ai-toolkit CLAUDE.md

Project instructions for an AI development toolkit that supports several coding assistants and provides shared skills, agents, hooks, and configuration.

In plain words
What is it for?
Use them when developing or configuring the toolkit, exporting settings for Claude apps, maintaining compatibility files, or checking documentation and counts.
Why use it?
They explain which instruction files each assistant reads and set rules for using the project's knowledge base before technical work.

Instructions file

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add instructions/softspark/ai-toolkit/claude-md
Clone the repo
git clone --depth 1 https://github.com/softspark/ai-toolkit
Per session 1,907 This file is loaded in full into every session.
When invoked 1,907 The same file — it is already loaded in full.
Security scan B 1 finding. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.01907 $0.01907
Opus 5 $0.00954 $0.00954
Sonnet 5 $0.00381 $0.00381
Haiku 4.5 $0.00191 $0.00191

Measured 3d ago against content hash 581e09a58fc8, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade B, and why

ai-toolkit CLAUDE.md scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Reads agent configuration directoriesmediumAgent snooping

.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.

# Install: ai-toolkit install (global → ~/.claude/settings.json hooks + ~/.softspark/ai-toolkit/hooks/ scripts)
CLAUDE.md · 83 lines

How it starts

The opening of the file, as written. The whole thing — 83 lines — stays where its author put it; the contents beside it link to each section on GitHub.

ai-toolkit

Overview

Shared AI development toolkit for Claude Code, Claude Chat/Cowork, Cursor, Devin, Copilot, Gemini, Cline, Roo/Zoo Code, Aider, Augment, Google Antigravity, and Codex CLI — skills, agents, lifecycle hooks, persona presets, plugin packaging, and safety constitution, distributed as a global npm package.

Claude Code Runtime Rules

  • Claude Code reads CLAUDE.md, .claude/CLAUDE.md, .claude/rules/*.md, skills, agents, settings, and hooks. It does not treat AGENTS.md as an instruction source.
  • Claude Chat/Desktop/Cowork does not scan Claude Code's ~/.claude/ files. Use ai-toolkit claude-app export, upload the ZIP in Customize > Plugins, and apply the generated Cowork global instructions. Skills work in Chat/Cowork; hooks and sub-agents are Cowork-only.
  • AGENTS.md is generated for Codex/OpenCode/Gemini compatibility. Do not move mandatory Claude behavior there.
  • KB-first is mandatory for technical work: before answering or acting on a technical/project prompt, call smart_query() or hybrid_search_kb() and use the result to locate the relevant SOP/reference. Cite the KB path when the result materially informs the answer. If the KB tool is unavailable, state that explicitly and continue from local files.
  • Any rule that must be enforced at a fixed lifecycle point belongs in app/hooks.json + app/hooks/*.sh with tests. CLAUDE.md guidance is context, not enforcement.

CRITICAL: Documentation & Count Accuracy

Every change to skills, agents, hooks, or editors MUST be reflected in ALL docs: README.md, CLAUDE.md, ARCHITECTURE.md, package.json, plugin.json, skills-catalog.md, architecture-overview.md, llms.txt, AGENTS.md. Run python3 scripts/validate.py --strict + python3 scripts/audit_skills.py --ci before every commit. When you touch any app/hooks/*.sh, ALSO run shellcheck --severity=warning app/hooks/*.sh — it runs in ci.yml but NOT in validate.py, npm test, or publish.yml, so a hook lint failure can publish on tag while turning main CI red (v4.5.1 postmortem). Stale counts = broken user trust. This is non-negotiable.

Read the full file on GitHub · 83 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 3d ago First seen · 83 lines · 1,907 tokens per session scan B 581e09a58fc8

Subscribe to this mod's changes

ai-toolkit CLAUDE.md is an instructions file published in the GitHub repository softspark/ai-toolkit (167 stars, last pushed 4d ago), licensed Apache-2.0. It adds 1,907 tokens to every session, about $0.0095 per session on Opus 5. A static security scan graded it B with 1 finding (reads agent configuration directories). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Related

Other instructions, from other repositories