Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/comisai/comis/claude-codenpx skills add comisai/comis --skill claude-codegit clone --depth 1 https://github.com/comisai/comisWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00117 | $0.02984 |
| Opus 5 | $0.00059 | $0.01492 |
| Sonnet 5 | $0.00023 | $0.00597 |
| Haiku 4.5 | $0.00012 | $0.00298 |
Grade A, and why
claude-code scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 139 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Driving Claude Code (interactive)
Claude Code is itself a capable coding agent. You operate it like a developer at a terminal: launch the interactive TUI, give it the task, let it work, answer its prompts, and verify. You drive it through the terminal_session_* tools — create, send_text (type), send_key (a keystroke), read (the screen), wait, status, kill.
Use this for any non-trivial coding work (build a project, add a feature, fix a bug, write+run tests). Prefer it over running raw shell commands yourself.
You already have this guide — do NOT go hunting for it. This SKILL.md is injected into your context; the numbered steps below are everything you need. Do not
find/read/exec/grepfor a "claude-code" or "SKILL.md" file, nor for the project folder or "how to drive claude" — that hunt FAILS (the file is outside your exec sandbox, and a guessed path like~claude-code/SKILL.mdtrips the path-traversal guard), and flailing on those tool errors is what derails a drive into wrongly reporting "the message came through empty." Your task is in THIS conversation. If you're unsure what to build, re-read the request you were given — never claim the message was empty/missing when a task was provided. Go straight to §1 below (create the session) and drive; your first tool call should beterminal_session_create, not a filesystem search.
1. Launch — always in a named project
Call terminal_session_create with:
allowId: "claude",command: "claude"project: "<short-kebab-name>"— this is mandatory for coding work. It opens a dedicated, persistent folder<workspace>/projects/<name>/you can come back to. New project → a new name. To fix or extend an existing project, pass the sameprojectname (the folder and its code are reused). Do NOT usecwd, and do NOT rely on the displayname— onlyprojectcreates a retrievable folder.- pick a clear
projectname from the task ("todo-app", "rate-limiter", "snake-game").
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 139 lines · 117 tokens per session scan A 4cd2d347033e
claude-code is a skill published in the GitHub repository comisai/comis (5 stars, last pushed 2d ago), licensed Apache-2.0. It adds 117 tokens to every session and 2,984 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
org-sync
Use when the CEO wants an organization-wide sync across PuPu's agent teams — running each org's internal sync, then a cross-org sync where departments challenge each other, converging into one decision list. Triggers: "跑一次 org sync", "全局同步", "组织盘点", "/org-sync", "各部门现在什么情况", "有什么要我拍板的".
release-feature-audit
Use when a new PuPu feature finishes implementation and needs its consistency audit before its ticket is marked done — "audit #123", "审计这个功能", "这个 feature 过一遍检查" — or when release-close-sprint roll-call finds a new feature that was never audited. Also covers standalone i18n checks ("漏翻了吗", "检查 i18n"), which used to be…
growth-analyst
Use when analyzing PuPu's open-source growth or health for the founder — GitHub traffic, downloads/installs, releases, community, or contributor activity — or when producing a growth report or weekly COO report. Repo is haoxiang-xu/PuPu. Triggers: "how is PuPu growing?", "are people installing PuPu?", "which release…
test-api
Use when running QA / regression tests against PuPu, when verifying a code change actually works in the running app, or when reading PuPu UI/state without screenshotting manually. Triggers on tasks like "test that PuPu still creates chats correctly", "verify the new model selector works end-to-end", "send a message…
gitnexus-impact-analysis
Use when the user wants to know what will break if they change something, or needs safety analysis before editing code. Examples: "Is it safe to change X?", "What depends on this?", "What will break?".
gitnexus-refactoring
Use when the user wants to rename, extract, split, move, or restructure code safely. Examples: "Rename this function", "Extract this into a module", "Refactor this class", "Move this to a separate file".