Borrowing it
Nothing to install: this file belongs to zystem-io/zymtrace-skills. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/zystem-io/zymtrace-skills/main/CLAUDE.mdgit clone --depth 1 https://github.com/zystem-io/zymtrace-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/instructions/zystem-io/zymtrace-skills/claude-md)<a href="https://agentmods.dev/instructions/zystem-io/zymtrace-skills/claude-md"><img src="https://agentmods.dev/badge/instructions/zystem-io/zymtrace-skills/claude-md/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/instructions/zystem-io/zymtrace-skills/claude-md"><img src="https://agentmods.dev/badge/instructions/zystem-io/zymtrace-skills/claude-md.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.02056 | $0.02056 |
| Opus 5.5 | $0.00822 | $0.00822 |
| Sonnet 5.5 | $0.00411 | $0.00411 |
| Haiku 4.5 | $0.00206 | $0.00206 |
Grade A, and why
zymtrace-skills CLAUDE.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 153 lines — stays where its author put it; the contents beside it link to each section on GitHub.
zymtrace-skills — Development Guide
Claude Code skills for installing, upgrading, exposing, troubleshooting, and analyzing zymtrace — continuous CPU/GPU profiling. This guide is for people developing the skills; end-user docs live in README.md.
Repository structure
A single plugin at zymtrace/ that installs into Claude Code, OpenAI Codex, and Cursor
from one canonical source, plus repo-root marketplace manifests (one per tool) and the test
suite.
.claude-plugin/marketplace.json # Claude Code marketplace manifest
.agents/plugins/marketplace.json # Codex (and generic) marketplace manifest
.cursor-plugin/marketplace.json # Cursor marketplace manifest
zymtrace/ # Plugin root (== ${CLAUDE_PLUGIN_ROOT} at runtime)
.claude-plugin/plugin.json # Claude Code plugin manifest
.codex-plugin/plugin.json # Codex plugin manifest (declares "skills": "./skills/")
.cursor-plugin/plugin.json # Cursor plugin manifest (declares "skills": "./skills/")
shared/ # Cross-skill docs (conventions.md, references.md)
skills/<skill-name>/ # THE canonical source — every tool reads these
SKILL.md # Required. Frontmatter + workflow.
reference.md # Optional. Deep details for progressive disclosure.
scripts/*.sh # Optional. Verify/diagnose helpers (executable).
values/*.yaml # Optional. Helm values templates.
tests/ # Structural pytest suite (no API keys / cluster)
Key conventions
- Versions stay in sync — the repo-root
VERSIONfile is the single source of truth. The plugin is the versioned unit; skills carry no version. All three productplugin.jsonfiles (.claude-plugin/,.codex-plugin/,.cursor-plugin/) and the Claudemarketplace.jsonplugin entry must matchVERSION. Don't hand-edit them — run./scripts/sync-version.sh(or./scripts/sync-version.sh <new>to bump) to propagate, thenmake testto enforce it (test_version_file_is_source_of_truth). - Multi-platform manifests are hand-written, not generated. One canonical source
(
zymtrace/skills/); each tool gets its ownplugin.json(insidezymtrace/) and a repo-root marketplace file, all pointing at the sameskills/. They differ only in per-tool metadata and field names. zymtrace bundles no MCP server, no hooks, no commands — the MCP is connected separately viaconfigure-zymtrace-mcpand the gateway URL is per-deployment, so Codex installauthenticationisNONE. The product mapsPRODUCT_PLUGIN_JSONS/PRODUCT_MARKETPLACE_JSONSintests/conftest.pydrive the structural tests that catch drift. Codex reads.agents/plugins/marketplace.json; Cursor reads.cursor-plugin/marketplace.json. - Intra-plugin paths use
${CLAUDE_PLUGIN_ROOT}, never bare relative paths. Skills run with the user's working directory, not the skill directory, as cwd. Any script the skill runs or reference file it reads must be addressed as${CLAUDE_PLUGIN_ROOT}/skills/<skill>/scripts/<x>.sh/${CLAUDE_PLUGIN_ROOT}/skills/<skill>/reference.md. Enforced bytests/structural/test_paths.py. (Markdown navigation links between skills, e.g.[expose-zymtrace-backend](../expose-zymtrace-backend/SKILL.md), may stay relative — the agent resolves those when reading a known file.) - Scripts are executable (
chmod +x) and invoked asbash ${CLAUDE_PLUGIN_ROOT}/.... - Skill
name== directory name. - Frontmatter is just
nameanddescription(withTrigger phrases:) — the only fields skills use. Nometadatablock (author/repository/keywords live inplugin.json); no per-skill version (the plugin is the versioned unit). - Secrets never touch disk or chat — see each skill's
## Security constraints. - Helm conventions (namespace/release resolution, the single canonical values file,
--reset-then-reuse-values, backups) are centralized inzymtrace/shared/conventions.md; skills link back to it rather than repeating it.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 11d ago Changed · +7 lines · +136 tokens per session aa179d81e837
- 2mo ago First seen · 146 lines · 1,920 tokens per session scan A 2aa0b2c50552
zymtrace-skills CLAUDE.md is an instructions file published in the GitHub repository zystem-io/zymtrace-skills (5 stars, last pushed 8d ago), licensed Apache-2.0. It adds 2,056 tokens to every session, about $0.0082 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
zymtrace-skills CLAUDE.md compared with instructions from other repositories
| Mod | Type | Stars | Last push | Licence | Scan | Tokens | Works with |
|---|---|---|---|---|---|---|---|
| zymtrace-skills CLAUDE.mdzystem-io/zymtrace-skills | Instructions file | 5 | 8d ago | Apache-2.0 | A | 2,056 | Claude Code |
| vscode buildNext.instructions.mdmicrosoft/vscode | Instructions file | 195k | today | MIT | A | 9,719 | GitHub Copilot |
| vscode oss-third-party-notices.instructions.mdmicrosoft/vscode | Instructions file | 195k | today | MIT | A | 5,516 | GitHub Copilot |
| next.js AGENTS.mdvercel/next.js | Instructions file | 143k | today | MIT | A | 7,461 | Codex, OpenCode |
| langchain AGENTS.mdlangchain-ai/langchain | Instructions file | 149k | today | MIT | A | 4,680 | Codex, OpenCode |
| vscode copilot-instructions.mdmicrosoft/vscode | Instructions file | 195k | today | MIT | A | 3,093 | GitHub Copilot |
| vscode model-prompts.instructions.mdmicrosoft/vscode | Instructions file | 195k | today | MIT | A | 2,022 | GitHub Copilot |