Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/Goodsmileduck/claude-registrynpx agentmods add skills/goodsmileduck/claude-registry/setup-project-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/goodsmileduck/claude-registry/setup-project-skills)<a href="https://agentmods.dev/skills/goodsmileduck/claude-registry/setup-project-skills"><img src="https://agentmods.dev/badge/skills/goodsmileduck/claude-registry/setup-project-skills/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/goodsmileduck/claude-registry/setup-project-skills"><img src="https://agentmods.dev/badge/skills/goodsmileduck/claude-registry/setup-project-skills.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00133 | $0.02092 |
| Opus 5 | $0.00067 | $0.01046 |
| Sonnet 5 | $0.00027 | $0.00418 |
| Haiku 4.5 | $0.00013 | $0.00209 |
Grade A, and why
setup-project-skills scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 170 lines — stays where its author put it; the contents beside it link to each section on GitHub.
setup-project-skills
Installs skills into the current project from a manifest the user maintains. Distinct from claude-automation-recommender (which advises across hooks/MCP/subagents/skills/plugins and does not install) and from find-skills (which discovers public skills). This skill is opinionated: it installs only what's on the user's whitelist.
When to invoke
- "Set up skills for this project."
- "Bootstrap this repo with my skills."
- "What skills should I install here?" — the project-detection pass answers that from the manifest.
- "Link/install/add
<name>here." - Fresh
git clonefollowed by a session in the new directory.
When NOT to invoke
- User is actually doing terraform/k8s/docker/etc. work — the underlying skills handle that.
- User wants a recommendation across the full Claude Code surface (hooks, subagents, MCP, plugins) — that's
claude-automation-recommender. - User wants to discover what skills exist on the public registry — that's
find-skills. - User wants to author a new skill — that's
skill-creator.
Cross-cutting rules
- The manifest is the source of truth. Always read
~/.claude/skill-manifest.json(or$SKILL_MANIFESTif set). Never invent skills not listed there. If a skill the user names isn't in the manifest, offer to add it rather than installing ad-hoc. - Project-scoped install only. Always link or install into
./.claude/skills/<name>of the current working directory. Never into~/.claude/skills/from this skill — that's the user's global decision. - Idempotent. If
./.claude/skills/<name>already exists, check whether it matches the desired target. Skip if identical; refuse and surface the conflict if not. - Restart required. Skills installed mid-session don't activate until the next Claude Code session starts in this project. Always say so after a successful install.
- No slash commands. Claude can't invoke
/plugin install. Forclaude-pluginsources, print the exact command for the user to run themselves.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 10d ago First seen · 170 lines · 133 tokens per session scan A dc40a251edc9
setup-project-skills is a skill published in the GitHub repository Goodsmileduck/claude-registry (1 stars, last pushed 1mo ago), licensed MIT. It adds 133 tokens to every session and 2,092 once invoked, about $0.0007 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
cicd-expert
Expert-level CI/CD with GitHub Actions, Jenkins, deployment pipelines, and automation. Use when the user mentions CI/CD, GitHub Actions, Jenkins, GitLab CI, deployment, or automation, or when the task involves CI/CD Fundamentals, Pipeline Design, Workflow Basics, or Docker Build and Push.
cicd-agent
CI/CD pipeline design and review — GitHub Actions, pipeline best practices, secrets management, deployment strategies, and release automation.
devops-best-practices
Opinionated production-grade DevOps defaults for Terraform, Kubernetes, CI/CD, Docker, cloud security, observability, cost, and disaster recovery. ALWAYS use when generating, reviewing, or modifying any infrastructure code, Kubernetes manifests (Deployment, Service, StatefulSet, Helm, Kustomize), Terraform (.tf…
subagent-driven-development
Execute plans via delegatetask subagents (2-stage review).
mcporter
List, auth, and call MCP servers/tools from the terminal.
research-engineer
An uncompromising Academic Research Engineer. Operates with absolute scientific rigor, objective criticism, and zero flair. Focuses on theoretical correctness, formal verification, and optimal implementation across any required technology.