What is InvestSkill CLAUDE.md?

A repository instruction file for Claude Code, an AI coding agent, in an investment-analysis project. It documents commands, project structure, skill organization, validation, testing, and release procedures.

It is for explaining how to test, validate, verify, package, and release the project's prompt-based investment skills and configuration files.

It gives the coding agent the project-specific information needed to run checks and handle changes consistently.

InvestSkill CLAUDE.md — Instructions file for coding agents by yennanliu: A repository instruction file for Claude Code, an AI…

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods

npx agentmods add instructions/yennanliu/investskill/claude-md

Clone the repo

git clone --depth 1 https://github.com/yennanliu/InvestSkill

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/instructions/yennanliu/investskill/claude-md.svg)](https://agentmods.dev/instructions/yennanliu/investskill/claude-md)

Your own site

<a href="https://agentmods.dev/instructions/yennanliu/investskill/claude-md"><img src="https://agentmods.dev/badge/instructions/yennanliu/investskill/claude-md.svg" alt="Measured on agentmods" height="20"></a>

Per session 2,507 This file is loaded in full into every session.

When invoked 2,507 The same file — it is already loaded in full.

Security scan E 3 findings. Scan, not verified.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5	$0.02507	$0.02507
Opus 5	$0.01254	$0.01254
Sonnet 5	$0.00501	$0.00501
Haiku 4.5	$0.00251	$0.00251

Measured 5d ago against content hash b33fdb494e5f, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade E, and why

InvestSkill CLAUDE.md scanned grade E with 3 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Downloads and executes remote codehighSupply chain

curl | sh runs whatever the server returns today, which is not necessarily what it returned when this was reviewed.

`install.sh` is the one-command curl installer (`curl -fsSL .../install.sh | bash -s -- -a <agent>`). It is tested by `scripts/test-install.js` (`npm run test:install`) and by `.github/workflows/install-script.yml`.

Recursive force deletehighDestructive command

rm -rf with a variable or a broad path is one typo away from removing the wrong tree.

4. `rm -rf` may only ever target the script's own `mktemp -d` directory (`$TMP`). Enforced by both the test suite and the lint job.

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

`install.sh` is the one-command curl installer (`curl -fsSL .../install.sh | bash -s -- -a <agent>`). It is tested by `scripts/test-install.js` (`npm run test:install`) and by `.github/workflows/install-script.yml`.

CLAUDE.md · 139 lines

How it starts

The opening of the file, as written. The whole thing — 139 lines — stays where its author put it; the contents beside it link to each section on GitHub.

CLAUDE.md

This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.

Commands

npm test                    # Run all unit tests (skill/structure + install script)
npm run test:skills         # Skill/structure tests only (270+ checks)
npm run test:install        # install.sh tests (static checks + sandboxed runs)
npm run validate            # Validate prompt file contents and format
npm run pre-release         # Full pre-release check: pre-release-check + validate + test
npm run verify              # Verify local setup is correct
npm run release:dry-run     # Preview release without making changes
npm run integration-tests   # Run integration tests

Validate JSON manifests manually:

jq empty plugins/us-stock-analysis/.claude-plugin/plugin.json
jq empty .claude-plugin/marketplace.json

Architecture

InvestSkill is a prompt-engineering plugin, not traditional software. There is no application runtime — the "skills" are structured markdown frameworks that guide AI assistants through investment analysis workflows.

Skill Distribution Model

Each skill lives in two forms simultaneously:

plugins/us-stock-analysis/skills/<name>/SKILL.md — Claude Code form, includes YAML frontmatter (---\ndescription: ...\n---) and uses slash command syntax
prompts/<name>.md — Universal form, identical content but with frontmatter stripped, AI-agnostic (no slash commands)

These two files must stay in sync. The prompts/ version is what Cursor, Gemini CLI, GitHub Copilot, and ChatGPT users access.

Platform Config Files

File	Platform
`plugins/us-stock-analysis/.claude-plugin/plugin.json`	Claude Code plugin manifest
`.claude-plugin/marketplace.json`	Claude marketplace listing
`.cursor/rules/invest-skill.mdc`	Cursor IDE auto-loading rules
`.github/copilot-instructions.md`	GitHub Copilot auto-loading
`GEMINI.md`	Gemini CLI auto-loading

Read the full file on GitHub · 139 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

5d ago First seen · 139 lines · 2,507 tokens per session scan E b33fdb494e5f

Subscribe to this mod's changes

InvestSkill CLAUDE.md is an instructions file published in the GitHub repository yennanliu/InvestSkill (199 stars, last pushed today), licensed MIT. It adds 2,507 tokens to every session, about $0.0125 per session on Opus 5. A static security scan graded it E with 3 findings (downloads and executes remote code, recursive force delete, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Finance and fintech LLM agent financial-analysis gemini investment stock-market

LangAlpha AGENTS.md

AGENTS.md instructions for ginlix-ai/LangAlpha, covering langalpha, common commands, architecture, backend (src/) and frontend (web/src/).

ginlix-ai/LangAlpha · 2,596 tokens

LangAlpha CLAUDE.md

Claude Code instructions for ginlix-ai/LangAlpha: Agent context for this repo lives in AGENTS.md — the vendor-neutral single source of truth, read directly by Codex/Cursor/Copilot/etc. Claude Code reads THIS file and expands the @import below, so every toolchain gets identical context. Edit AGENTS.md, not this file.…

ginlix-ai/LangAlpha · 83 tokens

InvestSkill CLAUDE.md