discover

A repository scanner that documents the project's technologies, coding conventions, test setup, and common anti-patterns. It writes the result where Claude Code automatically loads project rules.

In plain words
What is it for?
Use it once when beginning work on a repository, or again after its technology stack or conventions change.
Why use it?
It gives later agent sessions the project's own working rules, reducing guesses about how code should be written and tested.

Skill for Claude CodeCodex

Part of the ticket-flow plugin — 13 skills, 2 hooks shipped together

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add skills/keefar/ticket-flow/discover
Any agent
npx skills add keefar/ticket-flow --skill discover
Clone the repo
git clone --depth 1 https://github.com/keefar/ticket-flow

Made for: Claude Code, Codex.

Or install ticket-flow, the plugin that ships this one along with the rest of its 13 skills, 2 hooks.

Per session 62 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 1,419 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00062 $0.01419
Opus 5 $0.00031 $0.00709
Sonnet 5 $0.00012 $0.00284
Haiku 4.5 $0.00006 $0.00142

Measured 3d ago against content hash 27ba80e887dd, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

discover scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.

The scan reads SKILL.md. This mod also ships 1 executable file (discover.sh), listed below but not scanned — reading those needs a real analyzer, not pattern matching.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

skills/discover/SKILL.md · 79 lines

How it starts

The opening of the file, as written. The whole thing — 79 lines — stays where its author put it; the contents beside it link to each section on GitHub.

/ticket-flow:discover — Project-Convention Discovery

Args: none — operates on current working directory.

What it does

Codifies the answer to "what conventions does this project follow?" into a single file that the harness itself loads. Claude Code discovers every .md under .claude/rules/ recursively and loads a rule without a paths: frontmatter key at launch, at the same priority as .claude/CLAUDE.md (memory docs) — so the conventions are in context for /ticket-flow:spec, /ticket-flow:implement and any plain session, without a skill having to fetch them. (Earlier versions wrote docs/PROJECT-CONVENTIONS.md, which only helped whoever remembered to read it.)

Adapted from Weselow Claude-Protocol's /project-discovery skill, but stripped of the rule-injection mechanism — output is a doc, not a hook.

Output

.claude/rules/project-conventions.md — sections below. An existing file is not overwritten: the script reports it and exits 1 — re-run with --force to replace it (there is no interactive prompt, so an agent must not read that exit code as a failure). A leftover docs/PROJECT-CONVENTIONS.md from an earlier run is reported and left alone — no skill reads it any more; merge what you want to keep and delete it.

Sections in the rule file

  1. Tech Stack — frameworks/languages/versions detected from manifest files
    • Sources: package.json, Cargo.toml, pyproject.toml/requirements.txt, go.mod, Package.swift, pom.xml, Gemfile, composer.json, *.csproj
    • Output: Language: Swift 6.x · Framework: SwiftUI + AppKit · Min target: macOS 14+
  2. Build/Test/Lint commands — extracted from the manifests + common scripts (Makefile, package.json scripts, xcodebuild invocations in CI configs)
  3. Naming conventions — sample 20 files, derive patterns
    • SwiftUI: *View.swift, *Model.swift, etc.
    • JS/TS: kebab-case vs camelCase for files
    • Python: PEP 8 module names
  4. Testing setup — test framework + folder convention
    • Tests/ + XCTest + *Tests.swift|*Tests.m (Apple)
    • tests/ + pytest + test_*.py (Python)
    • __tests__/ + Jest (JS)
  5. Anti-patterns specific to this project — what not to do (extracted from existing CLAUDE.md, README, comments saying "// DO NOT")

Read the full file on GitHub · 79 lines

Files

What ships with it

1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 3d ago First seen · 79 lines · 62 tokens per session scan A 27ba80e887dd

Subscribe to this mod's changes

discover is a skill published in the GitHub repository keefar/ticket-flow (4 stars, last pushed 7d ago), licensed MIT. It adds 62 tokens to every session and 1,419 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Related

Other skills, from other repositories

project-discuss

⚠️ 本 skill 与 brainstorming / writing-plans / executing-plans 等流程 skill 正交、可并行触发,不互斥。 已调用流程 skill 不等于可以跳过本 skill;只要涉及项目讨论/决策/查询,都需要额外激活本 skill。 项目讨论管理协议。管理讨论上下文、决策记录、查询行为。 触发:用户讨论项目方向/设计/技术选型/需求分析/功能规划时; 用户问"我们讨论到哪了"/"XX 确定了吗"; 用户想修改已确定的内容;用户提供外部文档; 用户询问项目现状/架构/实现细节/历史决策(含 debug 揭示架构问题时); 当 bug…

hxt9805/cadence · 216 tokens

cadence-bootstrap

Use when starting any conversation in a cadence-managed project (project root contains cadence/INDEX.md or cadence/ACTIVE.md). Establishes cadence workflow conventions — 记 / 整 / 查 三阶段记录协议, ACTIVE.md / INDEX.md state contract, domain-neutral adaptive recording fidelity, session start behaviors, and subagent dispatch…

hxt9805/cadence · 117 tokens

cadence-resume

继续之前某次 session 的讨论上下文(v0.4:Step 6 archive cleanup B1 修复 + contenthashes 判据 + 派 retriever 替代 auditor)。用户说 '继续上次'/'resume' 或跑 /cadence-resume 时触发。.

hxt9805/cadence · 65 tokens

cadence-handoff

整理当前 session 讨论内容到 cadence 档案(v0.4:触发整 阶段(ε 整合)兜底 + 写 sha1 书签式 snapshot,15-30 行)。用户说 'handoff'/'整理 session'/'换新 session' 或跑 /cadence-handoff 时触发。.

hxt9805/cadence · 77 tokens

cadence-init

初始化 cadence 工作流目录结构。支持两种模式:新项目(极简模板 + TBD 占位) 和已有项目(通用发现 + 领域适配扫描 + 来源不一致清单)。适用于软件、研究、 写作、学习、运营及其他项目。当用户说"初始化 cadence"、 "开始用 cadence"、或跑 /cadence-init slash command 时触发。.

hxt9805/cadence · 89 tokens

polish

Polish a completed code change with a bounded independent review protocol. Use after implementation and before final approval or PR to review intent, acceptance criteria, non-goals, diff, relevant files, verification, and previously rejected findings.

takubii/smithy · 48 tokens