Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add byerlikaya/claude-starter-kit --skill adrgit clone --depth 1 https://github.com/byerlikaya/claude-starter-kitWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/byerlikaya/claude-starter-kit/adr)<a href="https://agentmods.dev/skills/byerlikaya/claude-starter-kit/adr"><img src="https://agentmods.dev/badge/skills/byerlikaya/claude-starter-kit/adr/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/byerlikaya/claude-starter-kit/adr"><img src="https://agentmods.dev/badge/skills/byerlikaya/claude-starter-kit/adr.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Prompt Injection · line 10 Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.Fix: Audit all comments and invisible characters. Remove any instructions that direct the agent to perform unauthorized actions. Use plain, reviewable content.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00027 | $0.00982 |
| Opus 5.5 | $0.00011 | $0.00393 |
| Sonnet 5.5 | $0.00005 | $0.00196 |
| Haiku 4.5 | $0.00003 | $0.00098 |
Grade A, and why
adr scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 77 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Architecture Decision Record (ADR)
Trigger phrases: "adr", "architecture decision", "decision record", "why this approach", "why we chose", "why we went with", "nobody remembers why", "why we picked"
When
On an architecture/technology choice that is expensive to reverse, long-lived, or contested (database selection, auth strategy, critical pattern). Small/reversible decisions do not require an ADR.
Most of these are never announced as decisions, and that is how they get missed. The examples above all sound like a question someone asked — "Redis or Postgres?" — so they are easy to recognise. The ones that actually escape arrive inside ordinary build work: you are asked to add a feature, and along the way you settle what an entity owns, what a session is bound to, what makes a row unique, which layer holds a rule. Nobody said "decide"; you decided anyway, and the next person inherits it with no idea it was a choice. Measured in the field: one infrastructure task settled four such questions and produced no record of any of them, in a session where this skill was installed and its trigger read every turn.
So the test is not "was I asked to choose". It is: would a maintainer six months from now, wanting to do this differently, need to know why it is this way? If yes, it is an ADR, however undramatic it felt while writing it. Cheap tell: you rejected an alternative in your head and moved on without writing it down.
On a team, the record ALSO goes on the board
docs/ is gitignored in an install, so an ADR written there reaches the machine that wrote it and nobody else —
which is the opposite of what a decision record is for. When a teamboard exists, record it with
board.sh decide "<title>" "<context + decision + consequences>" as well: the board is shared, so it arrives at
every teammate's next session opening, and it travels even when the board lives in its own repository. The local
file stays the long form; the board entry is the part that has to reach people, so it must be readable on its
own — a title nobody can act on ("auth decided") is not a record.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago Changed · +12 lines 702bf196cb5c
- 1mo ago First seen · 65 lines · 27 tokens per session scan A b9ab6d8f500a
adr is a skill published in the GitHub repository byerlikaya/claude-starter-kit (24 stars, last pushed 1mo ago), licensed MIT. It adds 27 tokens to every session and 982 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
shiplog
Recap of everything shipped since the last run - cross-repo PRs, security fixes, star deltas, and X traction, synthesized into a digest article and a ready-to-post shiplog in your voice.
token-pick
One token recommendation and one prediction market pick - scored, quantified, with a skip branch when signals are weak.
taskmarket-delegate
Delegate work to the TaskMarket agent-worker market - browse open tasks, create tasks with explicit authorization, and track/submit work, so an agent can outsource instead of burning inference on unreliable or low-confidence work.
create-prove
Run a changed Aeon skill for real and attach SHA-bound behavioral evidence to its PR.
case-interview-practice
Interactive consulting case interview practice with structured frameworks, feedback mechanisms, and progressive difficulty. Use when preparing for management consulting interviews, case competitions, or business problem-solving exercises.
agent-flutter-developer
Specialist subagent: Flutter/Dart cross-platform development, Riverpod state management, and platform channels specialist. Use when building Flutter apps, implementing state management, or working with native platform features. Trigger phrases: Flutter, Dart, Riverpod, Bloc, widget, MaterialApp, GoRouter, platform…