Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add instructions/sbom-tool/gh-guard/claude-mdgit clone --depth 1 https://github.com/sbom-tool/gh-guardWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/instructions/sbom-tool/gh-guard/claude-md)<a href="https://agentmods.dev/instructions/sbom-tool/gh-guard/claude-md"><img src="https://agentmods.dev/badge/instructions/sbom-tool/gh-guard/claude-md.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.01432 | $0.01432 |
| Opus 5 | $0.00716 | $0.00716 |
| Sonnet 5 | $0.00286 | $0.00286 |
| Haiku 4.5 | $0.00143 | $0.00143 |
Grade A, and why
gh-guard CLAUDE.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 95 lines — stays where its author put it; the contents beside it link to each section on GitHub.
GH-Guard: CI/CD Supply Chain Hardening for Rust
This is a Claude Code skill plugin that helps Rust OSS maintainers harden their CI/CD supply chain.
What This Plugin Does
GH-Guard provides production-tested templates, guided workflows, and gap analysis for:
- Trusted Publishing — OIDC-based crates.io publishing (no long-lived tokens)
- SLSA L3 Provenance — Verifiable build provenance attached to GitHub Releases
- OpenSSF Scorecard — Automated security posture monitoring (18 checks)
- CI Pipeline — Multi-job Rust CI with gate pattern, caching, SHA-pinned actions
- Dependency Policy — cargo-deny + Dependabot + osv-scanner layered defense
- Release Automation — Branch-protection-compatible release scripts with signed tags
- CodeQL + Fuzzing — Static analysis and fuzz testing for Rust
Hardening Levels
| Level | What You Get |
|---|---|
| Minimal | CI workflow + cargo-deny + Dependabot + SECURITY.md |
| Standard | Minimal + Trusted Publishing + CodeQL + Scorecard + release script |
| Hardened | Standard + SLSA L3 provenance + fuzz testing + osv-scanner |
Commands
/audit— Scan your repo and produce a gap analysis against supply chain best practices/harden— Interactive wizard to generate missing configs at your chosen hardening level/generate <target>— Generate a single config file (e.g.,/generate ci-workflow)/check-updates— Check deployed workflows for outdated SHA pins and CLI tool versions/verify— Validate generated configs are syntactically correct and internally consistent
Skills (Contextual Knowledge)
Skills are loaded automatically when relevant. They provide deep knowledge on:
scorecard-checks— All 18 OpenSSF Scorecard checks with Rust-specific guidancetrusted-publishing— OIDC setup for crates.ioslsa-provenance— Three-job publish→provenance→release pipelineci-pipeline— Multi-job CI design patterns for Rustrelease-automation— PR-based release flow with signed tagsdependency-policy— cargo-deny, Dependabot, and osv-scanner configurationfuzz-testing— Coverage-guided fuzz testing with cargo-fuzz, corpus management, and CI integrationmigration-guide— Upgrade paths between hardening levels with detection and rollbackworkspace-publishing— Multi-crate workspace publishing, ordering, and Trusted Publishinghardening-detection— Shared level detection algorithm (single source of truth)cargo-vet— Supply chain audits for third-party crate reviewssecurity-findings— SARIF triage workflow for CodeQL, Scorecard, and cargo-deny findingsbinary-releases— Cross-platform binary distribution via GitHub Releaseschangelog— Automated changelog generation with git-cliff
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 95 lines · 1,432 tokens per session scan A 9e74ce8083ee
gh-guard CLAUDE.md is an instructions file published in the GitHub repository sbom-tool/gh-guard (15 stars, last pushed 5mo ago), licensed MIT. It adds 1,432 tokens to every session, about $0.0072 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other instructions, from other repositories
bomly-cli AGENTS.md
AGENTS.md instructions for bomly-dev/bomly-cli, covering agent instructions — bomly cli, build & test, git worktrees, architecture and plugin framework.
bomly-cli copilot-instructions.md
Copilot instructions for bomly-dev/bomly-cli, a project described as: Free, open-source CLI for dependency intelligence, SBOMs, vulnerability auditing, and CI policy gates.
bomly-cli CLAUDE.md
Claude Code instructions for bomly-dev/bomly-cli, covering claude.md, build & test, git worktrees, architecture and plugin framework.
technocore-chat AGENTS.md
AGENTS.md instructions for flop-labs/technocore-chat: CI runs exactly these — run them before pushing.
devopness CLAUDE.md
Claude Code instructions for devopness/devopness, a project described as: Devopness: AI DevOps on your cloud. Deploy apps, infra and CI/CD. Any cloud and any stack, one MCP. Deterministic API, opinionated and fully configurable. No cloud credentials in AI chats. Free plan.
Sighthound AGENTS.md
Instructions for Corgea/Sighthound, covering claude, commands, python / django test naming and agent skill.