Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/jeromwolf/templateclaw/templateclaw-refactornpx skills add jeromwolf/templateclaw --skill templateclaw-refactorgit clone --depth 1 https://github.com/jeromwolf/templateclawWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00033 | $0.01121 |
| Opus 5 | $0.00016 | $0.00561 |
| Sonnet 5 | $0.00007 | $0.00224 |
| Haiku 4.5 | $0.00003 | $0.00112 |
Grade A, and why
templateclaw-refactor scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 143 lines — stays where its author put it; the contents beside it link to each section on GitHub.
TemplateClaw — Refactoring Checklists
Generate actionable refactoring guides with verification steps.
When Invoked
- If argument provided (e.g.,
/templateclaw-refactor security), generate that checklist - If no argument, ask: "Which checklist? (performance / security / db-migration)"
Available Checklists
Performance Optimization (/templateclaw-refactor performance)
Output: docs/performance-checklist.md
# Performance Optimization Checklist
## Frontend
- [ ] Bundle size analysis (webpack-bundle-analyzer / source-map-explorer)
- [ ] Image optimization (WebP, lazy loading, responsive srcset)
- [ ] Code splitting (dynamic imports, route-based)
- [ ] CSS purging (unused styles removal)
- [ ] Font optimization (subset, display=swap, preload)
- [ ] Core Web Vitals targets: LCP<2.5s, FID<100ms, CLS<0.1
## Backend
- [ ] Database query profiling (EXPLAIN ANALYZE)
- [ ] N+1 query detection and resolution
- [ ] Connection pooling configured
- [ ] Response caching (Redis / in-memory / CDN)
- [ ] Pagination for list endpoints
- [ ] Async processing for heavy operations
## Infrastructure
- [ ] CDN for static assets
- [ ] Gzip/Brotli compression
- [ ] HTTP/2 or HTTP/3 enabled
- [ ] DNS prefetch for external resources
- [ ] Service worker for offline caching (PWA)
## Measurement
- [ ] Lighthouse CI score > 90
- [ ] Load test baseline established
- [ ] APM monitoring configured (response times, error rates)
Bonus: Scan the current project and highlight specific optimization opportunities.
Security Audit (/templateclaw-refactor security)
Output: docs/security-audit.md
# Security Audit Checklist
## Authentication & Authorization
- [ ] Password hashing (bcrypt/argon2, NOT md5/sha1)
- [ ] JWT expiry < 24h, refresh token rotation
- [ ] Rate limiting on auth endpoints (5 attempts/min)
- [ ] RBAC/ABAC properly implemented
- [ ] Session invalidation on password change
## Input Validation
- [ ] All user input validated (type, length, format)
- [ ] SQL injection prevented (parameterized queries)
- [ ] XSS prevented (output encoding, CSP headers)
- [ ] CSRF tokens on state-changing requests
- [ ] File upload restrictions (type, size, scanning)
## Secrets Management
- [ ] No hardcoded secrets in code
- [ ] .env in .gitignore
- [ ] Secrets rotated on schedule
- [ ] API keys scoped to minimum permissions
- [ ] Audit log for secret access
## Infrastructure
- [ ] HTTPS everywhere (HSTS header)
- [ ] Security headers (CSP, X-Frame-Options, etc.)
- [ ] Dependencies scanned (npm audit / safety / cargo audit)
- [ ] Container images scanned
- [ ] Principle of least privilege on all services
## OWASP Top 10 Quick Check
- [ ] A01 Broken Access Control
- [ ] A02 Cryptographic Failures
- [ ] A03 Injection
- [ ] A07 Authentication Failures
- [ ] A09 Security Logging & Monitoring
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 143 lines · 33 tokens per session scan A 2a1411a44dc4
templateclaw-refactor is a skill published in the GitHub repository jeromwolf/templateclaw (2 stars, last pushed 5mo ago), licensed MIT. It adds 33 tokens to every session and 1,121 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
dashboard-design
Use this skill first when the user wants to design or plan a dashboard, especially Vizro dashboards. Enforces a 3-step workflow (requirements, layout, visualization) before implementation. Activate when the user asks to create, design, or plan a dashboard. For implementation, use the dashboard-build skill after…
design-everyday-things
Apply foundational design principles: affordances, signifiers, constraints, feedback, and conceptual models. Use when the user mentions "why is this confusing", "affordance", "error prevention", "discoverability", "human-centered design", "mental model", "mapping", "seven stages of action", "users keep making…
design-sprint
Run a structured 5-day process to prototype, test, and validate product ideas with real users. Use when the user mentions "design sprint", "validate before we build", "rapid prototype", "test with users", or "should we build this". Also trigger when a team is stuck in endless debate over a high-stakes product…
design-system
Creates the Tamagui brand system for an Expo/React Native Power Apps mobile app, including design-system.md, tokens.ts, and an HTML gallery.
generate-mcp-app-ui
Generate an MCP App widget (self-contained HTML) for an MCP tool. Describe the visual you want and paste your tool's test output. Use when user asks to create an MCP App, widget, or visual for a tool.
designing-vizro-layouts
Use this skill when designing or building Vizro dashboard layouts — grid configuration, component sizing, filter/parameter placement, selector types, or container patterns. Activate when the user is creating wireframes, defining page structure, placing controls, or sizing charts.