claude-md-progressive-disclosurer

claude-md-progressive-disclosurer is a skill for Codex from daymade/claude-code-skills. It costs 123 tokens per session (11,668 once invoked), scanned A, original, MIT.

An organizer for CLAUDE.md and AGENTS.md files, which contain instructions that coding assistants read when working in a project. It restructures these instructions so relevant details are shown when needed without losing information.

In plain words
What is it for?
Auditing, slimming, restructuring, or splitting assistant instruction files, and investigating why rules are not being followed.
Why use it?
Large or repeated instruction files can hide important rules and make assistants follow them inconsistently. It helps keep one clear source for each rule and reduces distraction from unrelated guidance.

Skill for Codex

Written for Codex: reads ~/.codex or $CODEX_HOME. Also seen: reads .claude/ paths; mentions CLAUDE.md; mentions Claude Code.

Part of the daymade-claude-code plugin — 19 skills shipped together

Good fit Auditing, slimming, restructuring, or splitting assistant instruction files, and investigating why rules are not being followed.

Compare 6 skills from other repositories ↓
Install with agentmods
npx agentmods add skills/daymade/claude-code-skills/claude-md-progressive-disclosurer
About the project

Claude Code Skills Marketplace is a collection and marketplace of skills, plugins, agents, and instructions that extend Claude Code with specialized development workflows. It is for developers who want to install existing workflows or create, validate, and package their own Claude Code skills.

daymade/claude-code-skills · 1,388 stars · on GitHub

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent
npx skills add daymade/claude-code-skills --skill claude-md-progressive-disclosurer
Clone the repo
git clone --depth 1 https://github.com/daymade/claude-code-skills

Made for: Codex.

Or install daymade-claude-code, the plugin that ships this one along with the rest of its 19 skills.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for claude-md-progressive-disclosurer

README.md
[![agentmods](https://agentmods.dev/badge/skills/daymade/claude-code-skills/claude-md-progressive-disclosurer/github.svg)](https://agentmods.dev/skills/daymade/claude-code-skills/claude-md-progressive-disclosurer)
Your own site
<a href="https://agentmods.dev/skills/daymade/claude-code-skills/claude-md-progressive-disclosurer"><img src="https://agentmods.dev/badge/skills/daymade/claude-code-skills/claude-md-progressive-disclosurer/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for claude-md-progressive-disclosurer

Your own site · 80×15
<a href="https://agentmods.dev/skills/daymade/claude-code-skills/claude-md-progressive-disclosurer"><img src="https://agentmods.dev/badge/skills/daymade/claude-code-skills/claude-md-progressive-disclosurer.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 123 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 11,668 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 1 finding. A grade says what 26 rules found in the file — not that it is safe. Third-party audits
  • Socket pass 18 May 2026
  • Snyk pass 18 May 2026
  • NVIDIA SkillSpector warn 7 Sept 2026
SkillSpector: 4 findings, up to high

These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →

  • high Agent Snooping · line 106
    Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
    Fix: Remove all code or instructions that access agent configuration directories (.claude/, .codex/, .gemini/). If configuration values are needed, pass them explicitly as parameters or environment variabl
  • high Tool Misuse · line 125
    Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
    Fix: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults.
  • high Agent Snooping · line 207
    Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
    Fix: Remove all code or instructions that access agent configuration directories (.claude/, .codex/, .gemini/). If configuration values are needed, pass them explicitly as parameters or environment variabl
  • high Privilege Escalation · line 611
    Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
    Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
How audits are shown
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00123 $0.11668
Opus 5 $0.00062 $0.05834
Sonnet 5 $0.00025 $0.02334
Haiku 4.5 $0.00012 $0.01167

Measured 3d ago against content hash 499969dd35dc, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-11, from the pricing page.

Security

Grade A, and why

claude-md-progressive-disclosurer scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.

The scan reads SKILL.md. This mod also ships 4 executable files (scripts/markdown_headings.py, scripts/profile_claude_md.py, scripts/sink_sections.py, …), listed below but not scanned — reading those needs a real analyzer, not pattern matching.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Reads agent configuration directorieslowAgent snooping

.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.

4. **载入语义与上限**:逐宿主实测,禁把历史版本的默认值当当前不变量。当前 Codex 的 `project_doc_max_bytes` 是**项目层级文档的累计预算**;全局用户指令可走另一条加载路径,不能拿该值推断它是否截断。先查 `~/.codex/config.toml`,再以同 cwd 的 `codex debug prompt-input` 实际字节为裁决。历史上确有 96 KiB 配置配合旧加载行为导致 164KB

Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.

daymade-claude-code/claude-md-progressive-disclosurer/SKILL.md · 560 lines

How it starts

The opening of the file, as written. The whole thing — 560 lines — stays where its author put it; the contents beside it link to each section on GitHub.

CLAUDE.md 渐进式披露优化器

核心理念

"找到最小的高信号 token 集合,最大化期望结果的可能性。" — Anthropic

目标是让指令在实际任务中被正确加载、找到并执行。 信息效率、可读性与可维护性服务于这个结果;文件大小、审阅次数和脚本绿灯都不能替代行为证据。

本 skill 在主文保留决策与执行入口,验证命令和历史材料按触发读取。官方篇幅建议用于发现可拆分内容,不是通过/失败阈值;用户需要的是正确行为,不是达到一个行数。

执行边界与验收

  • 先固定当前目标文件、消费它的宿主、授权范围、用户可见结果与停止条件。诊断/审计请求只读;明确要求优化或修复时,执行范围内的本地可逆修改与必要验证。发布、不可逆操作和范围扩张按当前用户授权处理,已答过的同一事项不反复确认。
  • “零信息损失”约束仍有效的契约与原样迁移,不要求旧错误永久留在现行规范里。每项改动先标为:保留/原样移动、同源去重、依据现行权威纠错,或待用户裁决的退役/边界变更。已有明确裁定按其执行;不能把“优化”当作撤销未获授权契约的许可。
  • 提案或验收正文给出:当前原文 → 候选文本/准确 diff → 依据 → 行为后果 → 未验证之处。先做出可审阅的本地结果,再请求尚缺的决策;不能只贴改后版本或让用户自行翻文件拼差异。
  • 依据分为当前宿主/官方契约、原始研究、用户长期契约、实测样例和待验证假设。标出研究的模型、任务、样本与限制;不能把旧模型结果、公司实践或单次成功改写成 GPT/Claude 全系通用阈值。
  • 先修会改变当前任务决策的冲突、失效规则、权限歧义、假指针或真实截断。只有在问题确实是常驻负担时,才用测量贡献度安排减负顺序;不因文件最大就先改它,也不为缩小指令而新建 hook、监控或 Skill。
  • 验收是:授权范围内的改动完整且无误、真实宿主加载路径正确、代表性任务符合预期。完成必要检查后停止;仅因新改动、失败或未决疑点扩大验证。普通小修改不自动加独立审阅,复杂且缺少机械裁判的改动按当前协作契约做一次有界审阅。

当前依据与适用边界见 references/progressive_disclosure_principles.md 开头;核查外部机制或研究结论时读取,历史案例不覆盖这里的现行契约。

铁律:行数禁作 KPI,可作诊断症状

禁作优化目标 / 成功指标(不可削弱——案例 7/8/9 的防线就是这条):

  • 行数少不代表更好,行数多不代表更差
  • 评判标准是:单一信息源(同一信息不在多处维护)、认知相关性(当前任务不需要的信息不干扰注意力)、维护一致性(改一处不需要同步另一处)——不是行数
  • 禁止在优化方案 / 总结中出现"从 X 行精简到 Y 行"、"减少 Z%"作为成果
  • 禁止把"减少行数"作为移动 / 删除某内容的理由
  • 一个结构清晰、信息不重复的长文件,胜过砍掉关键信息的短文件

可作诊断症状(官方依据:Claude Code 文档"文件太长 → 规则被淹没 → Claude 不遵守"):

  • 允许把"行数异常大 + Claude 反复不遵守某规则"当成触发调查的信号,不是结论
  • 调查动作仍是信号分诊(Step 2.1)+ 分层,不是"砍到 N 行"
  • 一句话区分:行数可以让你开始怀疑,不可以成为你优化的目标汇报的成果
触发即 reframe(用户说「太大 / 太长 / 精简 / 瘦身」时——最易在此处跑偏)

这些词触发的本能是「砍行数」。先 reframe,再动手:① 确认用户要改善的实际症状与已有授权;② 按 Step 2.0 做相关测量,再进 Step 2.1 信号分诊,用「这段有没有 canonical source 重复 / 是不是反信号」决定去留,不是用「文件多长」;③ 把「太大吗」当调查的起点,不是砍的许可。用户连续追问「还是太大」时同理——回应是「再做一轮分诊找重复 / 反信号」,分诊空了就诚实说「剩下都是高频核心,再砍会丢信号」,不是继续砍有信息的内容。(实战:把「太大吗」做成减行数任务、一路用「省 39%」当成果汇报、被连续追问拽着越砍越多 → 案例 15、16。)

两层架构

下图是项目级布局示例,不是要求每个文件补齐的模板。全局层只留跨项目决策约束;命令、代码、诊断和目录导航按实际任务频率与可靠检索路径分配。

Level 1 (CLAUDE.md) - 每次对话都加载
├── 信息记录原则               ← 防止未来膨胀的自我约束
├── Reference 索引(开头)     ← 入口1:遇到问题查这里
├── 核心命令表
├── 铁律/禁令(含代码示例)
├── 常见错误诊断(症状→原因→修复)
├── 代码模式(可直接复制)
├── 目录映射(功能→文件)
├── 修改代码前必读             ← 入口2:改代码前查这里
└── Reference 触发索引(末尾) ← 入口3:长对话后复述

Level 2 (references/) - 按需即时加载
├── 详细 SOP 流程
├── 边缘情况处理
├── 完整配置示例
└── 历史决策记录

Read the full file on GitHub · 560 lines

Files

What ships with it

6 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 3d ago Changed · -243 lines scan B → A 499969dd35dc
  2. 12d ago First seen · 803 lines · 123 tokens per session scan B 21a27370acbd

Subscribe to this mod's changes

claude-md-progressive-disclosurer is a skill published in the GitHub repository daymade/claude-code-skills (1,388 stars, last pushed today), licensed MIT. It adds 123 tokens to every session and 11,668 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it A with 1 finding (reads agent configuration directories). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Related

Other skills, from other repositories

systematic-debugging

Use when encountering any bug, test failure, or unexpected behavior, before proposing fixes.

obra/superpowers · 21 tokens

local-ai-agents

Build local-first AI agents that run entirely on a developer workstation with Microsoft Foundry Local and Qwen function-calling models. Covers Small Language Models (SLMs), the OpenAI-compatible local endpoint, sandboxed local tools, local RAG with Chroma, local MCP servers, hybrid cloud/local routing, and the…

microsoft/ai-agents-for-beginners · 200 tokens

next-cache-components-adoption

Turn on Cache Components in a Next.js app and resolve the blocking routes it surfaces. Use when the user wants to enable, adopt, or migrate to Cache Components, flip the cacheComponents flag, work through a flood of blocking-prerender / instant validation errors, run the cache-components-instant-false codemod, or…

vercel/next.js · 95 tokens

insight-error-page

Write or audit an insight-kind error page for the Next.js dev overlay. Use when creating a new errors/ .mdx page, auditing an existing one, or checking that a page matches the framework fix cards. Covers page structure, title alignment, FixCard cards with Copy prompt button, code snippets, terminology verification…

vercel/next.js · 83 tokens

next-cache-components-optimizer

Drive a Next.js route to instant navigation by setting up an agentic loop, under Cache Components / PPR, on initial load (hard navigation) and client-side navigation (soft navigation). Encode the goal as a failing @next/playwright instant() e2e and work it to green, one verified route at a time; the shipped test then…

vercel/next.js · 170 tokens

next-partial-prefetching-adoption

Turn on Partial Prefetching in a Next.js app and work through the insights it surfaces. Use when the user wants to enable or adopt Partial Prefetching, flip the partialPrefetching flag, opt routes in with export const prefetch = 'partial', audit Link prefetch={true} behavior, preserve existing prefetched UI with…

vercel/next.js · 103 tokens