mill-init

mill-init is a skill for Claude Code from aaddrick/ticketmill. It costs 65 tokens per session (2,431 once invoked), scanned C, original, MIT.

A one-time setup skill for preparing a repository to use ticketmill, the GitHub issue batch-processing system.

In plain words
What is it for?
Use it before the first batch run, or when repairing an existing setup, to verify prerequisites and configure tests, files, environment settings, and pipeline roles.
Why use it?
It checks the repository and GitHub access, creates the required profile, and maps or generates the agents that ticketmill needs.

Skill for Claude Code

Written for Claude Code: ${CLAUDE_PLUGIN_ROOT} variable. Also seen: reads .claude/ paths; mentions CLAUDE.md; mentions subagents.

Runs only inside its plugin — its command needs a path that Claude Code sets for a plugin’s own hooks and for nothing else. Install the plugin, not this.

Part of the ticketmill plugin — 4 skills, 5 agents shipped together

Good fit Use it before the first batch run, or when repairing an existing setup, to verify prerequisites and configure tests, files, environment settings, and pipeline roles.

Compare 6 skills from other repositories ↓
Install

Getting it into your agent

This one installs as part of its plugin. Adding the marketplace and installing the plugin brings it with everything else the plugin ships.

Claude Code
/plugin marketplace add aaddrick/ticketmill
Claude Code
/plugin install ticketmill

Made for: Claude Code.

Or install ticketmill, the plugin that ships this one along with the rest of its 4 skills, 5 agents.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for mill-init

README.md
[![agentmods](https://agentmods.dev/badge/skills/aaddrick/ticketmill/mill-init/github.svg)](https://agentmods.dev/skills/aaddrick/ticketmill/mill-init)
Your own site
<a href="https://agentmods.dev/skills/aaddrick/ticketmill/mill-init"><img src="https://agentmods.dev/badge/skills/aaddrick/ticketmill/mill-init/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for mill-init

Your own site · 80×15
<a href="https://agentmods.dev/skills/aaddrick/ticketmill/mill-init"><img src="https://agentmods.dev/badge/skills/aaddrick/ticketmill/mill-init.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 65 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 2,431 The whole file, excluding the scripts and references it only reads on demand.
Security scan C 2 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00065 $0.02431
Opus 5.5 $0.00026 $0.00972
Sonnet 5.5 $0.00013 $0.00486
Haiku 4.5 $0.00006 $0.00243

Measured 1mo ago against content hash ac00d4ce97cf, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade C, and why

mill-init scanned grade C with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Recursive force deletehighDestructive command

rm -rf with a variable or a broad path is one typo away from removing the wrong tree.

with `rm -rf` on cleanup (both the per-issue browser-verify stage and the final

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

If `browser` is configured, also boot `serve_command` once (any port) and curl it.
skills/mill-init/SKILL.md · 174 lines

How it starts

The opening of the file, as written. The whole thing — 174 lines — stays where its author put it; the contents beside it link to each section on GitHub.

mill-init: onboard a repo for ticketmill

Produces everything a mill run needs, and refuses to write a profile it hasn't proven works. Do the steps in order; each gates the next.

Step 1: Preconditions

  1. Confirm you are in a git repo with a GitHub remote: git rev-parse --show-toplevel and gh repo view --json nameWithOwner. Record ROOT and the owner/name slug.
  2. Confirm gh auth status succeeds and the token can write issues (gh label list is a cheap probe).
  3. If <ROOT>/.claude/ticketmill.json already exists, read it and tell the user: this run will UPDATE it (show a diff at the end), not silently replace it.

Step 2: Detect the stack and propose a profile

Inspect the repo (build files, CI config, CLAUDE.md, README) and propose values for every profile field. Show the user the proposal and confirm the load-bearing ones:

{
  "repo": "owner/name",
  "test_command": "php artisan test",
  "test_globs": ["**/*.php", "tests/**"],
  "install_commands": ["composer install --no-interaction"],
  "env_files": [".env"],
  "simplify_globs": ["**/*.php"],
  "serialize_globs": [],
  "docblock_globs": null,
  "docs_dir": null,
  "logs_dir": "logs/ticketmill",
  "claim_label": "ticketmill",
  "verify_notes": [],
  "warn_base_branches": [],
  "consolidation": true,
  "engine_owned_globs": [],
  "browser": null,
  "models": {},
  "roles": { }
}

Field rules:

  • test_command is REQUIRED and may be null ONLY as an explicit human decision. If you find no test suite, ASK: "I found no test command. Ticketmill will merge code that no automated test has exercised, and every batch PR will carry a visible 'Verification Gaps' notice. Confirm test_command: null?" Never write null on your own initiative.
  • env_files: files the test suite needs that git doesn't track (e.g. .env). They are copied root -> worktree at issue setup.
  • verify_notes: environment preconditions agents must know (required containers, seed commands, service dependencies). Anything you needed in Step 4 belongs here.
  • browser: OPT-IN. Only propose it for projects with a servable UI AND if the user wants live browser verification: { "serve_command": "... --port={port}", "build_command": null, "ui_globs": [...], "port_base": 8100, "notes": "..." }. Optional coordination overrides (each defaults to the value shown; only mention them if the user needs to change one): lock_path (default /tmp/ticketmill-browser-lock, the shared cross-agent browser lock directory), stale_seconds (default 1800, how long before a held lock is considered dead and stolen), poll_seconds (default 15, wait interval between lock-acquire retries), port_span (default 900, the modulus port_base is spread over per issue number), and artifact_dir (default /tmp/ticketmill-issue-{issue}, {issue}-templated like serve_command's {port}, where browser-verify screenshots/artifacts are written). Caution: this resolved path is deleted with rm -rf on cleanup (both the per-issue browser-verify stage and the final batch cleanup). It must be a dedicated scratch directory, never a project directory, shared mount, or $HOME.
  • lockstep_installed_paths: only needed when the repo being onboarded keeps an installed copy of an engine-owned file in lockstep with a source-of-truth file elsewhere in the same repo, kept in sync by the repo's own tooling. List those installed paths so the engine's post-implement guardrail exempts them from a hard revert instead of undoing genuine engine work. Ticketmill's own profile (this repo, self-hosted) sets lockstep_installed_paths: [".claude/workflows/ticketmill.js"], since scripts/lint-engine.js keeps that installed copy byte-identical to workflows/ticketmill.js. Leave it empty for every other repo.
  • serialize_globs: OPTIONAL, default []. Lane scheduling (issue #1) already predicts likely file overlap per issue and serializes those issues instead of racing them. This field is only for files that heuristic alone can't be trusted to catch: a magnet config, a shared schema/router, anything where two issues touching it concurrently would conflict even if their predicted-file sets don't otherwise overlap. Leave it [] unless the user names such a file; propose it only when the stack detection in Step 2 surfaces an obvious candidate (e.g. a single central routes/config file every feature touches).
  • warn_base_branches: OPTIONAL, default []. Base branch names that should trigger a Select-phase warning when a batch targets one (a signal the run may be pointed at a branch that auto-deploys on push rather than the intended working branch). Leave it [] unless the user names CI/CD-trigger branches for this repo (e.g. a deploy-prod/deploy-dev convention). Never propose a default on your own.
  • consolidation: OPTIONAL, default true. Leave it true unless the user asks to disable the Select-phase consolidation gate that groups issues cheaper to resolve as one unit; set false to skip that gate agent call entirely.
  • engine_owned_globs: OPTIONAL, default []. Extends the built-in engine-owned path set with repo-specific read-only paths, beyond lockstep_installed_paths above. Leave it [] unless the user names additional paths a run must never touch.
  • models: OPTIONAL, default {}. Per-stage model/effort overrides. The valid stage keys are enumerated in the header schema comment of workflows/ticketmill.js, adjacent to the M map that is their source of truth. Do not re-derive or duplicate that list here.

Read the full file on GitHub · 174 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 1mo ago First seen · 174 lines · 65 tokens per session scan C ac00d4ce97cf

Subscribe to this mod's changes

mill-init is a skill published in the GitHub repository aaddrick/ticketmill (16 stars, last pushed 2mo ago), licensed MIT. It adds 65 tokens to every session and 2,431 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it C with 2 findings (recursive force delete, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.