Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add instructions/flasherses/claude-code-dotfiles/claude-mdgit clone --depth 1 https://github.com/flasherses/claude-code-dotfilesWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.01368 | $0.01368 |
| Opus 5 | $0.00684 | $0.00684 |
| Sonnet 5 | $0.00274 | $0.00274 |
| Haiku 4.5 | $0.00137 | $0.00137 |
Grade B, and why
claude-code-dotfiles CLAUDE.md scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Reads agent configuration directoriesmediumAgent snooping
.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.
- 修改 `~/.claude/settings.json` 或任何 `.env` 文件 How it starts
The opening of the file, as written. The whole thing — 110 lines — stays where its author put it; the contents beside it link to each section on GitHub.
CLAUDE.md — Universal Engineering Template
Personal Preferences
- OS: OS (e.g., Windows 11 / macOS 15 / Ubuntu 24)
- Shell: SHELL (e.g., PowerShell / bash / zsh)
- Editor: EDITOR (e.g., VS Code / IDEA / Neovim)
- Primary Language: LANG (e.g., Java / Python / TypeScript / Go)
- Path Convention: PATH_CONVENTION (forward slash
/recommended for portability)
Language & Communication
- 中文为主要沟通语言，代码、技术术语、CLI 命令保持英文
- 直接简洁，不寒暄。用表格做对比时表头用中文
- 解释用 WHY 而非 WHAT — 告诉我为什么这样做，不要描述代码本身做了什么
- 给出明确建议而非选项列表（"推荐 X，因为 Y" 而非 "A 可以、B 也行"）
Coding Style
- 不写废话注释 — 代码自解释，只写 WHY 不写 WHAT
- 不过度抽象 — 3 行重复好过一个不成熟的抽象
- 不引入未使用的依赖
- 优先级: 安全 > 正确性 > 性能 > 可读性 > 简洁
- 不写 feature flag、不写向后兼容 shim — 直接改代码
- 不做过度的错误处理 — 只处理系统边界（用户输入、外部 API），不处理内部不可能发生的场景
- 遵循项目现有命名约定。布尔变量用
is_/has_/should_前缀
Forbidden Zones
以下操作必须先问再动：
- 修改
~/.claude/settings.json或任何.env文件 git commit/git push/git rebase- 全局安装 npm/pip 包
- 删除文件 — 优先重命名为
.deprecated后缀 - 修改当前工作目录外的文件
Development Workflow
需求分析 → 开发文档 → 测试文档 → 实施代码。每阶段确认后才进入下一阶段。
适用范围：新增功能、重构、线上风险修复、数据库/API/权限相关改动必须走完整四阶段。小型文档修改、格式修正、注释修正、一次性脚本、配置示例调整可简化为：确认范围 → 修改 → 自检。
三种工作模式
| 模式 | 触发条件 | 目录 | 阶段数 |
|---|---|---|---|
| Feature | 用户可见新功能 | docs/features/<YYYY-MM-DD>-<slug>/ |
1→2→3→4 |
| Change | 重构/基础设施/权限升级 | docs/changes/<YYYY-MM-DD>-<slug>/ |
1→2→4 |
| Hotfix | 线上紧急修复 | docs/changes/<YYYY-MM-DD>-hotfix-<slug>/ |
定位→修复→验证 |
| Reference | 项目参考/规范/手册/踩坑记录 | docs/reference/ |
无（直接撰写） |
四阶段产出路径
| 阶段 | 产出 | 文件路径 |
|---|---|---|
| 1. 需求分析 | PM对齐问题清单（可选） | docs/features/<date>-<slug>/00-questions.md |
| 2. 开发文档 | 设计文档 | docs/features/<date>-<slug>/01-design.md |
| 3. 测试文档 | 测试用例 + 自测清单 + 测试脚本 | 02-test-cases.md + 03-自测清单.md + 04-test.ps1 |
| 4. 实施代码 | 测试报告 + 自测报告 | 05-测试报告.md + 06-自测报告.md |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 110 lines · 1,368 tokens per session scan B e18782cdcc17
claude-code-dotfiles CLAUDE.md is an instructions file published in the GitHub repository flasherses/claude-code-dotfiles (5 stars, last pushed 23d ago), licensed MIT. It adds 1,368 tokens to every session, about $0.0068 per session on Opus 5. A static security scan graded it B with 1 finding (reads agent configuration directories). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other instructions, from other repositories
vscode buildNext.instructions.md
Working notes and architecture documentation for the new esbuild-based build system in build/next. Use when making changes to the new build pipeline (transpile/bundle commands, NLS plugin, source-map handling, resource copying, or self-hosting watch tasks).
spec-kit AGENTS.md
AGENTS.md instructions for github/spec-kit, covering agents.md, about spec kit and specify, quickstart — add a new integration in 5 steps, integration architecture and integrationmanifest — file tracking.
codex AGENTS.md
AGENTS.md instructions for openai/codex, covering rust/codex-rs, the codex-core crate, code review rules, crate api surface and model visible context.
langchain AGENTS.md
AGENTS.md instructions for langchain-ai/langchain, covering global development guidelines for the langchain monorepo, corridor security analysis, project architecture and context, monorepo structure and development tools & commands.
vscode oss-third-party-notices.instructions.md
Instructions for microsoft/vscode, covering vs code oss third-party-notices pipeline, architecture, pipeline flow in ci, applying the notice (cutover) and fallback chain (never fail the build).
next.js AGENTS.md
Instructions for vercel/next.js, covering next.js development guide, codebase structure, monorepo overview, core package: packages/next and other important packages.