Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/clever-cc-plugins/cc-confignpx agentmods add skills/clever-cc-plugins/cc-config/bootstrapping-configWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/clever-cc-plugins/cc-config/bootstrapping-config)<a href="https://agentmods.dev/skills/clever-cc-plugins/cc-config/bootstrapping-config"><img src="https://agentmods.dev/badge/skills/clever-cc-plugins/cc-config/bootstrapping-config/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/clever-cc-plugins/cc-config/bootstrapping-config"><img src="https://agentmods.dev/badge/skills/clever-cc-plugins/cc-config/bootstrapping-config.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00107 | $0.07649 |
| Opus 5.5 | $0.00043 | $0.03060 |
| Sonnet 5.5 | $0.00021 | $0.01530 |
| Haiku 4.5 | $0.00011 | $0.00765 |
Grade D, and why
bootstrapping-config scanned grade D with 3 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 22d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Reads agent configuration directoriesmediumAgent snooping
.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.
Also flag (as advisory text, not a file to write) the `alwaysThinkingEnabled` and `effortLevel` settings in `~/.claude/settings.json` — these are usually user-level, not project-level, but they control thinking budget mo Recursive force deletehighDestructive command
rm -rf with a variable or a broad path is one typo away from removing the wrong tree.
"Bash(rm -rf:*)" Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
"Bash(curl:*)", How it starts
The opening of the file, as written. The whole thing — 492 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Bootstrap Claude Code Configuration
You are setting up a Claude Code configuration from scratch. The project directory may be empty or nearly empty. Your goal is to create a lean, high-quality baseline that works for any project regardless of language, framework, or tooling.
Philosophy
Every line in CLAUDE.md costs context tokens on every single message. Frontier models follow ~150–200 instructions reliably; the system prompt already uses ~50. That leaves ~100–150 slots before quality degrades across all rules. Configuration is a multiplier on everything Claude Code does — invest in it upfront, keep it lean, let automation compound.
The single most impactful principle: give Claude a way to verify its work. If Claude has a feedback loop (tests, linters, type checkers), output quality doubles or triples.
Step 0: Recall learnings
If .claude/learnings.md exists, read all entries and apply them silently to inform this run. The [skill-name] tag on each entry is provenance only — all entries apply regardless of which skill wrote them. Do not announce that learnings were loaded.
If the file does not exist, proceed without mention.
Step 1: Gather context
Before creating any files, understand what you're working with.
- Check if a git repo exists. If not, do NOT create one — just note it for the user.
- Look for existing config:
CLAUDE.md,AGENTS.md,.claude/,.mcp.json,context/. If any exist, tell the user this skill is for fresh setups and suggest using/auditing-configinstead. - Scan for clues about the project. Cover both code and content projects:
- Code:
package.json,composer.json,Cargo.toml,pyproject.toml,go.mod,Makefile,Gemfile,pom.xml,build.gradle, any*.slnor*.csprojfiles. - Content / static sites / docs:
hugo.toml,config.toml,config.yaml(Hugo),_config.yml(Jekyll),astro.config.*,.eleventy.js,mkdocs.yml,content/,articles/,posts/,_posts/, dominant.mdfiles, knowledge base or style guide files (STYLE.md,style-guide.md). - Always check
README.mdfor purpose. - Design system:
DESIGN.mdat the project root (open-source format — YAML design tokens + Markdown rationale; Claude Code and other agents read it automatically). Also checkcontext/design/for Claude Design handoff artifacts (PROMPT.md, design-notes.md, screenshots/).
- Code:
- Check for existing quality tools:
- Code:
.eslintrc*,.prettierrc*,phpcs.xml*,rustfmt.toml,.editorconfig, CI configs (.github/workflows/,.gitlab-ci.yml), pre-commit configs. - Content:
.vale.ini/vale.ini,.markdownlint.{json,yaml,yml}, prettier configured for Markdown.
- Code:
- Check for sensitive files:
.env,.env.*,secrets/, any*credentials*or*secret*files. - GitHub Actions: Check whether
.github/exists or the git remote points to GitHub. Note the result — used in Step 4a.
What ships with it
3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 22d ago Changed · -4 lines f59dc1768508
- 1mo ago First seen · 496 lines · 107 tokens per session scan D 59c663dbd474
bootstrapping-config is a skill published in the GitHub repository clever-cc-plugins/cc-config (1 stars, last pushed 14d ago), licensed MIT. It adds 107 tokens to every session and 7,649 once invoked, about $0.0004 per session on Opus 5.5. A static security scan graded it D with 3 findings (reads agent configuration directories, recursive force delete, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
atomize
Use this skill to repurpose one core message across multiple content formats in a single run — e.g. turning a campaign brief or a single piece into a LinkedIn post, newsletter, and blog post at once, each properly adapted to its own conventions while keeping the core claim and proof points identical. Invoke when the…
blog-article
Use this skill when the owner wants to write, draft, or generate a blog article. Invoke when the user says "write a blog article", "draft a blog post", "create a blog article", "generate a blog post", "write a how-to article", "draft a thought leadership piece", "write a pillar page", or similar requests for long-form…
content-onboarding
Use this skill when setting up a new marketing project with Claude Code, registering context files, or extending the context of an existing project. Invoke when the user asks to "onboard a new client", "set up context files", "initialize marketing project", "register context", "add context", or "set up project…
long-tail-copy
Use this skill to draft a finished marketing or PR text for an output format that does NOT have its own dedicated skill — for example a newsletter, whitepaper, landing-page copy, product description, email, webinar abstract, or ad copy. Invoke when the user says "draft a newsletter", "write the copy for this landing…
facebook-post
Use this skill when the owner wants to write, draft, or generate a Facebook post. Invoke when the user says "write a Facebook post", "create a Facebook post", "draft for Facebook", "write for Facebook", or "generate a Facebook post".
humanize
Use this skill to remove AI "tells" from an existing draft and make it read as human-written, calibrated to the project's brand voice. Invoke when the user says "humanize this", "make this sound less AI", "remove AI tells from this", "this reads like ChatGPT wrote it", "polish this draft to sound human", or pastes a…