exists to catch.
- Read or write? A component that reports and a component that changes files do not belong together: different risk, different done-criterion. Split them.
- Is it stack-neutral? Anything shipped to every profile names no language, framework or vendor as the case. The example you have in mind is not the scope.
2. Write it
- Skill:
.claude/skills/<name>/SKILL.md— the directory name and thename:field must match. Keep the body lean; depth goes toreferences/*.mdand is loaded on demand. - Agent: a thin trigger — who and when. The how lives in the skill it applies; do not copy the method in.
- The
descriptionsays when to reach for this, not what its author knows.
3. Register it — the cascade, in this order
Skipping one of these is how a component ships half-installed:
- Route it. Name it in an agent body, a command, or the trigger map. §3b checks exactly this.
- Golden case. Add a positive line to
.claude/eval/golden-routing.txt— and a negative one (prompt|!target) for a neighbour it must NOT steal. - Catalog + counts (kit repository only —
packaging/is not installed anywhere).bash packaging/build-readme-catalog.sh(both READMEs), and the network diagram if the component set changed:python3 packaging/gen-network.py assets— the target directory is an argument; without it the SVGs land in the current directory andassets/silently stays stale. - Plugin edition (kit repository only).
bash packaging/build-plugin.sh— in the same commit, or the release stops at the sync gate. - Budget. A new skill moves
BUDGET_SKILLS; raise it in the same commit with the justification comment the file's convention requires. Never raise it to make a red gate green without saying why.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 61 lines · 24 tokens per session scan A 6f5aec46244a
skill-csk is a command published in the GitHub repository byerlikaya/claude-starter-kit (22 stars, last pushed today), licensed MIT. It adds 24 tokens to every session and 979 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other commands, from other repositories
auto
An automated coding workflow runs a software task from planning through code changes, checks, and a pull request. A pull request is a proposed change for review before it is merged into the main codebase.
sync
A command that pulls the latest code from the main Git branch and updates the project's key planning and instruction documents to match it.
next-task
A command that checks a coding project and prepares the next task. It reads project notes, Git history, changed files, and task checkboxes to find progress and the next unfinished work.
guide
An interactive beginner's guide for Claude Forge that checks whether a project, its rules file, and Git are ready, then suggests common next steps.
suggest-automation
A command that reviews recent Git commits and project instructions to find work patterns that happen repeatedly.
eval
Manage eval-driven development workflow (define, check, report, list).