Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/data-wise/craft/cinpx skills add Data-Wise/craft --skill cigit clone --depth 1 https://github.com/Data-Wise/craftWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00068 | $0.02865 |
| Opus 5 | $0.00034 | $0.01432 |
| Sonnet 5 | $0.00014 | $0.00573 |
| Haiku 4.5 | $0.00007 | $0.00286 |
Grade A, and why
project-detector scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 269 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Project Detector Skill
Intelligent detection of project types, build tools, test frameworks, and CI requirements. Used by /craft:ci:detect and related commands.
Detection Priority
Detection runs in priority order (first match wins for primary type):
| Priority | Type | Marker Files | Stack |
|---|---|---|---|
| 1 | Claude Plugin | .claude-plugin/plugin.json |
plugin |
| 2 | MCP Server | package.json + mcp in name/deps |
mcp |
| 3 | Tauri | src-tauri/tauri.conf.json |
tauri |
| 4 | Swift Package | Package.swift |
swift |
| 5 | Swift iOS/macOS | *.xcodeproj OR *.xcworkspace |
swift |
| 6 | R Package | DESCRIPTION + NAMESPACE |
r |
| 7 | R Quarto | _quarto.yml + *.qmd |
r |
| 8 | Python UV | pyproject.toml + uv.lock |
python |
| 9 | Python Poetry | pyproject.toml + poetry.lock |
python |
| 10 | Python Pip | pyproject.toml OR setup.py |
python |
| 11 | Node Bun | package.json + bun.lock |
node |
| 12 | Node PNPM | package.json + pnpm-lock.yaml |
node |
| 13 | Node Yarn | package.json + yarn.lock |
node |
| 14 | Node NPM | package.json + package-lock.json |
node |
| 15 | Rust | Cargo.toml |
rust |
| 16 | Go | go.mod |
go |
| 17 | Java Maven | pom.xml |
java |
| 18 | Java Gradle | build.gradle OR build.gradle.kts |
java |
| 19 | Homebrew Tap | Formula/*.rb OR Casks/*.rb |
homebrew |
| 20 | ZSH Plugin | *.plugin.zsh OR functions/*.zsh |
zsh |
| 21 | Emacs Package | *.el + -pkg.el |
elisp |
| 22 | Shell | *.sh + no other markers |
shell |
Detection Algorithm
from pathlib import Path
from dataclasses import dataclass
from typing import Optional
@dataclass
class ProjectInfo:
"""Detected project information."""
type: str # Primary type (python, node, r, etc.)
variant: str # Specific variant (uv, poetry, npm, etc.)
test_framework: str # pytest, jest, testthat, etc.
build_tool: str # uv, npm, cargo, etc.
ci_template: str # Recommended CI template
python_versions: list # For Python projects
node_versions: list # For Node projects
has_docs: bool # Has documentation setup
has_ci: bool # Already has CI configured
DETECTORS = [
# (type, variant, required_files, optional_files)
# Priority 1-5: Specialized/hybrid projects
("plugin", "claude", [".claude-plugin/plugin.json"], []),
("mcp", "server", ["package.json"], []), # Check for mcp in name/deps
("tauri", "app", ["src-tauri/tauri.conf.json"], ["src-tauri/Cargo.toml"]),
("swift", "package", ["Package.swift"], ["Sources/"]),
("swift", "xcode", [], []), # Special: glob for *.xcodeproj
# Priority 6-7: R ecosystem
("r", "package", ["DESCRIPTION", "NAMESPACE"], ["R/", "tests/"]),
("r", "quarto", ["_quarto.yml"], ["*.qmd"]),
# Priority 8-10: Python ecosystem
("python", "uv", ["pyproject.toml", "uv.lock"], ["src/"]),
("python", "poetry", ["pyproject.toml", "poetry.lock"], ["src/"]),
("python", "pip", ["pyproject.toml"], ["requirements.txt"]),
("python", "setuptools", ["setup.py"], ["setup.cfg"]),
# Priority 11-14: Tooling projects (check BEFORE Node to catch hybrids)
("homebrew", "tap", [], []), # Special: glob for Formula/*.rb
("zsh", "plugin", [], []), # Special: glob for *.plugin.zsh
("elisp", "package", [], []), # Special: glob for *-pkg.el
# Priority 15-18: Node ecosystem (requires real Node project, not just tooling)
("node", "bun", ["package.json", "bun.lock"], []),
("node", "pnpm", ["package.json", "pnpm-lock.yaml"], []),
("node", "yarn", ["package.json", "yarn.lock"], []),
("node", "npm", ["package.json"], ["package-lock.json"]),
# Priority 19-20: Other compiled languages
("rust", "cargo", ["Cargo.toml"], ["Cargo.lock"]),
("go", "mod", ["go.mod"], ["go.sum"]),
("java", "maven", ["pom.xml"], []),
("java", "gradle", ["build.gradle"], ["build.gradle.kts"]),
# Priority 21: Fallback
("shell", "script", [], []), # Fallback for *.sh
]
def is_real_node_project(path: Path) -> bool:
"""Check if package.json indicates a real Node.js project vs just tooling.
A real Node.js project has at least one of:
- 'main' field (library entry point)
- 'bin' field (CLI commands)
- 'dependencies' (not just devDependencies)
- 'type': 'module' with actual source files
Projects with only devDependencies (ESLint, Prettier, etc.) are
just using Node tooling, not actual Node.js projects.
"""
pkg = path / "package.json"
if not pkg.exists():
return False
import json
try:
data = json.loads(pkg.read_text())
except json.JSONDecodeError:
return False
# Has entry point = real Node project
if data.get("main"):
return True
# Has CLI commands = real Node project
if data.get("bin"):
return True
# Has real dependencies (not just devDependencies) = real Node project
if data.get("dependencies") and len(data["dependencies"]) > 0:
return True
# Has exports field = real Node project (modern ESM)
if data.get("exports"):
return True
# Only has devDependencies = just tooling, not a Node project
return False
def detect_project(path: Path) -> Optional[ProjectInfo]:
"""Detect project type from directory contents."""
for proj_type, variant, required, optional in DETECTORS:
if all((path / f).exists() for f in required):
# Special handling for Node.js - skip if only tooling
if proj_type == "node" and not is_real_node_project(path):
continue # Skip Node detection, try next detector
return ProjectInfo(
type=proj_type,
variant=variant,
test_framework=detect_test_framework(path, proj_type),
build_tool=variant,
ci_template=f"{proj_type}-{variant}",
python_versions=detect_python_versions(path) if proj_type == "python" else [],
node_versions=detect_node_versions(path) if proj_type == "node" else [],
has_docs=detect_docs(path),
has_ci=(path / ".github/workflows").exists(),
)
return None
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 269 lines · 68 tokens per session scan A 736fefe2b006
project-detector is a skill published in the GitHub repository Data-Wise/craft (4 stars, last pushed 16d ago), licensed MIT. It adds 68 tokens to every session and 2,865 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
github-actions-workflow
Scaffolds or audits a GitHub Actions CI/CD workflow for a project. Covers job structure, caching, secrets handling, concurrency groups, environment gates, and reusable workflows via workflowcall. Invoked when the user asks to set up CI, add a GitHub Actions workflow, improve pipeline performance, or share workflow…
specflow
Spec-driven development with executable contracts.
specflow-loop-selector
Selects the correct Specflow loop and forces a concrete run contract before work starts. Use when an agent is asked to start Specflow work, build a ticket, create/refine a PRD, investigate an existing product, run Gate D, choose between spec-build and feature-build, or "go find out about" Specflow loops. Compatible…
specflow-simulate
Simulates end-to-end usage of a Specflow story across multiple personas and divergent routes to discover gaps, edge cases, and unhandled branches BEFORE the story is built — then proposes each finding as a concrete story addition (new REQ, negative-path AC, Gherkin branch, or journey step). This is the high-value…
sync-confluence
Syncs engineering documentation (ADR, RFC, architecture) from docs/engineering/ to Confluence Cloud using the mark tool. Operates in two modes: scaffold (creates the directory tree locally) and CI sync (pushes on every main push). Only files with mark metadata headers are synced. Enforces diagram hierarchy (Mermaid >…
specflow-audit
Audits a Specflow story/ticket for spec-compliance and surgically uplifts it — adding only the missing executable contract sections (SQL/RLS, TypeScript interfaces, invariant codes, Gherkin, acceptance criteria, Definition of Done, data-testid coverage) — then runs a pre-flight gate that refuses to mark the ticket…