Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add instructions/paulduvall/claude-code/claude-mdgit clone --depth 1 https://github.com/PaulDuvall/claude-codeWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.04223 | $0.04223 |
| Opus 5 | $0.02112 | $0.02112 |
| Sonnet 5 | $0.00845 | $0.00845 |
| Haiku 4.5 | $0.00422 | $0.00422 |
Grade A, and why
claude-code CLAUDE.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 359 lines — stays where its author put it; the contents beside it link to each section on GitHub.
CLAUDE.md
This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
Project Overview
Claude Code Custom Commands is a comprehensive collection of 45 custom slash commands for Claude Code that accelerate software development workflows through AI-powered automation. These commands provide intelligent automation for every stage of the software development lifecycle, from planning and architecture to deployment and monitoring.
Core Philosophy
This project focuses on creating defensive security tools and development workflow automation. Each command leverages AI to analyze codebases and provide contextual assistance while maintaining security best practices.
Key Principles:
- Security-First: All commands focus on defensive security and safe development practices
- Workflow Automation: Streamline repetitive development tasks with intelligent automation
- Comprehensive Coverage: Support the entire software development lifecycle
- Quality Assurance: Maintain high code quality through automated checks and validations
- Documentation-Driven: Every command is thoroughly documented with usage examples
All commands are designed to enhance developer productivity while maintaining security and quality standards.
Repository Structure
claude-code/
├── CLAUDE.md # This file - project guidance
├── README.md # Main project documentation
├── setup-devcontainer.sh # Devcontainer setup script
├── claude-dev-toolkit/ # NPM package (distributable toolkit)
│ ├── package.json # NPM package manifest
│ ├── bin/claude-commands # CLI entry point
│ ├── lib/ # JavaScript modules
│ ├── scripts/ # Install/publish scripts
│ ├── commands/ # Synced command copies for npm
│ ├── hooks/ # Synced hook copies for npm
│ ├── subagents/ # Synced subagent copies for npm
│ ├── templates/ # Synced template copies for npm
│ └── tests/ # NPM package tests
├── docs/ # Documentation directory
│ ├── claude-custom-commands.md # Command reference guide
│ ├── claude-code-hooks-system.md # Hooks architecture documentation
│ ├── debug-context.md # Debug context management
│ ├── devcontainer-guide.md # Devcontainer guide
│ ├── manual-uninstall-install-guide.md # Installation/uninstallation guide
│ ├── npm-distribution-plan.md # NPM distribution strategy
│ ├── npm-package-guide.md # Published package information
│ ├── subagent-hook-integration.md # Subagent integration docs
│ ├── npm-only/ # NPM consolidation migration guides
│ ├── plans/ # Implementation plans
│ └── publish/ # Blog articles
├── hooks/ # Hook implementations (10 shell + 14 Python)
│ ├── file-logger.sh # File operation logging
│ ├── on-error-debug.sh # Error debugging hook
│ ├── pre-commit-quality.sh # Pre-commit quality checks
│ ├── pre-commit-test-runner.sh # Auto-detect and run tests
│ ├── pre-write-security.sh # Pre-write security validation
│ ├── prevent-credential-exposure.sh # Credential exposure prevention
│ ├── subagent-trigger.sh # Subagent trigger hook (--simple for lightweight mode)
│ ├── tab-color.sh # Terminal tab colorization
│ ├── verify-before-edit.sh # Warn about fabricated references
│ ├── claude-wrapper.sh # Claude wrapper script
│ └── lib/ # Hook support libraries (15 shell modules + 1 config)
│ ├── hook-helpers.sh # Shared helpers for standalone hooks
│ ├── config-constants.sh # Configuration constants
│ ├── file-utils.sh # File utility functions
│ ├── error-handler.sh # Error handling and logging
│ ├── argument-parser.sh # CLI argument parsing
│ ├── context-manager.sh # Context orchestrator (thin)
│ ├── context-gathering.sh # Context data gathering
│ ├── context-file-ops.sh # Context file I/O and validation
│ ├── execution-engine.sh # Subagent execution engine
│ ├── execution-simulation.sh # Execution simulation
│ ├── execution-results.sh # Result processing
│ ├── subagent-discovery.sh # Subagent discovery
│ ├── subagent-validator.sh # Subagent validation
│ ├── field-validators.sh # Field validation
│ ├── validation-reporter.sh # Validation reporting
│ └── credential-patterns.conf # Credential detection patterns
├── lib/ # Shared utility libraries
│ └── logging.sh # Logging utilities
├── scripts/ # Build and deployment scripts
│ ├── sync-to-npm.sh # Sync source files to npm package
│ ├── deploy-subagents.sh # Subagent deployment
│ ├── generate-command-docs.sh # Auto-generate command docs
│ ├── setup-hooks.sh # Hook installation script
│ ├── setup-npm-ssm.sh # NPM SSM parameter setup
│ ├── beads-orchestrator.sh # Beads task orchestration
│ ├── update-subagent-settings.py # Settings updater
│ └── xact.sh # GitHub Actions local testing
├── slash-commands/ # Command implementations (source of truth)
│ ├── active/ # 17 production-ready commands
│ │ ├── xarchitecture.md # Architecture design and analysis
│ │ ├── xconfig.md # Configuration management
│ │ ├── xcontinue.md # Execution plan continuation
│ │ ├── xdebug.md # Advanced debugging
│ │ ├── xdocs.md # Documentation generation
│ │ ├── xexplore.md # Codebase exploration (read-only)
│ │ ├── xgit.md # Automated Git workflow
│ │ ├── xhelp.md # Built-in help system
│ │ ├── xpipeline.md # CI/CD pipeline management
│ │ ├── xquality.md # Code quality analysis
│ │ ├── xrefactor.md # Code refactoring automation
│ │ ├── xrelease.md # Release management
│ │ ├── xsecurity.md # Security scanning and analysis
│ │ ├── xspec.md # Specification generation
│ │ ├── xtdd.md # Test-driven development
│ │ ├── xtest.md # Testing automation
│ │ └── xverify.md # Reference verification
│ └── experiments/ # 28 experimental commands
│ ├── xact.md # GitHub Actions testing
│ ├── xapi.md # API development tools
│ ├── xaws.md # AWS integration
│ ├── xcompliance.md # Compliance checking
│ ├── xinfra.md # Infrastructure as Code
│ ├── xmetrics.md # Metrics collection
│ ├── xplanning.md # Project planning
│ ├── xpolicy.md # Policy enforcement
│ ├── xproduct.md # Product management
│ ├── xrisk.md # Risk assessment
│ └── [17 additional commands] # Complete experimental collection
├── subagents/ # 25 subagent definitions
├── specs/ # Command specifications
│ ├── command-specifications.md # Command development specs
│ ├── custom-command-specifications.md # Custom command guidelines
│ └── help-functionality-specification.md # Help system specs
├── templates/ # Configuration templates
│ ├── basic-settings.json # Basic Claude Code settings
│ ├── comprehensive-settings.json # Advanced settings
│ ├── security-focused-settings.json # Security-focused config
│ ├── global-settings-backup.json # Global settings backup
│ ├── global-claude.md # Global CLAUDE.md instructions template
│ ├── headless-examples.md # Headless mode examples
│ ├── hybrid-hook-config.yaml # Hybrid hook configuration
│ └── subagent-hooks.yaml # Subagent hook definitions
└── tests/ # Test suites (shell + JS)
├── run-all-tests.sh # Test runner script
├── test_*.sh # 25 shell-based test files for hooks/lib
├── validate-settings-templates.js # Settings template validation
├── validate-documentation-accuracy.js # Documentation accuracy checks
├── install-guide-tester.js # Install guide testing
├── customization-guide-tester.js # Customization guide testing
├── security-validator.js # Security validation
├── hook-integration/ # Hook integration test suite
└── lib/ # Shared test utilities
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 359 lines · 4,223 tokens per session scan A 1e691fe37b72
claude-code CLAUDE.md is an instructions file published in the GitHub repository PaulDuvall/claude-code (108 stars, last pushed 16d ago), licensed MIT. It adds 4,223 tokens to every session, about $0.0211 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other instructions, from other repositories
ai-development-patterns AGENTS.md
Instructions for PaulDuvall/ai-development-patterns, covering agent instructions, task tracking, pattern adoption evaluation and landing the plane (session completion).
drift AGENTS.md
Instructions for dadbodgeoff/drift: Do not fumble your words. Be precise, straight to the point, and talk like a human, not an AI.
claude-ruby-marketplace CLAUDE.md
Instructions for hoblin/claude-ruby-marketplace, covering claude.md, repository purpose, before editing, directory structure and versioning.
mcp-devtools-server CLAUDE.md
Instructions for rshade/mcp-devtools-server, covering claude.md, project overview, specialized agents available, implementation agents and issue management.
slop-mop copilot-instructions.md
forcing agentic coder's path of least resistance through long-term maintainable codepaths.
claude-workspace CLAUDE.md
Instructions for Piyush8296/claude-workspace, covering claude workspace — frontend engineering, quick facts, commands, code style and git.