Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add arch3rPro/dsh-skills --skill code-conventionsgit clone --depth 1 https://github.com/arch3rPro/dsh-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/arch3rpro/dsh-skills/code-conventions)<a href="https://agentmods.dev/skills/arch3rpro/dsh-skills/code-conventions"><img src="https://agentmods.dev/badge/skills/arch3rpro/dsh-skills/code-conventions/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/arch3rpro/dsh-skills/code-conventions"><img src="https://agentmods.dev/badge/skills/arch3rpro/dsh-skills/code-conventions.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00081 | $0.01216 |
| Opus 5.5 | $0.00032 | $0.00486 |
| Sonnet 5.5 | $0.00016 | $0.00243 |
| Haiku 4.5 | $0.00008 | $0.00122 |
Grade A, and why
code-conventions scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 69 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Code Conventions
A set of conventions distilled from a large, heavily-gated TypeScript codebase. Each one prevents a recurring class of mistake. They are not style preferences; they are rules that keep behavior explicit, reversible, and checked at the right boundary. Apply the ones that fit your codebase's shape; most assume a typed language and module/package boundaries.
The defining constraint: every convention makes one thing unambiguous — where a side effect can be undone, where a decision is made, where a value is validated, and what a swallow actually swallowed.
Reversible side effects
Registrations and contributions are effects, and every effect has a disposer. When a plugin, module, or service contributes something to a shared context — a listener, a schema, a provider, a slot — the registration path returns the function that undoes it. This makes reload and teardown unwind predictably. If a contribution cannot be undone, that is a design gap to name, not something to hide.
Switch on discriminant tags
When a union is closed, exhaustiveness is checked by ending the switch in assertNever. When the union is deliberately open to extension, fall through a documented default rather than a bare default that silently does nothing. The reader should always be able to tell "every case handled and proven" from "unknown case falls through on purpose."
Explicit over implicit at boundaries
Defaulting and choice-making happen at one named step, never hidden inside a downstream call. If a request carries optional fields that must resolve to concrete values, the resolution is an explicit resolve(request) → spec step in the owning implementation — not a ?? default tucked inside run(). A caller reading run() should never have to hunt for the default it applied.
Configuration over hardcoded tunables
Anything that varies by deployment is a validated configuration field, changeable by the operator — not a hardcoded constant or a test-only hook. A DEFAULT_* constant is a code smell for a choice that belongs in config. The inverse also holds: protocol constants, external specifications, and security invariants stay fixed in code; they are not configurable because someone might someday want to change them.
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 69 lines · 81 tokens per session scan A ef3d6184fe67
code-conventions is a skill published in the GitHub repository arch3rPro/dsh-skills (5 stars, last pushed 2mo ago), licensed MIT. It adds 81 tokens to every session and 1,216 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
tastemaker
Generate genuinely beautiful, on-brand UI instead of generic "AI slop" — use whenever the user asks to build, design, style, or improve a UI, landing page, dashboard, app screen, or component, whenever a PRD/spec needs a design pass before implementation, whenever the user pastes reference images/Pinterest/Dribbble…
fde
Keeps the engagement record for client work. Use when they name a client or stakeholder. Use when they debrief a meeting or paste notes. Use when they ask what was agreed. Use when they run a POC, change the client's codebase, prove it on their staging, go live, or need evals before a model acts. Use when they prep a…
board-memo
Draft a board or executive summary of an engagement using outcomes, risks and investment decisions. Use when the sponsor needs to brief senior leadership.
brief
Clarify a new customer brief, desired outcome, constraints and evidence gaps. Use for kickoff or a first meeting; do not repeat discovery already supplied.
business-case
Develop a business case for an initiative using costs, benefits, risks and evidence. Use when a sponsor needs budget or timeline justification.
earn-trust
Plan how to earn customer trust and appropriate access. Use when credibility, permissions or AI policy constrain the engagement.