Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add byerlikaya/claude-starter-kit --skill trace-scangit clone --depth 1 https://github.com/byerlikaya/claude-starter-kitWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/byerlikaya/claude-starter-kit/trace-scan)<a href="https://agentmods.dev/skills/byerlikaya/claude-starter-kit/trace-scan"><img src="https://agentmods.dev/badge/skills/byerlikaya/claude-starter-kit/trace-scan/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/byerlikaya/claude-starter-kit/trace-scan"><img src="https://agentmods.dev/badge/skills/byerlikaya/claude-starter-kit/trace-scan.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00058 | $0.00588 |
| Opus 5 | $0.00029 | $0.00294 |
| Sonnet 5 | $0.00012 | $0.00118 |
| Haiku 4.5 | $0.00006 | $0.00059 |
Grade B, and why
trace-scan scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Reads agent configuration directoriesmediumAgent snooping
.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.
| grep -iEf .claude/hooks/trace-blocklist.txt What it actually says
Trace Scan (trace-scan)
Trigger phrases: "scan traces", "trace scan", "AI trace", "check vendor name", "pre-commit audit"
Purpose: to bind §4.1/§4.2 to a gate rather than to memory. If the rule lives only in text, a trace leaks sooner or later; this skill + the hooks stop the leak at commit time.
When
- Before every commit (automatic:
pre-commit+commit-msghooks). - Before commit-agent-csk proposes a message (manual verification).
How
Pattern list: ./.claude/hooks/trace-blocklist.txt (grep -iE, one pattern per line).
- Defaults are high-hit: co-author trailers, auto-generation footers, robot emoji, and AI-assistant/tool brand names. Standalone words that occur too often (model/assistant) are DELIBERATELY excluded. See trace-blocklist.txt for the exact list.
- Vendor name is project-specific: ADD the name of the third-party template in use to the list (§4.2).
Manual scan (a quick look without the hook):
git diff --cached --unified=0 | grep -E '^\+' | grep -Ev '^\+\+\+' \
| grep -iEf .claude/hooks/trace-blocklist.txt
Hook setup
start.sh sets git config core.hooksPath .claude/hooks (if there is a git repo). The hooks live
under .claude → they are in gitignore and stay local (§4.3). To do it later for a repo:
git config core.hooksPath .claude/hooks
chmod +x .claude/hooks/pre-commit .claude/hooks/commit-msg
Rules
- If there is a finding, the commit STOPS; the phrase is removed and the real rationale is written in human Turkish.
- Skipping with
--no-verifyonly on an EXPLICIT request (§4.5); the hook is not skipped silently. - On a false positive, narrow/remove the pattern — the list is set up by the project owner.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 6d ago First seen · 46 lines · 58 tokens per session scan B bbc250c0a7b6
trace-scan is a skill published in the GitHub repository byerlikaya/claude-starter-kit (22 stars, last pushed yesterday), licensed MIT. It adds 58 tokens to every session and 588 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it B with 1 finding (reads agent configuration directories). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
security-pipeline
Use when security verification is needed - pre-commit security checks, vulnerability scanning, STRIDE threat analysis. Integrates with /handoff-verify --security and /commit-push-pr. CWE Top 25 based.
repo-stats-autoupdate
Keeps README badge + inline counts in sync with the real number of skills, agents, graph nodes/edges, communities, converted pipelines, and test inventory. Runs automatically on every commit via a git pre-commit hook. Use when the README drifts from reality or before publishing a release.
caveman-commit
Ultra-compressed commit message generator. Cuts noise from commit messages while preserving intent and reasoning. Conventional Commits format. Subject ≤50 chars, body only when "why" isn't obvious. Use when user says "write a commit", "commit message", "generate commit", "/commit", or invokes /caveman-commit.…
no-mistakes
Validate committed feature-branch changes through the no-mistakes pipeline: intent, rebase, review, test, docs, lint, push, PR, and CI. Use when the user asks to run no-mistakes, ship safely, validate before pushing, or gate a change before it reaches upstream.
core-workflow
Detailed development workflow patterns, checklists, and standards. Auto-loads for complex tasks, planning, debugging, testing, or when explicit patterns are needed. Contains session protocols, git conventions, security checklists, testing strategy, and communication standards.
contribute
Complete contribution workflow using git-town. Create branch → commit → PR → ship. Preflight at every step.