What is project_initialization?

A setup workflow for an AI coding assistant in a project. It scans the source code, creates project-specific rules and reference documentation, and can check whether a code-relationship tool is installed.

Use it when starting a project or updating the assistant's setup after major changes. It can inspect initialization files, generate references, and optionally configure CodeGraph.

It gives the coding assistant information about the actual project structure instead of relying on generic instructions or incomplete references.

project_initialization — Skill for Claude Code and Codex by Jorgejie

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent

npx skills add Jorgejie/ai_scaffold --skill project_initialization

Clone the repo

git clone --depth 1 https://github.com/Jorgejie/ai_scaffold

Made for: Claude Code, Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/jorgejie/ai_scaffold/project_initialization/github.svg)](https://agentmods.dev/skills/jorgejie/ai_scaffold/project_initialization)

Your own site

<a href="https://agentmods.dev/skills/jorgejie/ai_scaffold/project_initialization"><img src="https://agentmods.dev/badge/skills/jorgejie/ai_scaffold/project_initialization/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/skills/jorgejie/ai_scaffold/project_initialization"><img src="https://agentmods.dev/badge/skills/jorgejie/ai_scaffold/project_initialization.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 49 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 7,050 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe. Third-party audits

NVIDIA SkillSpector warn 7 Sept 2026

SkillSpector: 6 findings, up to medium

These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →

medium MCP Rug Pull · line 66
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Fix: Pin the version: npx @scope/[email protected]
medium MCP Rug Pull · line 791
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Fix: Pin the version: npx @scope/[email protected]
medium Agent Snooping · line 478
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Fix: Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation.
medium Agent Snooping · line 692
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Fix: Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation.
medium Agent Snooping · line 690
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Fix: Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation.
medium Agent Snooping · line 691
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Fix: Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation.

How audits are shown

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00049	$0.07050
Opus 5.5	$0.00020	$0.02820
Sonnet 5.5	$0.00010	$0.01410
Haiku 4.5	$0.00005	$0.00705

Measured 2mo ago against content hash 2be7dd6a3527, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

project_initialization scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2mo ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

cli/templates/skills/project_initialization/SKILL.md · 809 lines

How it starts

The opening of the file, as written. The whole thing — 809 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Project Initialization Guide — 项目AI辅助体系初始化指南

重要说明: 本文件是AI执行初始化的操作手册，不是给人类阅读的文档。

触发方式:

方式1: 用户说"按project_initialization skill初始化本项目"

方式2: 用户说"阅读AI_INIT_GUIDE.md并执行"

方式3: AI检测到{{DIR}}/rules/目录下文件为空或包含占位符时主动建议

Phase 0: 检测当前状态

首先检查项目当前状态：

读取配置文件
- 检查 {{DIR}}/scripts/gen_references.py 是否存在
- 检查 {{DIR}}/references/_scan.json 是否已生成
- 判断是"首次初始化"还是"增量更新"
检查模板完整性
- 如果检测到 project_rule.md 中仍有 "Define XXX here" 等占位符
- 说明之前未完成初始化，应重新执行完整流程
确认CodeGraph状态
- 运行 codegraph --version (3秒超时)
- 如果未安装，执行 Phase 0.4 询问用户是否安装
- 记录结果用于后续决策

输出检测结果：

📋 初始化状态检测:
- gen_references.py: [存在/缺失]
- _scan.json: [已生成/未生成]
- CodeGraph CLI: [已安装/未安装]
- 初始化类型: [首次初始化/增量更新]

Phase 0.4: CodeGraph 安装提示（仅当未安装时执行）

如果Phase 0.3检测到CodeGraph未安装，询问用户：

⚙️  检测到 CodeGraph CLI 未安装

CodeGraph 是一个代码关系图工具，可为 AI 提供项目结构探索能力（类/方法/符号搜索）。
安装后可减少约 90% 的 AI 工具调用，使 references/ 目录采用轻量模式。

是否现在安装 CodeGraph？
  1. ✅ 是，安装并配置（推荐）
  2. ❌ 否，跳过（将使用完整模式）

选择 1 → 执行 Phase 0.4.1 安装流程
选择 2 → 设置 HAS_CODEGRAPH = false，references/ 采用完整模式

Phase 0.4.1: CodeGraph 安装流程

用户选择安装后，执行以下步骤：

Step 1: 安装 CodeGraph CLI
  执行: npx @colbymchenry/codegraph
  
Step 2: 验证安装
  执行: codegraph --version
  成功 → HAS_CODEGRAPH = true
  失败 → 显示错误信息，询问用户是否继续（降级为完整模式）
  
Step 3: 初始化 CodeGraph（必须执行）
  说明: CodeGraph 必须在项目中建立索引才能使用
  执行: codegraph init
  等待初始化完成...
  
  如果初始化成功:
    → CodeGraph 已就绪，使用轻量模式
    → 继续后续流程
  
  如果初始化失败:
    → 显示错误信息
    → 询问用户: "CodeGraph 初始化失败，是否降级为完整模式？"
      - 是 → HAS_CODEGRAPH = false，使用完整模式
      - 否 → 中止初始化流程，让用户手动解决问题

安装成功后设置 HAS_CODEGRAPH = true，影响后续行为：

project_rule.md §1 行为准则使用 CodeGraph 版本
{{ENTRY}} 入口文件追加 CodeGraph 集成说明
gen_references.py 使用 --lightweight 标志
references/ 采用轻量模式

安装失败不阻塞流程，降级为完整模式继续。

Phase 1: 项目深度分析

1.1 运行结构扫描器（带 CodeGraph 验证）

关键步骤: 在执行扫描前，必须验证 CodeGraph 是否真正可用

如果 HAS_CODEGRAPH = true:
  Step A: 验证 CodeGraph 可用性
    执行: codegraph explore "test" --limit 1 2>/dev/null
    
    如果成功:
      → CodeGraph 可用 ✅
      执行: python {{DIR}}/scripts/gen_references.py --lightweight
      
    如果失败:
      → CodeGraph 不可用 ️
      自动降级: HAS_CODEGRAPH = false
      提示: "⚠️ CodeGraph 未正确初始化或不可用，已降级为完整模式"
      执行: python {{DIR}}/scripts/gen_references.py
      
如果 HAS_CODEGRAPH = false:
  直接执行: python {{DIR}}/scripts/gen_references.py

Read the full file on GitHub · 809 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

2mo ago First seen · 809 lines · 49 tokens per session scan A 2be7dd6a3527

Subscribe to this mod's changes

project_initialization is a skill published in the GitHub repository Jorgejie/ai_scaffold (57 stars, last pushed 3mo ago), licensed MIT. It adds 49 tokens to every session and 7,050 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Building agents Planning

project_initialization next to 6 skills from other repositories
Mod	Type	Stars	Last push	Licence	Scan	Tokens	Works with
project_initializationJorgejie/ai_scaffold	Skill	57	3mo ago	MIT	A	49	Claude Code, Codex
imagegenopenai/codex	Skill	134k	yesterday	Apache-2.0	A	113	Codex
local-ai-agentsmicrosoft/ai-agents-for-beginners	Skill	79k	2d ago	MIT	A	200	Claude Code, Codex
playwright-climicrosoft/playwright	Skill	100k	today	Apache-2.0	A	19	Claude Code
browser-automationopenclaw/openclaw	Skill	394k	today	MIT	A	36	Claude Code
systematic-debuggingobra/superpowers	Skill	315k	6d ago	MIT	A	21	Claude Code
next-cache-components-adoptionvercel/next.js	Skill	143k	yesterday	MIT	A	95	Claude Code