Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add AnantKumar17/repo-scaffold --skill scaffoldgit clone --depth 1 https://github.com/AnantKumar17/repo-scaffoldWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/anantkumar17/repo-scaffold/scaffold)<a href="https://agentmods.dev/skills/anantkumar17/repo-scaffold/scaffold"><img src="https://agentmods.dev/badge/skills/anantkumar17/repo-scaffold/scaffold/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/anantkumar17/repo-scaffold/scaffold"><img src="https://agentmods.dev/badge/skills/anantkumar17/repo-scaffold/scaffold.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00059 | $0.08110 |
| Opus 5 | $0.00030 | $0.04055 |
| Sonnet 5 | $0.00012 | $0.01622 |
| Haiku 4.5 | $0.00006 | $0.00811 |
Grade C, and why
scaffold scanned grade C with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Reads agent configuration directoriesmediumAgent snooping
.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.
cat ~/.claude/plugins/cache/local/repo-scaffold/1.0.0/skills/scaffold/templates/claude-md.template.md Enumerates other installed skillsmediumAgent snooping
Other skills' SKILL.md files reveal prompts, capabilities and secrets that should be invisible to peers.
ls -1 .claude/skills/ 2>/dev/null || echo "NONE" How it starts
The opening of the file, as written. The whole thing — 933 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Scaffold Skill
Overview
When invoked, perform a complete repository analysis and generate CLAUDE.md and skills. Follow these steps exactly and in order.
Step 1: Parse Arguments and Check Current State
Parse Mode Flags
Check the arguments for flags:
--dry-run: Preview mode, don't write files--force: Regenerate everything, skip confirmations--skills-only: Only generate skills (skip CLAUDE.md and AGENTS.md)--claude-md-only: Only generate CLAUDE.md (skip skills and AGENTS.md)--agents-md-only: Only generate AGENTS.md (skip CLAUDE.md and skills)--package <name>: Monorepo mode, target specific package
If no flag is specified, perform a full generation (CLAUDE.md + AGENTS.md + skills).
Store the mode for later steps.
Check Current State
Run these checks:
-
Check if
CLAUDE.mdexists:test -f CLAUDE.md && echo "EXISTS" || echo "MISSING" -
Check if
.claude/skills/directory exists:test -d .claude/skills && echo "EXISTS" || echo "MISSING" -
If
CLAUDE.mdexists, read its first line to check for the scaffold marker:head -1 CLAUDE.md -
If
.claude/skills/exists, list all skill directories:ls -1 .claude/skills/ 2>/dev/null || echo "NONE" -
Check for monorepo structure:
ls -1 {turbo.json,nx.json,lerna.json,pnpm-workspace.yaml} 2>/dev/null | head -1
Store these results as your "current state".
Step 2: Reconnaissance
Gather comprehensive repository data. Use Read, Glob, and Bash tools.
A. Configuration Files
Read full content if found (use Read tool):
package.json/pyproject.toml/Cargo.toml/go.mod/pom.xml/build.gradletsconfig.json/jsconfig.json.eslintrc*/.prettierrc*/ruff.toml/.rubocop.yml/golangci.ymlnext.config.*/vite.config.*/webpack.config.*/nuxt.config.*docker-compose.yml/Dockerfile.env.example/.env.templateturbo.json/nx.json/lerna.json/pnpm-workspace.yaml(for monorepos)
What ships with it
14 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- templates/agents-md.template.md 5.9 KB
- templates/claude-md.template.md 2.7 KB
- templates/skills/api-doc-generator.md 4.4 KB
- templates/skills/api-route-generator.md 1.7 KB
- templates/skills/changelog-updater.md 2.0 KB
- templates/skills/ci-workflow-helper.md 1.3 KB
- templates/skills/code-reviewer.md 2.4 KB
- templates/skills/component-generator.md 1.6 KB
- templates/skills/cross-package-refactor.md 2.4 KB
- templates/skills/db-migration-helper.md 2.1 KB
- templates/skills/doc-writer.md 1.6 KB
- templates/skills/dockerfile-optimizer.md 2.0 KB
- templates/skills/observability.md 3.5 KB
- templates/skills/security-scanner.md 3.6 KB
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 10d ago First seen · 933 lines · 59 tokens per session scan C b2d8cc421711
scaffold is a skill published in the GitHub repository AnantKumar17/repo-scaffold (2 stars, last pushed 4mo ago), licensed MIT. It adds 59 tokens to every session and 8,110 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it C with 2 findings (reads agent configuration directories, enumerates other installed skills). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
miniapp-devtools-cli-repair
Diagnose WeChat DevTools failures through the official CLI instead of relying only on GUI screenshots. Use when Codex needs to run open, preview, or related commands, discover the live service port, classify whether a failure is CLI-visible, host-side, or outside preview scope, and apply or suggest only safe…
miniapp-center-hub-refactor
Refactor a growing WeChat Mini Program whose top-level navigation has become scattered across tabs such as home, profile, inbox, integrations, or settings into a clearer hub or center structure. Use when Codex needs to regroup top-level tabs, separate high-frequency action flows from low-frequency settings, define…
miniapp-devtools-gui-check
Use host-side WeChat DevTools automation to inspect GUI-only runtime and interaction failures that do not show up in CLI preview. Trigger when page entry, taps, websocket-based DevTools automation, or run-directory evidence such as report.json and trace.log are needed to separate repo bugs from IDE session problems…
miniapp-devtools-recovery
Recover a WeChat Mini Program repository after wrong-root import, DevTools template residue, stale compile conditions, or TypeScript-recognition drift. Use when Codex needs to restore the intended repo shape, remove generated clutter, or tell the user exactly what to fix inside DevTools.
miniapp-official-scaffold-alignment
Validate or design a WeChat Mini Program scaffold, repository layout, or TypeScript setup against official platform rules. Use when Codex needs to review project.config.json, app.json, miniprogramRoot, page or component file sets, or the initial repo skeleton before feature work begins.
miniapp-user-facing-copy-trim
Simplify on-page WeChat Mini Program copy so main surfaces become shorter, more action-first, and more user-facing. Use when Codex needs to trim verbose labels, mixed implementation detail, over-explained settings, or long empty-state and status text without changing the underlying business flow.