Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add instructions/quant-off/skills/claude-mdgit clone --depth 1 https://github.com/Quant-Off/skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/instructions/quant-off/skills/claude-md)<a href="https://agentmods.dev/instructions/quant-off/skills/claude-md"><img src="https://agentmods.dev/badge/instructions/quant-off/skills/claude-md.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.01385 | $0.01385 |
| Opus 5 | $0.00692 | $0.00692 |
| Sonnet 5 | $0.00277 | $0.00277 |
| Haiku 4.5 | $0.00138 | $0.00138 |
Grade A, and why
skills CLAUDE.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 125 lines — stays where its author put it; the contents beside it link to each section on GitHub.
CLAUDE.md
Directives for Claude Code when working in this repository. Follow these rules whenever you create or modify files here. The human contribution workflow lives in CONTRIBUTING.md; this file is the operating manual for the agent.
Repository context
Quant-Off/skills is a Claude Code plugin marketplace for security research.
Each plugin bundles one or more skills that let Claude Code verify cryptographic
code, analyze binary artifacts with Ghidra, and audit codebases accurately and
repeatably.
Structural rules (never violate)
.claude-plugin/marketplace.jsonlives at the repo root, never inside a plugin.- A plugin's
plugin.jsonlives atplugins/<name>/.claude-plugin/plugin.json. - Skills, commands, agents, and hooks live at the plugin root
(
plugins/<name>/skills/...), never inside.claude-plugin/. - Skills auto-discover from the plugin's
skills/directory; no extra declaration is needed unless a custom path is used.
Repository layout:
.
├── .claude-plugin/
│ └── marketplace.json # Marketplace manifest (MUST stay at repo root)
├── plugins/ # One directory per plugin
│ └── <plugin-name>/
│ ├── .claude-plugin/
│ │ └── plugin.json # Plugin manifest
│ ├── skills/
│ │ └── <skill-name>/
│ │ ├── SKILL.md # Entry point, under 500 lines
│ │ ├── references/ # Detail loaded on demand, one level deep
│ │ └── scripts/ # Optional executable helpers
│ └── README.md
├── CLAUDE.md # This file (Claude Code directives)
├── CONTRIBUTING.md # Contribution guide (English)
├── CONTRIBUTING_KR.md # Contribution guide (Korean)
├── README.md # English docs
├── README_KR.md # Korean translation
└── LICENSE
Marketplace facts
- The marketplace
nameisquant-security(frommarketplace.json). - Each plugin's
sourceis a repo-relative path (./plugins/<name>), so everything ships from this single repository. - Install path for users:
/plugin marketplace add Quant-Off/skillsthen/plugin install <plugin-name>@quant-security.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 125 lines · 1,385 tokens per session scan A e5c8fcce70ec
skills CLAUDE.md is an instructions file published in the GitHub repository Quant-Off/skills (1 stars, last pushed 24d ago), licensed MIT. It adds 1,385 tokens to every session, about $0.0069 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other instructions, from other repositories
Cybermes AGENTS.md
Instructions for Zyrexnn/Cybermes, covering 🛡️ cybermes master operational directives (agents.md), 1. 🎯 persona & core mission, 2. ⚡ core operational principles, 3. 📁 strict target-scoped workspace & deliverables and mandatory rules for file creation.
CheatSheetSeries CLAUDE.md
Claude Code instructions for OWASP/CheatSheetSeries, covering claude.md and for maintainers.
Sighthound AGENTS.md
Instructions for Corgea/Sighthound, covering claude, commands, python / django test naming and agent skill.
hacker-bob AGENTS.md
Instructions for vmihalis/hacker-bob, covering hacker bob agent instructions and review guidelines.
hacker-bob CLAUDE.md
Instructions for vmihalis/hacker-bob: This repository is the install source for the Hacker Bob /bob-evaluate Claude Code framework.
vuln-scout CLAUDE.md
Instructions for allsmog/vuln-scout, covering vulnscout - development guide, project structure, key commands, development notes and supported languages.