What is InvestSkill CLAUDE.md?

A repository instruction file for Claude Code, an AI coding agent, in an investment-analysis project. It documents commands, project structure, skill organization, validation, testing, and release procedures.

It is for explaining how to test, validate, verify, package, and release the project's prompt-based investment skills and configuration files.

It gives the coding agent the project-specific information needed to run checks and handle changes consistently.

How yennanliu/InvestSkill configures Claude Code

Reuse

Borrowing it

Nothing to install: this file belongs to yennanliu/InvestSkill. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file

curl -O https://raw.githubusercontent.com/yennanliu/InvestSkill/main/CLAUDE.md

Clone the repo

git clone --depth 1 https://github.com/yennanliu/InvestSkill

Made for: Claude Code.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/instructions/yennanliu/investskill/claude-md/github.svg)](https://agentmods.dev/instructions/yennanliu/investskill/claude-md)

Your own site

<a href="https://agentmods.dev/instructions/yennanliu/investskill/claude-md"><img src="https://agentmods.dev/badge/instructions/yennanliu/investskill/claude-md/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/instructions/yennanliu/investskill/claude-md"><img src="https://agentmods.dev/badge/instructions/yennanliu/investskill/claude-md.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 3,931 This file is loaded in full into every session.

When invoked 3,931 The same file — it is already loaded in full.

Security scan E 3 findings. A grade says what 26 rules found in the file — not that it is safe. ✓ AI security review Sonnet 5 · 7 Sept 2026 📄 Read the review

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.03931	$0.03931
Opus 5.5	$0.01572	$0.01572
Sonnet 5.5	$0.00786	$0.00786
Haiku 4.5	$0.00393	$0.00393

Measured 8d ago against content hash 50a8ea585fa3, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade E, and why

InvestSkill CLAUDE.md scanned grade E with 3 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Downloads and executes remote codehighSupply chain

curl | sh runs whatever the server returns today, which is not necessarily what it returned when this was reviewed.

`install.sh` is the one-command curl installer (`curl -fsSL .../install.sh | bash -s -- -a <agent>`). It is tested by `scripts/test-install.js` (`npm run test:install`) and by `.github/workflows/install-script.yml`.

Recursive force deletehighDestructive command

rm -rf with a variable or a broad path is one typo away from removing the wrong tree.

4. `rm -rf` may only ever target the script's own `mktemp -d` directory (`$TMP`). Enforced by both the test suite and the lint job.

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

`install.sh` is the one-command curl installer (`curl -fsSL .../install.sh | bash -s -- -a <agent>`). It is tested by `scripts/test-install.js` (`npm run test:install`) and by `.github/workflows/install-script.yml`.

CLAUDE.md · 167 lines

How it starts

The opening of the file, as written. The whole thing — 167 lines — stays where its author put it; the contents beside it link to each section on GitHub.

CLAUDE.md

This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.

Commands

npm test                    # Run all unit tests (skill/structure + install script)
npm run test:skills         # Skill/structure tests only (270+ checks)
npm run test:install        # install.sh tests (static checks + sandboxed runs)
npm run validate            # Validate prompt file contents and format
npm run pre-release         # Full pre-release check: pre-release-check + validate + test
npm run verify              # Verify local setup is correct
npm run release:dry-run     # Preview release without making changes
npm run integration-tests   # Run integration tests
npm run test:llm-io         # Offline output-contract, prompt and eval-harness checks (part of npm test)
npm run prompt:diff         # What this branch changed in the prompts (tokens, description, contract)
npm run prompt:budgets      # Rewrite tests/prompt-budgets.json after an intended prompt-size change
npm run eval:claude -- --skills stock-eval   # Live eval through the Claude API (needs ANTHROPIC_API_KEY + the SDK)

Validate JSON manifests manually:

jq empty plugins/us-stock-analysis/.claude-plugin/plugin.json
jq empty .claude-plugin/marketplace.json

Architecture

InvestSkill is a prompt-engineering plugin, not traditional software. There is no application runtime — the "skills" are structured markdown frameworks that guide AI assistants through investment analysis workflows.

Skill Distribution Model

Each skill lives in two forms simultaneously:

plugins/us-stock-analysis/skills/<name>/SKILL.md — Claude Code form, includes YAML frontmatter (---\ndescription: ...\n---) and uses slash command syntax
prompts/<name>.md — Universal form, identical content but with frontmatter stripped, AI-agnostic (no slash commands)

These two files must stay in sync. The prompts/ version is what Cursor, Gemini CLI, GitHub Copilot, and ChatGPT users access.

Read the full file on GitHub · 167 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

8d ago Changed · +18 lines · +733 tokens per session 50a8ea585fa3
24d ago Changed · +10 lines · +489 tokens per session 59aa8d159f14
25d ago Changed · +202 tokens per session d63036cac21f
1mo ago First seen · 139 lines · 2,507 tokens per session scan E b33fdb494e5f

Subscribe to this mod's changes

InvestSkill CLAUDE.md is an instructions file published in the GitHub repository yennanliu/InvestSkill (250 stars, last pushed yesterday), licensed MIT. It adds 3,931 tokens to every session, about $0.0157 per session on Opus 5.5. A static security scan graded it E with 3 findings (downloads and executes remote code, recursive force delete, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Finance and fintech LLM agent financial-analysis gemini investment stock-market

vscode buildNext.instructions.md

Working notes and architecture documentation for the new esbuild-based build system in build/next. Use when making changes to the new build pipeline (transpile/bundle commands, NLS plugin, source-map handling, resource copying, or self-hosting watch tasks).

microsoft/vscode · 9,649 tokens

InvestSkill: Instructions file for Claude Code