Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add AlexZio00/sovereign-skills --skill project-initgit clone --depth 1 https://github.com/AlexZio00/sovereign-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/alexzio00/sovereign-skills/project-init)<a href="https://agentmods.dev/skills/alexzio00/sovereign-skills/project-init"><img src="https://agentmods.dev/badge/skills/alexzio00/sovereign-skills/project-init/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/alexzio00/sovereign-skills/project-init"><img src="https://agentmods.dev/badge/skills/alexzio00/sovereign-skills/project-init.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Privilege Escalation · line 294 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00082 | $0.03768 |
| Opus 5 | $0.00041 | $0.01884 |
| Sonnet 5 | $0.00016 | $0.00754 |
| Haiku 4.5 | $0.00008 | $0.00377 |
Grade A, and why
project-init scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 397 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Project Init — New Project Design Interview
Dominant Variable
Do interview decisions map exactly to generated files? — If interview answers conflict with CLAUDE.md/ROADMAP content, the project starts on a false premise.
Purpose
Capture every critical decision before writing a single line of code. Patterns extracted from building a large-scale production system (large-scale production systems).
Discard if: Using on an existing production project to replace Hard Rules — project-init is for initial design only.
Trigger
/project-init- "새 프로젝트"
- "프로젝트 생성"
- "project setup"
Key Assumptions
- Empty or new project directory — if broken: existing file conflicts need resolution.
- Write tool accessible — if broken: output file contents as code blocks and user saves manually.
Phase 0: Context Check
0-1. Existing CLAUDE.md Detection
Check if CLAUDE.md exists in the current working directory.
- Not found → proceed to Phase 1 normally.
- Found → read it, then ask:
CLAUDE.md already exists. What would you like to do? 1. Update — enhance based on existing content (keep Hard Rules, add missing sections) 2. Rewrite — start fresh from scratch (delete existing content) 3. Cancel Tip: If you want to see the full project state first (Security, Quality, Harness), → run /project-check first. Then come back here and select Update mode.- Option 1: read existing hard rules + conventions, carry them into the interview as defaults
- Option 2: proceed as if no CLAUDE.md exists
- Option 3: stop
0-2. Brief / Context File
If the user provides a file path or pastes a project brief, read it first. Extract any stack decisions or constraints to pre-fill interview answers.
0-3. Smart Defaults
After Phase 0, check for context clues before asking each Q.
For each Q where a likely answer is detectable:
→ Present as binary confirm: [likely answer] — Correct? (Y/n)
→ Y: accept and move to next Q immediately
→ N: ask the full open-ended question
What ships with it
3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago Changed · -1 lines 65aaee3afcba
- 11d ago First seen · 398 lines · 82 tokens per session scan A 1866ce5dfdfe
project-init is a skill published in the GitHub repository AlexZio00/sovereign-skills (128 stars, last pushed 4d ago), licensed MIT. It adds 82 tokens to every session and 3,768 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
issue-creation
Trigger: issue creation, bug reports, feature requests, or issue approval. Create and triage GitHub issues from repository evidence.
sdd-tasks
Break an SDD change into implementation tasks. Trigger: orchestrator launches task planning for a change.
systemic-issue-triage
Trigger: new issue, bug report, triage, backlog, issue flood, community report, root cause, dead-end, blocked user. Attack issues by root class, never one-by-one; fixes must shrink the system, not grow it.
github-triage
Read-only GitHub triage for issues AND PRs. 1 item = 1 background task (category: quick). Analyzes all open items and writes evidence-backed reports to /tmp/{datetime}/. Every claim requires a GitHub permalink as proof. NEVER takes any action on GitHub - no comments, no merges, no closes, no labels. Reports only.…
finn-review
Review open PRs against their linked Linear issues and required GitHub checks, then post a three-group verdict with Finn-loop labels. Use when asked to run Finn-loop's reviewer or review its PR queue. Designed for /loop; never merges or pushes code.
jira
Unified Jira entry point. Routes to preview (default), create, or review subcommands.