Borrowing it
Nothing to install: this file belongs to maojiebc/majia-Popskill. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/maojiebc/majia-Popskill/main/CLAUDE.mdgit clone --depth 1 https://github.com/maojiebc/majia-PopskillWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/instructions/maojiebc/majia-popskill/claude-md)<a href="https://agentmods.dev/instructions/maojiebc/majia-popskill/claude-md"><img src="https://agentmods.dev/badge/instructions/maojiebc/majia-popskill/claude-md.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.14202 | $0.14202 |
| Opus 5 | $0.07101 | $0.07101 |
| Sonnet 5 | $0.02840 | $0.02840 |
| Haiku 4.5 | $0.01420 | $0.01420 |
Grade A, and why
majia-Popskill CLAUDE.md scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
2. **`security find-identity` 0 valid** — 缺 Developer ID G2 intermediate，`curl https://www.apple.com/certificateauthority/DeveloperIDG2CA.cer | security import -` How it starts
The opening of the file, as written. The whole thing — 235 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Popskill — Project Notes for Claude
项目快照 — 让任何 Claude Code session 在这个目录下都能 5 秒 catch up。
二级交互重构（2026-09-05，PR #8）
本节覆盖下文旧版“设置/CLI 弹层”描述。主屏矩阵不变；维护中心是主窗口内的二级页面（技能来源 / Agent CLI），设置使用共享同一 AppModel 的原生 Settings 场景，固定为工具 / 自动维护 / 数据与恢复 / 关于。添加和系统后台任务使用原生 sheet，不再使用自绘遮罩。
MaintenanceState.swift保存会话视图状态、授权范围和实际动作收据，不存第二份库存。OperationReport.swift保存最后批次结果；排队/运行/失败/版本未确认必须区分。MaintenanceIO.swift：打开页面仅本地盘点；过滤不联网；显式检查使用当前授权范围，不因打开页面扩大包名外发范围。SettingsView.swift：新来源默认策略与应用现有来源是两个动作。禁止恢复之前被撤回的永久 known-ID 并集。CliSheet.swift现为MaintenanceView；菜单/⌘J 与主屏都进入同一页面，⌘, 走系统设置。来源详情和搜索上下文留在共享 session。- CLI 升级前复核同一安装身份，命令后重新盘点实测版本，不把目标版本伪装成已安装。保持原有队列、StoreFS、跨进程锁及恢复保护。
SecondaryUISnapshotTests通过POPSKILL_UI_SNAPSHOT_DIR/POPSKILL_UI_SNAPSHOT_LANG显式启用，CI 保存中文与英文原生截图；未执行的用户实机交互不得报为已验收。- 设计与验收：
docs/design/secondary-ui-2026-09-05.md。安装进行中不能关闭 sheet 清掉 staging；同名恢复明确拒绝，不承诺直接回滚。
是什么（v2，2026-06-10 推倒重来）
Popskill v2 = 本地 AI 能力管理器。在 ~/.agents/ 维护一份能力仓库（store，按类型分 skills/ agents/ mcp/ bin/），通过 symlink 把每项能力挂载到多个 AI 工具（Claude Code ~/.claude/、Codex CLI ~/.codex/）。
核心场景一句话：技能装一次，挂到多个 AI 工具上；坏了能修，旧了能升。
产品页面：能力矩阵 + 主窗口内维护中心 + 原生 Settings 窗口；添加 / 系统后台任务使用原生短任务 sheet，保留行内修复与详情 peek。当前二级交互以 docs/design/secondary-ui-2026-09-05.md 为准。
- 设计真源：
docs/design/v2-handoff/（原始包）+v2-handoff-patch-01/（详情 peek）+v2-handoff-patch-02/（当前定稿：绿激活色语义/默认折叠/键盘导航/套装 tokens/列对齐，SPEC.md 以此为准） - v1（sidecar + cc-switch + 6 目的地账本）止于 tag
v1.1.0，复盘见docs/history/PLAN-v1.md与PLAN-v2.md
公开 repo：https://github.com/maojiebc/majia-Popskill
v2 架构（纯 Swift，无 sidecar，无数据库）
swift-app/Sources/Popskill/
├── PopskillApp.swift @main + RootView（窗口外壳/键盘监听/Sparkle）
├── Theme.swift 账本视觉令牌（暖纸 #fafaf8 / 墨黑 #111 / 电光蓝 #1f4ed8）
├── Models.swift Entry/Capability/LinkStatus/Tool + 派生(stats/issues/updates)
├── StoreFS.swift 文件系统引擎：扫描/链接读写/安装/回收站（核心，全部单测覆盖）
├── StoreProcessLock.swift 跨进程 store 写锁（flock + 同进程可重入；崩溃自动释放）
├── AppModel.swift @MainActor @Observable 单 store + 全部动作
├── ChromeViews.swift 标题栏/状态栏/tag/单元格/pill/toast
├── MainView.swift 主屏：hero/健康横幅/类型chip/卡片网格/空态
├── FixPopover.swift 行内修复弹层（锚定单元格）
├── DetailPeek.swift 详情 peek（PATCH-01：点能力名称，380 宽，与修复弹层互斥）
├── Sheets.swift 添加（URL→安装计划）+ 设置
├── Sched.swift 定时任务引擎（v2.9 引入 v2.10 重做：plist/cron 解析 + next-fire 计算 + 日志 mtime 推上次运行 + launchctl 操作）
├── SchedSheet.swift 定时任务弹层（◷ / ⌘J；行为分组/倒计时排序/人话备注；写操作 NSAlert 确认）
├── Localization.swift L() 取词 + 显式语言协商 + l10nLocale（v2.12，详见「本地化」节）
├── StoreWatch.swift FSEvents 监听器（v2.15：store/工具目录外部变更秒级自动重扫）
├── CliInventory.swift CLI 白名单 / 多前缀 / brew·pipx·uv 纯函数（v2.20）
├── NpmSource.swift npm 源 + 按前缀升级全局 CLI
├── ToolRegistry.swift 工具列注册表（Claude/Codex/Cursor 常显，其余设置里开）
├── WorkMode.swift 工作模式快照 / 最小差异切换（v2.20）
├── Resources/ {zh-Hans,en}.lproj（gen-l10n.sh 从 l10n/ 目录预编译，提交进库）
└── Fixtures.swift 原型样例数据（POPSKILL_FAKE_DATA=1）
swift-app/l10n/Localizable.xcstrings 本地化权威源（人/AI 只编辑这一个文件）
Tests/PopskillTests/StoreFSTests.swift 引擎测试 + RealEnvSmoke 只读冒烟
Tests/PopskillTests/AppModelTests.swift 纯逻辑测试（修复推荐矩阵/键盘状态机）
Tests/PopskillTests/SchedTests.swift 定时任务解析测试（plist/cron/launchctl 全 fixture，不碰真系统）
Tests/PopskillTests/StoreWatchTests.swift FSEvents 触发/幂等 + AppModel 全链集成（外部进程写）
Tests/PopskillTests/WorkModeTests.swift 工作模式快照/差异纯函数
Tests/PopskillTests/MatrixLayoutTests.swift 折叠套装网格打包（展开才通栏）
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- today Changed · +42 tokens per session bdc2c4716a22
- 2d ago Changed · +16 lines · +608 tokens per session 10a9224a11d4
- 7d ago First seen · 219 lines · 13,552 tokens per session scan A a69691c27ed6
majia-Popskill CLAUDE.md is an instructions file published in the GitHub repository maojiebc/majia-Popskill (3 stars, last pushed yesterday), licensed MIT. It adds 14,202 tokens to every session, about $0.0710 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other instructions, from other repositories
codex AGENTS.md
AGENTS.md instructions for openai/codex, covering rust/codex-rs, the codex-core crate, code review rules, crate api surface and model visible context.
vscode buildNext.instructions.md
Working notes and architecture documentation for the new esbuild-based build system in build/next. Use when making changes to the new build pipeline (transpile/bundle commands, NLS plugin, source-map handling, resource copying, or self-hosting watch tasks).
next.js AGENTS.md
AGENTS.md instructions for vercel/next.js, covering next.js development guide, codebase structure, monorepo overview, core package: packages/next and other important packages.
langchain AGENTS.md
AGENTS.md instructions for langchain-ai/langchain, covering global development guidelines for the langchain monorepo, corridor security analysis, project architecture and context, monorepo structure and development tools & commands.
vscode oss-third-party-notices.instructions.md
Instructions for microsoft/vscode, covering vs code oss third-party-notices pipeline, architecture, pipeline flow in ci, applying the notice (cutover) and fallback chain (never fail the build).
spec-kit AGENTS.md
AGENTS.md instructions for github/spec-kit, covering agents.md, about spec kit and specify, quickstart — add a new integration in 5 steps, integration architecture and integrationmanifest — file tracking.