Borrowing it
Nothing to install: this file belongs to go-to-k/cdkd. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/go-to-k/cdkd/main/.claude/skills/cleanup/SKILL.mdgit clone --depth 1 https://github.com/go-to-k/cdkdWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/go-to-k/cdkd/cleanup)<a href="https://agentmods.dev/skills/go-to-k/cdkd/cleanup"><img src="https://agentmods.dev/badge/skills/go-to-k/cdkd/cleanup/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/go-to-k/cdkd/cleanup"><img src="https://agentmods.dev/badge/skills/go-to-k/cdkd/cleanup.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Tool Misuse · line 63 Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).Fix: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00027 | $0.03385 |
| Opus 5.5 | $0.00011 | $0.01354 |
| Sonnet 5.5 | $0.00005 | $0.00677 |
| Haiku 4.5 | $0.00003 | $0.00338 |
Grade A, and why
cleanup scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 15d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 147 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Leftover Resource Cleanup
Detect and optionally delete AWS resources left behind by cdkd integration tests.
Safety
- ONLY targets resources whose names match a cdkd integ stack prefix; NEVER one that does not match a known cdkd naming pattern.
- Always show what will be deleted and confirm via
AskUserQuestionfirst. - Detect-only is the DEFAULT.
Arguments
stack-name-prefix: one prefix (e.g.EcrStack); absent, scan all known cdkd test stack prefixes.--detect-only: list only, the default.
Steps
-
Determine stack name prefixes to scan: the given prefix, else discover every integ stack name by synthesizing or reading
bin/app.tsin eachtests/integration/*/— the construct ID is the second argument tonew *Stack(app, '<id>'). -
Resolve region and account: scan
us-east-1,ap-northeast-1ANDus-west-2— the benchmark suite runs its variant stacks in the third, and its leftovers (billed PROVISIONED Kinesis streams, Lambda log groups) are invisible to a two-region scan. Derive any further regions from the state-bucket key layout (aws s3 lsrecursively, collect the distinct{region}segments) so a fixture pinned elsewhere is not missed. Account id viaaws sts get-caller-identity; IAM is global, so one query. -
Check S3 state:
aws s3 ls s3://cdkd-state-{accountId}/cdkd/ --recursive --region us-east-1 | grep state.json(also the legacycdkd-state-{accountId}-{region}bucket if it exists)
3.5. Bulk-sweep orphaned deployment-event stores: cdkd destroy / cdkd state destroy removes
state.json but, unless --purge-events was passed, INTENTIONALLY leaves the
cdkd/{stack}/{region}/deployments/ event store behind (post-mortem history). After
a long integ campaign those orphaned event stores accumulate across dozens of
already-destroyed stacks, so aws s3 ls .../cdkd/ is never empty even when there are
no real state / resource leaks. This step bulk-removes them. Safety: only a prefix
that has a deployments/ child AND NO state.json under any region is an orphan —
a prefix that still has a state.json is an ACTIVE (deployed, not destroyed) stack
and MUST be left untouched (its deployments/ is live history).
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 15d ago Changed · +1 lines 4ebc090537f0
- 1mo ago Changed 89284c6ab235
- 1mo ago Changed · +8 lines 22487ad80ec5
- 1mo ago Changed · -1 lines 3fd03840082f
- 1mo ago Changed · +7 lines 5577220545ea
- 2mo ago First seen · 132 lines · 27 tokens per session scan A fbb9324ef9d3
cleanup is a skill published in the GitHub repository go-to-k/cdkd (156 stars, last pushed today), licensed Apache-2.0. It adds 27 tokens to every session and 3,385 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
aws-cdk-mcp-server-mcp
AWS Cloud Development Kit (CDK) best practices, infrastructure as code patterns, and security compliance with CDK Nag.
aws-serverless-patterns
AWS Lambda, API Gateway, DynamoDB, Step Functions, EventBridge patterns and best practices. Use when building or reviewing serverless backends, CDK infrastructure, or Lambda functions.
aws-diagram-html
Generate a polished, self-contained HTML architecture diagram (inline SVG) with real official AWS Architecture Icons, hand-routed orthogonal connectors that never cross or overlap, numbered flow steps, and an observability panel. Triggers when the user asks for a nice looking diagram, an HTML diagram, a diagram to…
aws-diagram-png
Generate AWS architecture diagrams as PNG images with real AWS icons using the awslabs/diagram-as-code (awsdac) CLI. Triggers when user wants a PNG diagram, architecture image, or visual export of AWS infrastructure. Produces publication-ready diagrams following AWS architecture guidelines.
cognito-email-migration
Runbook for migrating an existing Cognito User Pool from default emails to a custom CustomEmailSender Lambda. Use when an existing app needs to switch from the default Cognito verification / password-reset / MFA emails to brand-matched HTML emails sent via SES.
deploy-on-aws
Deploy applications to AWS via deploy.sh. Triggers on phrases like: deploy to AWS, deploy.sh, build me a deploy script, host on AWS, run this on AWS, AWS architecture, estimate AWS cost, generate infrastructure. Analyzes any codebase and deploys to optimal AWS services.