Borrowing it
Nothing to install: this file belongs to ldbumble/taskuary. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/ldbumble/taskuary/master/CLAUDE.mdgit clone --depth 1 https://github.com/ldbumble/taskuaryWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/instructions/ldbumble/taskuary/claude-md)<a href="https://agentmods.dev/instructions/ldbumble/taskuary/claude-md"><img src="https://agentmods.dev/badge/instructions/ldbumble/taskuary/claude-md/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/instructions/ldbumble/taskuary/claude-md"><img src="https://agentmods.dev/badge/instructions/ldbumble/taskuary/claude-md.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00668 | $0.00668 |
| Opus 5.5 | $0.00267 | $0.00267 |
| Sonnet 5.5 | $0.00134 | $0.00134 |
| Haiku 4.5 | $0.00067 | $0.00067 |
Grade A, and why
taskuary CLAUDE.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 53 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Working in this repository
Never commit the owner's own data
This repository is public. It is also built by reading one person's real mail, so the pull is constant: the quickest way to write a test for a bug is to paste the message that caused it, and the clearest way to explain a fix is to name the people in it. Both put a private thing somewhere it cannot be taken back from — a commit message, a fixture, a comment, a screenshot.
None of it goes in. Not in code, tests, fixtures, docs, comments, commit messages, or images:
- names of colleagues, senders, residents, patients or customers
- company names, facility names and numbers, internal repository names
- mailbox addresses and the domains around them
- what a real thread actually said, where it identifies the people in it
- anything a divestiture, a contract or a salary could be read out of
What a bug NEEDS is its shape — a forwarded chain, a report that repeats, two mails in one poll. Write that, with invented people. A test reads better for it, and the failure it pins is the same.
The stand-ins this repository already uses
Addresses use RFC 2606's reserved names — *.example, example.com, .test, .invalid — and
nothing else. tests/test_demo.py::test_nobody_real_is_in_it enforces that for the demo world, and
it asserts the invariant rather than naming any real domain, which is the pattern to copy: a guard
that spells out the thing it guards against has published it.
| for | use |
|---|---|
| the owner | Alex Doyle, [email protected] |
| their company | Northwind, northwind.example |
| colleagues | Erin Blake, Gail Moreno, Paula Vance, Ray Colton, Marcus Reed, Omar Keller |
| a vendor | vendor.example, Payworth, Trainly, Spendly, PhishGuard |
| repositories | northwind/ledger, northwind/portal, org/app |
The one exception is the connector catalogue (taskuary/connectorcatalog.json,
website/src/logos.jsx, docs/site/connections.md, the keyword list in taskuary/reports.py).
Naming PointClickCare, ADP, Epic or Cerner there says what this app can connect to. That is a
feature of the product, not a fact about its owner.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 53 lines · 668 tokens per session scan A 57632acbc73e
taskuary CLAUDE.md is an instructions file published in the GitHub repository ldbumble/taskuary (143 stars, last pushed today), licensed MIT. It adds 668 tokens to every session, about $0.0027 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-23.
Other instructions, from other repositories
vscode buildNext.instructions.md
Working notes and architecture documentation for the new esbuild-based build system in build/next. Use when making changes to the new build pipeline (transpile/bundle commands, NLS plugin, source-map handling, resource copying, or self-hosting watch tasks).
next.js AGENTS.md
AGENTS.md instructions for vercel/next.js, covering next.js development guide, codebase structure, monorepo overview, core package: packages/next and other important packages.
vscode oss-third-party-notices.instructions.md
Instructions for microsoft/vscode, covering vs code oss third-party-notices pipeline, architecture, pipeline flow in ci, cache eligibility and rollout and applying the notice (cutover).
langchain AGENTS.md
AGENTS.md instructions for langchain-ai/langchain, covering global development guidelines for the langchain monorepo, corridor security analysis, project architecture and context, monorepo structure and development tools & commands.
vscode copilot-instructions.md
Copilot instructions for microsoft/vscode, covering vs code copilot instructions, project overview, root folders, core architecture (src/ folder) and built-in extensions (extensions/ folder).
vscode model-prompts.instructions.md
Model-specific prompt authoring and registry guidelines.