Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add instructions/starslingdev/skills/claude-mdgit clone --depth 1 https://github.com/starslingdev/skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/instructions/starslingdev/skills/claude-md)<a href="https://agentmods.dev/instructions/starslingdev/skills/claude-md"><img src="https://agentmods.dev/badge/instructions/starslingdev/skills/claude-md.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.02026 | $0.02026 |
| Opus 5 | $0.01013 | $0.01013 |
| Sonnet 5 | $0.00405 | $0.00405 |
| Haiku 4.5 | $0.00203 | $0.00203 |
Grade A, and why
skills CLAUDE.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 137 lines — stays where its author put it; the contents beside it link to each section on GitHub.
starslingdev/skills
Public Claude Code skills from StarSling. The repo ships four skills, each in
its own self-contained directory under skills/: ci-speedup (measured
speed / runner-minute waste), ci-score (configuration best practices),
ci-secure (the ten critical CI/CD attack vectors), and sling (live
single-run questions, routed between the sling and gh CLIs).
The first three audit a local checkout offline and ship deterministic Python
engines. sling is deliberately different: it is prose plus a routing
contract over a live CLI, with no engine of its own, so its tests pin the
contract (the commands it names exist; state changes never route to a
read-only CLI) rather than detector behavior.
Repository layout
skills/
ci-score/ # skill: configuration best practices (the CI Score)
ci-secure/ # skill: the ten critical CI/CD attack vectors
ci-speedup/ # skill: measured speed waste (self-contained)
SKILL.md # the skill's canonical contract — read it first
CHANGELOG.md # dated, PR-referenced change history (keep updated)
ARCHITECTURE.md # how the pipeline fits together
scripts/ # the deterministic engine (stdlib only)
references/ # the pattern catalog + methodology docs
evals/ # eval cases
tests/ # oracle tests + verify_report.py invariants
sling/ # skill: live run/job questions (prose only:
# SKILL.md, references/, evals/, tests/)
docs/methodology.md # public front-door methodology (links into the skill)
examples/ # sanitized sample report(s)
maintainers/ # maintainer-only loop infra, OUTSIDE the installable tree
ci-score/ # (ci-score's maintainer-only material)
skills-registry-security/ # skill: triage a registry audit verdict (see its README.md)
ci-speedup/ # (the `skills` CLI copies skills/<name>/ recursively, so
MAINTAINERS.md # keeping this here is the only way to keep it out of installs)
loops/ # loop prompts + summary schema (gap→catalog, transcript)
scripts/ # draft_detector.py, aggregate_lessons.py, dogfood helpers
workflows/ # the automated dogfood loop (ci-speedup-dogfood.js)
tests/ # tests for the above
tests/ # repo-level guard (install-surface invariant)
pyproject.toml # pytest config; testpaths span the skill + maintainers/
.github/workflows/ci.yml # runs `pytest -v` on push / PR to main (ubuntu-latest)
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 137 lines · 2,026 tokens per session scan A 001b07b87181
skills CLAUDE.md is an instructions file published in the GitHub repository starslingdev/skills (20 stars, last pushed today), licensed MIT. It adds 2,026 tokens to every session, about $0.0101 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other instructions, from other repositories
devopness CLAUDE.md
Claude Code instructions for devopness/devopness, a project described as: Devopness: AI DevOps on your cloud. Deploy apps, infra and CI/CD. Any cloud and any stack, one MCP. Deterministic API, opinionated and fully configurable. No cloud credentials in AI chats. Free plan.
zuke AGENTS.md
AGENTS.md instructions for zuke-build/zuke, covering agents.md, using zuke — the api, without guessing, tech stack, typescript 7 / tsgo and coding guidelines (non-negotiable).
docker-zoneminder CLAUDE.md
Instructions for jantman/docker-zoneminder, covering claude.md, project overview, build and test, ci/cd and architecture.
klaudiush CLAUDE.md
Claude Code instructions for smykla-skalski/klaudiush, covering claude.md, project overview, commands, completion (shell completion scripts) and doctor (diagnose setup and configuration).
harmont-cli CLAUDE.md
Instructions for harmont-dev/harmont-cli, covering testing, documentation, dsl and keep the sdk, hm init templates, and docs in sync.
everr AGENTS.md
AGENTS.md instructions for everr-labs/everr, covering constitution, web app packages/app, clickhouse, postgres and drizzle and everr cli.