Borrowing it
Nothing to install: this file belongs to PaulDuvall/claude-code. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/PaulDuvall/claude-code/main/CLAUDE.mdgit clone --depth 1 https://github.com/PaulDuvall/claude-codeWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/instructions/paulduvall/claude-code/claude-md)<a href="https://agentmods.dev/instructions/paulduvall/claude-code/claude-md"><img src="https://agentmods.dev/badge/instructions/paulduvall/claude-code/claude-md/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/instructions/paulduvall/claude-code/claude-md"><img src="https://agentmods.dev/badge/instructions/paulduvall/claude-code/claude-md.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.04575 | $0.04575 |
| Opus 5.5 | $0.01830 | $0.01830 |
| Sonnet 5.5 | $0.00915 | $0.00915 |
| Haiku 4.5 | $0.00458 | $0.00458 |
Grade B, and why
claude-code CLAUDE.md scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Reads agent configuration directoriesmediumAgent snooping
.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.
│ ├── wire-settings.py # Merge hook config into ~/.claude/settings.json How it starts
The opening of the file, as written. The whole thing — 376 lines — stays where its author put it; the contents beside it link to each section on GitHub.
CLAUDE.md
This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
Project Overview
Claude Code Custom Commands is a comprehensive collection of 45 custom slash commands for Claude Code that accelerate software development workflows through AI-powered automation. These commands provide intelligent automation for every stage of the software development lifecycle, from planning and architecture to deployment and monitoring.
Core Philosophy
This project focuses on creating defensive security tools and development workflow automation. Each command leverages AI to analyze codebases and provide contextual assistance while maintaining security best practices.
Key Principles:
- Security-First: All commands focus on defensive security and safe development practices
- Workflow Automation: Streamline repetitive development tasks with intelligent automation
- Comprehensive Coverage: Support the entire software development lifecycle
- Quality Assurance: Maintain high code quality through automated checks and validations
- Documentation-Driven: Every command is thoroughly documented with usage examples
All commands are designed to enhance developer productivity while maintaining security and quality standards.
Repository Structure
claude-code/
├── CLAUDE.md # This file - project guidance
├── README.md # Main project documentation
├── setup-devcontainer.sh # Devcontainer setup script
├── claude-dev-toolkit/ # NPM package (distributable toolkit)
│ ├── package.json # NPM package manifest
│ ├── bin/claude-commands # CLI entry point
│ ├── lib/ # JavaScript modules
│ ├── scripts/ # Install/publish scripts
│ ├── commands/ # Synced command copies for npm
│ ├── hooks/ # Synced hook copies for npm
│ ├── subagents/ # Synced subagent copies for npm
│ ├── templates/ # Synced template copies for npm
│ └── tests/ # NPM package tests
├── docs/ # Documentation directory
│ ├── ash-integration.md # ASH tiered security integration
│ ├── claude-custom-commands.md # Command reference guide
│ ├── claude-code-hooks-system.md # Hooks architecture documentation
│ ├── debug-context.md # Debug context management
│ ├── devcontainer-guide.md # Devcontainer guide
│ ├── manual-uninstall-install-guide.md # Installation/uninstallation guide
│ ├── npm-distribution-plan.md # NPM distribution strategy
│ ├── npm-package-guide.md # Published package information
│ ├── subagent-hook-integration.md # Subagent integration docs
│ ├── analysis/ # Historical MECE reports (superseded, dated)
│ ├── npm-only/ # NPM consolidation migration guides
│ ├── plans/ # Implementation plans
│ └── publish/ # Blog articles
├── hooks/ # Hook implementations (11 shell + 18 Python)
│ ├── file-logger.sh # File operation logging
│ ├── on-error-debug.sh # Error debugging hook
│ ├── pre-commit-quality.sh # Pre-commit quality checks
│ ├── pre-commit-test-runner.sh # Auto-detect and run tests
│ ├── pre-write-security.sh # Pre-write security validation
│ ├── prevent-credential-exposure.sh # Credential exposure prevention
│ ├── subagent-trigger.sh # Subagent trigger hook (--simple for lightweight mode)
│ ├── tab-color.sh # Terminal tab colorization
│ ├── verify-before-edit.sh # Warn about fabricated references
│ ├── statusline.sh # Status line (model, dir, context usage)
│ ├── claude-wrapper.sh # Claude wrapper script
│ ├── check-complexity.py # PostToolUse code smell detection
│ ├── check-security.py # PostToolUse security violations
│ ├── check-commit-signing.py # PreToolUse GPG/SSH signing check
│ ├── precommit_checks.py # Tier 1 pre-commit: secrets + IaC
│ ├── prepush_checks.py # Tier 2 pre-push: ASH on push range
│ ├── check_ash_expirations.py # Tier 3 CI: ASH suppression expiry guard
│ ├── [12 more *.py] # Supporting scan modules (see hooks/README.md)
│ ├── settings.example.json # Claude Code hook wiring to merge into settings.json
│ ├── git/ # Tracked git hook logic (pre-commit, pre-push)
│ ├── tests/ # pytest suite for the Python hooks
│ └── lib/ # Hook support libraries (15 shell modules + 1 config)
│ ├── hook-helpers.sh # Shared helpers for standalone hooks
│ ├── config-constants.sh # Configuration constants
│ ├── file-utils.sh # File utility functions
│ ├── error-handler.sh # Error handling and logging
│ ├── argument-parser.sh # CLI argument parsing
│ ├── context-manager.sh # Context orchestrator (thin)
│ ├── context-gathering.sh # Context data gathering
│ ├── context-file-ops.sh # Context file I/O and validation
│ ├── execution-engine.sh # Subagent execution engine
│ ├── execution-simulation.sh # Execution simulation
│ ├── execution-results.sh # Result processing
│ ├── subagent-discovery.sh # Subagent discovery
│ ├── subagent-validator.sh # Subagent validation
│ ├── field-validators.sh # Field validation
│ ├── validation-reporter.sh # Validation reporting
│ └── credential-patterns.conf # Credential detection patterns
├── lib/ # Shared utility libraries
│ └── logging.sh # Logging utilities
├── scripts/ # Build and deployment scripts
│ ├── sync-to-npm.sh # Sync source files to npm package
│ ├── deploy-subagents.sh # Subagent deployment
│ ├── generate-command-docs.sh # Auto-generate command docs
│ ├── setup-hooks.sh # Hook installation script
│ ├── install-git-hooks.sh # Install chained git pre-commit/pre-push shims
│ ├── wire-settings.py # Merge hook config into ~/.claude/settings.json
│ ├── setup-github-actions-iam.py # GitHub Actions IAM setup
│ ├── testing/ # Test support scripts
│ ├── setup-npm-ssm.sh # NPM SSM parameter setup
│ ├── beads-orchestrator.sh # Beads task orchestration
│ ├── update-subagent-settings.py # Settings updater
│ └── xact.sh # GitHub Actions local testing
├── slash-commands/ # Command implementations (source of truth)
│ ├── active/ # 17 production-ready commands
│ │ ├── xarchitecture.md # Architecture design and analysis
│ │ ├── xconfig.md # Configuration management
│ │ ├── xcontinue.md # Execution plan continuation
│ │ ├── xdebug.md # Advanced debugging
│ │ ├── xdocs.md # Documentation generation
│ │ ├── xexplore.md # Codebase exploration (read-only)
│ │ ├── xgit.md # Automated Git workflow
│ │ ├── xhelp.md # Built-in help system
│ │ ├── xpipeline.md # CI/CD pipeline management
│ │ ├── xquality.md # Code quality analysis
│ │ ├── xrefactor.md # Code refactoring automation
│ │ ├── xrelease.md # Release management
│ │ ├── xsecurity.md # Security scanning and analysis
│ │ ├── xspec.md # Specification generation
│ │ ├── xtdd.md # Test-driven development
│ │ ├── xtest.md # Testing automation
│ │ └── xverify.md # Reference verification
│ └── experiments/ # 28 experimental commands
│ ├── xact.md # GitHub Actions testing
│ ├── xapi.md # API development tools
│ ├── xaws.md # AWS integration
│ ├── xcompliance.md # Compliance checking
│ ├── xinfra.md # Infrastructure as Code
│ ├── xmetrics.md # Metrics collection
│ ├── xplanning.md # Project planning
│ ├── xpolicy.md # Policy enforcement
│ ├── xproduct.md # Product management
│ ├── xrisk.md # Risk assessment
│ └── [17 additional commands] # Complete experimental collection
├── subagents/ # 25 subagent definitions
├── specs/ # Command specifications
│ ├── command-specifications.md # Command development specs
│ ├── custom-command-specifications.md # Custom command guidelines
│ └── help-functionality-specification.md # Help system specs
├── templates/ # Configuration templates
│ ├── basic-settings.json # Basic Claude Code settings
│ ├── comprehensive-settings.json # Advanced settings
│ ├── security-focused-settings.json # Security-focused config
│ ├── global-settings-backup.json # Global settings backup
│ ├── global-claude.md # Global CLAUDE.md instructions template
│ ├── headless-examples.md # Headless mode examples
│ ├── hybrid-hook-config.yaml # Hybrid hook configuration
│ └── subagent-hooks.yaml # Subagent hook definitions
└── tests/ # Test suites (shell + JS)
├── run-all-tests.sh # Test runner script
├── test_*.sh # 26 shell-based test files for hooks/lib
├── validate-settings-templates.js # Settings template validation
├── validate-documentation-accuracy.js # Documentation accuracy checks
├── install-guide-tester.js # Install guide testing
├── customization-guide-tester.js # Customization guide testing
├── security-validator.js # Security validation
├── hook-integration/ # Hook integration test suite
└── lib/ # Shared test utilities
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago Changed · +17 lines · +347 tokens per session scan A → B 71b0b7d4999a
- 1mo ago Changed · +5 tokens per session 23d532aaae4f
- 1mo ago First seen · 359 lines · 4,223 tokens per session scan A 1e691fe37b72
claude-code CLAUDE.md is an instructions file published in the GitHub repository PaulDuvall/claude-code (110 stars, last pushed 1mo ago), licensed MIT. It adds 4,575 tokens to every session, about $0.0183 per session on Opus 5.5. A static security scan graded it B with 1 finding (reads agent configuration directories). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other instructions, from other repositories
vibetags com-example-service-TransactionalPaymentService.instructions.md
Instructions for PIsberg/vibetags, covering copilot instructions for transactionalpaymentservice and strict exception handling.
vibetags com-example-gmm-platform-FeatureGate.md
Instructions for PIsberg/vibetags, covering amazon kiro steering: featuregate and feature flag gate.
vscode buildNext.instructions.md
Working notes and architecture documentation for the new esbuild-based build system in build/next. Use when making changes to the new build pipeline (transpile/bundle commands, NLS plugin, source-map handling, resource copying, or self-hosting watch tasks).
next.js AGENTS.md
AGENTS.md instructions for vercel/next.js, covering next.js development guide, codebase structure, monorepo overview, core package: packages/next and other important packages.
vscode oss-third-party-notices.instructions.md
Instructions for microsoft/vscode, covering vs code oss third-party-notices pipeline, architecture, pipeline flow in ci, cache eligibility and rollout and applying the notice (cutover).
langchain AGENTS.md
AGENTS.md instructions for langchain-ai/langchain, covering global development guidelines for the langchain monorepo, corridor security analysis, project architecture and context, monorepo structure and development tools & commands.