Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add instructions/summersec/sumsec-skills/claude-mdgit clone --depth 1 https://github.com/SummerSec/SumSec-SkillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/instructions/summersec/sumsec-skills/claude-md)<a href="https://agentmods.dev/instructions/summersec/sumsec-skills/claude-md"><img src="https://agentmods.dev/badge/instructions/summersec/sumsec-skills/claude-md.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.03579 | $0.03579 |
| Opus 5 | $0.01790 | $0.01790 |
| Sonnet 5 | $0.00716 | $0.00716 |
| Haiku 4.5 | $0.00358 | $0.00358 |
Grade A, and why
SumSec-Skills CLAUDE.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 222 lines — stays where its author put it; the contents beside it link to each section on GitHub.
SumSec-Skills 仓库说明（供 Agent）
本仓库为 SummerSec 个人 Agent Skills 集合，与具体业务代码仓库分离，仅存放可复用的 SKILL.md 及附属资源。仓库以多插件 monorepo 结构管理，Skill 来源包括：
- 本仓库原创 skill。
- submodule 同步：
claude-plugins-official、context7、taste-skill-upstream、semantic-linter-upstream。
默认 Git 规则
- 本仓默认提交目标分支为
master。 - 除非用户明确要求创建分支、提交 PR，或指定其他分支，否则维护性改动默认应提交并推送到
master。 - 如果当前不在
master，提交前先确认是否需要切回master；不要把“默认新建codex/*分支”当成本仓默认行为。 - GitHub 远端默认分支可能仍显示为
main；提交/推送前用git branch --show-current和git remote show origin确认当前目标，不要只依赖 remote HEAD。 - 暂存时只纳入本次任务相关文件，不要使用无差别
git add .。 - 不要提交无关未跟踪目录、临时输出或同步过程残留，除非本次任务明确要求。
发现与使用
- 所有 skill 按类别分组在插件目录下：
<plugin>/skills/<skill-name>/。 - 每个 skill 的入口为
<plugin>/skills/<skill-name>/SKILL.md，顶部 YAML frontmatter 中的description用于判断是否与任务相关。 - 当用户任务与某个 skill 的
description匹配时：先读取并遵循该SKILL.md，再按需读取其同目录下references/、scripts/、assets/、rules/等由SKILL.md直接链接的文件。 - 执行 skill 时遵守其中的确认门槛、工作流顺序与输出格式要求；不要在未阅读 skill 的情况下用通用流程替代。
核心命令
# 同步 submodule skills 到插件目录
python .claude/skills/sync-skills/scripts/sync-skills.py
python .claude/skills/sync-skills/scripts/sync-skills.py --dry-run
python .claude/skills/sync-skills/scripts/sync-skills.py --clean
# 添加映射
python .claude/skills/sync-skills/scripts/sync-skills.py --add "<source>" "<target>"
python .claude/skills/sync-skills/scripts/sync-skills.py --add-plugin <plugin-name>
python .claude/skills/sync-skills/scripts/sync-skills.py --list
# npm scripts（等同上述命令）
npm run sync
npm run sync:dry
npm run sync:clean
npm run validate:dsh
验证命令
# JSON manifest 可解析
node -e "const fs=require('fs'); for (const f of ['package.json','plugin.json','.claude-plugin/plugin.json','.claude-plugin/marketplace.json','.cursor-plugin/plugin.json','.cursor-plugin/marketplace.json','.codex-plugin/plugin.json']) JSON.parse(fs.readFileSync(f,'utf8')); console.log('json ok')"
# DeepSeek Harness bundle 元数据、patch roots 与一层 Skill 目录
npm run validate:dsh
# 版本残留检查，按目标版本调整表达式
rg -n "1\.0\.(40|41)" package.json plugin.json .claude-plugin .cursor-plugin .codex-plugin .agents/plugins writing-zh/.claude-plugin dev-tools/.claude-plugin agents-dev/.claude-plugin openclaw.plugin.json opencode/plugins/sumsec-skills.mjs hermes/skills/sumsec-skills/SKILL.md
# 空白、冲突标记与 symlink 检查
git diff --check
git ls-files -s AGENTS.md CLAUDE.md
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 6d ago First seen · 222 lines · 3,579 tokens per session scan A 24b26cee52c4
SumSec-Skills CLAUDE.md is an instructions file published in the GitHub repository SummerSec/SumSec-Skills (8 stars, last pushed 21d ago), licensed Apache-2.0. It adds 3,579 tokens to every session, about $0.0179 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other instructions, from other repositories
Agentkey AGENTS.md
Instructions for chainbase-labs/Agentkey, covering agents.md, what this repo is, directory structure, key commands and test a local edit against every detected agent.
superdesign-skill AGENTS.md
Instructions for superdesigndev/superdesign-skill, covering project agent memory, what this repo is, skill flow invariant: two entry paths, ground truth for cli behavior and plugin packaging & release.
seektty AGENTS.md
AGENTS.md instructions for Hilbert-beinghappy/seektty: This repository ships one out-of-tree DeepSeek Harness Bundle. Harness remains the only owner of Agent, Session, model, settings, permissions, Profile, plugin, and persistence state.
iPolloWork AGENTS.md
AGENTS.md instructions for Devin-AXIS/iPolloWork, covering agents.md, what ipollowork is, core philosophy, pull request expectations (fast merge) and validate every experience.
dsh-industry-research AGENTS.md
AGENTS.md instructions for PerryLink/dsh-industry-research, covering agents.md, layout, hard rules applied here, checks and release.
causal-memory CLAUDE.md
Claude Code instructions for JingxuanC/causal-memory, covering causal memory mcp integration, causal memory integration, after acting on a decision and observing the result, when something fails unexpectedly and when a recorded lesson turns out to be wrong.