Borrowing it
Nothing to install: this file belongs to theoden8/webspace_app. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/theoden8/webspace_app/master/CLAUDE.mdgit clone --depth 1 https://github.com/theoden8/webspace_appWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/instructions/theoden8/webspace_app/claude-md)<a href="https://agentmods.dev/instructions/theoden8/webspace_app/claude-md"><img src="https://agentmods.dev/badge/instructions/theoden8/webspace_app/claude-md/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/instructions/theoden8/webspace_app/claude-md"><img src="https://agentmods.dev/badge/instructions/theoden8/webspace_app/claude-md.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.30549 | $0.30549 |
| Opus 5.5 | $0.12220 | $0.12220 |
| Sonnet 5.5 | $0.06110 | $0.06110 |
| Haiku 4.5 | $0.03055 | $0.03055 |
Grade D, and why
webspace_app CLAUDE.md scanned grade D with 3 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks for rootmediumPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
sudo apt-get install -y pipewire pipewire-bin wireplumber dbus-daemon jq \ Downloads and executes remote codehighSupply chain
curl | sh runs whatever the server returns today, which is not necessarily what it returned when this was reviewed.
curl -fsSL https://fvm.app/install.sh | bash Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
curl -fsSL https://fvm.app/install.sh | bash How it starts
The opening of the file, as written. The whole thing — 871 lines — stays where its author put it; the contents beside it link to each section on GitHub.
CLAUDE.md
WebSpace: Flutter app managing multiple websites with per-site cookie isolation via flutter_inappwebview. Platforms: iOS, Android, macOS, Linux (WPE WebKit fork).
Coding principles
Simplicity comes first: every structure here exists to make the code easier to hold in the head; one that makes it harder has failed, however correct it is. Within that: one owner per fact, joins are types, and every invariant is caught at the earliest point it can be violated. A bug then has one suspect.
Reasoning stays local as the system grows. Adding a component costs the same to write, to read and to check, whatever else exists. Components meet only through what they share, so the first question for any new piece is what it shares with the rest, and a good answer is small and explicit. Interleavings multiply with every component that touches the same state: two pieces that share nothing can be understood and checked apart, and two that share a variable must be understood and checked together. A design in which every new piece interacts with every old one has stopped scaling, however correct each piece is.
Design is proved by the compiler and timing by the model checker, each over its own unit: a type for a fact, and for timing what runs between two awaits. The model is printed from the code, so when the two disagree the suspects are the code, the printer and the fakes, never the printed text, and the trace names which. A check counts once it has caught a planted mistake, and the mistake stays as its proof. Debt is a list in a gate that only shrinks. Verification only grows: a refactor prints the same model and still catches every planted mistake, no count of checks, mistakes caught or obligations proved falls (formal/levels.tsv), and a check retires only when its replacement has caught the same mistakes.
The ladder
Each invariant sits on one rung. Put it on the highest rung Dart allows; step down only with a one-line reason next to the check.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- today Changed · +4 lines · +303 tokens per session b72376561cee
- 2d ago Changed · +5 lines · +489 tokens per session 368e1f5e7c0b
- 5d ago Changed · +2 lines · +371 tokens per session 031f6e152268
- 6d ago Changed · +14 lines · +1,945 tokens per session scan C → D c9daa059460a
- 8d ago Changed · +2 lines · +298 tokens per session 2eef3471731c
- 9d ago Changed · +6 lines · +719 tokens per session 9f33ba54a1b3
- 11d ago Changed · +1 lines · +172 tokens per session f987ab2b43ab
- 12d ago Changed · +25 tokens per session 5b082197efcd
- 14d ago Changed · +4 lines · +625 tokens per session c798edbe8ecd
- 15d ago First seen · 833 lines · 25,602 tokens per session scan C cf80170adf63
webspace_app CLAUDE.md is an instructions file published in the GitHub repository theoden8/webspace_app (220 stars, last pushed yesterday), licensed MIT. It adds 30,549 tokens to every session, about $0.1222 per session on Opus 5.5. A static security scan graded it D with 3 findings (asks for root, downloads and executes remote code, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
webspace_app CLAUDE.md compared with instructions from other repositories
| Mod | Type | Stars | Last push | Licence | Scan | Tokens | Works with |
|---|---|---|---|---|---|---|---|
| webspace_app CLAUDE.mdtheoden8/webspace_app | Instructions file | 220 | yesterday | MIT | D | 30,549 | Claude Code |
| vscode buildNext.instructions.mdmicrosoft/vscode | Instructions file | 195k | yesterday | MIT | A | 9,719 | GitHub Copilot |
| next.js AGENTS.mdvercel/next.js | Instructions file | 143k | today | MIT | A | 7,461 | Codex, OpenCode |
| langchain AGENTS.mdlangchain-ai/langchain | Instructions file | 149k | today | MIT | A | 4,680 | Codex, OpenCode |
| vscode oss-third-party-notices.instructions.mdmicrosoft/vscode | Instructions file | 195k | yesterday | MIT | A | 5,516 | GitHub Copilot |
| vscode copilot-instructions.mdmicrosoft/vscode | Instructions file | 195k | yesterday | MIT | A | 3,093 | GitHub Copilot |
| deepseek-harness AGENTS.mddeepseek-ai/deepseek-harness | Instructions file | 274k | 2d ago | MIT | A | 4,313 | Codex, OpenCode |