Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add instructions/imbflool/cc-plugin-eval/claude-mdgit clone --depth 1 https://github.com/imbflool/cc-plugin-evalWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.03802 | $0.03802 |
| Opus 5 | $0.01901 | $0.01901 |
| Sonnet 5 | $0.00760 | $0.00760 |
| Haiku 4.5 | $0.00380 | $0.00380 |
Grade A, and why
cc-plugin-eval CLAUDE.md scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
const response = await fetch(url, { How it starts
The opening of the file, as written. The whole thing — 384 lines — stays where its author put it; the contents beside it link to each section on GitHub.
CLAUDE.md
This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
Project Overview
cc-plugin-eval is a 4-stage evaluation framework for testing Claude Code plugin component triggering. It evaluates whether skills, agents, commands, hooks, and MCP servers correctly activate when expected.
Requirements: Node.js >= 20.0.0, Anthropic API key (in .env as ANTHROPIC_API_KEY)
Commands
# Build & Dev
npm run build # Compile TypeScript to dist/
npm run dev # Watch mode
# Lint & Type Check
npm run lint # ESLint
npm run lint:fix # Auto-fix
npm run format # Prettier auto-fix
npm run format:check # Prettier check only
npm run typecheck # tsc --noEmit
# Test
npm run test # All tests (Vitest)
npm run test:watch # Watch mode
npm run test:coverage # With coverage
npm run test:ui # Visual test UI (opens browser)
# Single test file
npx vitest run tests/unit/stages/1-analysis/skill-analyzer.test.ts
# Tests matching pattern
npx vitest run -t "SkillAnalyzer"
# E2E tests (requires API key, costs money)
RUN_E2E_TESTS=true npm test -- tests/e2e/
RUN_E2E_TESTS=true E2E_MAX_COST_USD=2.00 npm test -- tests/e2e/
Test behavior: Parallel execution, randomized order, 30s timeout. CI retries failed tests twice.
Additional Linters
npx prettier --check "src/**/*.ts" "*.json" "*.md"
markdownlint "*.md"
uvx yamllint -c .yamllint.yml config.yaml .yamllint.yml
actionlint .github/workflows/*.yml
CLI Usage
cc-plugin-eval run -p ./plugin # Full pipeline
cc-plugin-eval analyze -p ./plugin # Stage 1 only
cc-plugin-eval generate -p ./plugin # Stages 1-2
cc-plugin-eval execute -p ./plugin # Stages 1-3
cc-plugin-eval run -p ./plugin --dry-run # Cost estimation only
cc-plugin-eval resume -r <run-id> # Resume interrupted run
cc-plugin-eval run -p ./plugin --fast # Re-run failed scenarios only
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 384 lines · 3,802 tokens per session scan A 759576fd692c
cc-plugin-eval CLAUDE.md is an instructions file published in the GitHub repository imbflool/cc-plugin-eval (2 stars, last pushed 2d ago), licensed MIT. It adds 3,802 tokens to every session, about $0.0190 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other instructions, from other repositories
qaskills AGENTS.md
Instructions for PramodDutta/qaskills, covering agents.md, project overview, common commands, run a single package and run tests in watch mode.
metabot CLAUDE.md
Instructions for xvirobotics/metabot: The canonical project instructions are in AGENTS.md. Follow that file for this repository. This compatibility file exists for Claude Code; MetaBot install/update does not deploy or replace workspace instruction files.
ai-api-test-skill AGENTS.md
Instructions for buer2233/ai-api-test-skill, covering agents.md, 沟通语言, 仓库性质, 文档层级(加载顺序很重要) and 项目根定位架构(最不显眼的要点).
orangepro-mcp CLAUDE.md
Instructions for OrangeproAI/orangepro-mcp, covering claude.md, what this is, commands, environment and architecture.
qaskills CLAUDE.md
Instructions for PramodDutta/qaskills, covering claude.md, what this is, conventions (non-negotiable), commands and single package.
qa-skills AGENTS.md
Instructions for petrkindlmann/qa-skills, covering agent behavior specification, skill discovery, cross-skill references, description quality and picking between overlapping skills.