Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/m-binimran/dev-pack/claude-pack-buildernpx skills add m-binimran/dev-pack --skill claude-pack-buildergit clone --depth 1 https://github.com/m-binimran/dev-packWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00159 | $0.01399 |
| Opus 5 | $0.00079 | $0.00700 |
| Sonnet 5 | $0.00032 | $0.00280 |
| Haiku 4.5 | $0.00016 | $0.00140 |
Grade A, and why
claude-pack-builder scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 91 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Claude Pack Builder
You are operating as a professional GitHub publisher. The deliverable is a small, enforced, honestly-documented Claude Code pack — and a clean public repo. The reference implementation this skill produced is github.com/m-binimran/dev-pack (Next.js + Supabase). Read it for examples.
Reference Library — load per phase (NOT all at once)
| File | Load when |
|---|---|
references/hook-authoring.md |
Building hooks — stdin/exit-code protocol, fail-open vs fail-closed, settings.json wiring, hook + test-harness skeletons |
references/verification.md |
After building, before publishing — the full "did I actually verify it" checklist + commands |
references/safe-publish.md |
Publishing to GitHub — secret scan, naming/rename, privacy-safe identity, .gitattributes, gh repo create, confirm visibility, verify remote CI |
The five goals (every item must serve ≥1)
🪙 fewer tokens · 🎯 accuracy · ✅ truth-telling · ⚡ speed · 💎 quality. If an item serves none, cut it.
The core insight
Rules are advisory (the model may ignore them under load). Hooks are deterministic — they run every time. So the guarantees come from hooks; rules, skills, loops, and agents layer on top. When the user wants something enforced, it's a hook, not a rule.
The layers
| Layer | Folder | Nature | Installs to |
|---|---|---|---|
| Rules | rules/ |
Advisory CLAUDE.md fragments |
appended to <project>/CLAUDE.md |
| Skills | skills/<name>/SKILL.md |
On-demand capability packs | .claude/skills/ |
| Hooks | hooks/*.py + settings.json |
Deterministic enforcement | .claude/hooks/ + merged settings |
| Loops | loops/*.md |
Multi-step slash commands | .claude/commands/ |
| Agents | agents/*.md |
Review subagents | .claude/agents/ |
Phase 1 — Research first (never fabricate)
Survey the real ecosystem before designing. Use WebSearch/WebFetch and read any local reference libraries
the user already has (e.g. ~/Claude rules/ecc/, their existing skills). Produce a short comparison of
comparable repos and name the gap this pack fills. Cite real repos with URLs. Do not invent star counts,
benchmarks, or repos.
What ships with it
3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 91 lines · 159 tokens per session scan A 7c515c239f53
claude-pack-builder is a skill published in the GitHub repository m-binimran/dev-pack (2 stars, last pushed 2mo ago), licensed MIT. It adds 159 tokens to every session and 1,399 once invoked, about $0.0008 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
investigate-issue
Investigate a GitHub issue by fetching details, analyzing the codebase, researching documentation, and presenting an actionable implementation plan with test guidance. Use when asked to investigate, analyze, triage, or plan work for a GitHub issue. Invoked with /investigate-issue or /investigate-issue (prompts for ID).
resolve-pr-comments-stack
Resolve unresolved PR review comments across an entire Graphite (gt) stack of many PRs, bottom-up, in one working directory. Use when asked to "go through this stack and resolve comments", "clean up review comments across the whole stack", or given a list/range of PR numbers that form (or partially form) a gt stack.…
release-checklist
Pre-release safety audit for the Bifrost repo. Scans database migrations changed in a release for high-scale deadlock / lock-contention risks and for work that blocks application boot time, then produces a pass/warn/fail report with a concrete remediation plan. Invoked with /release-checklist [git-ref-range]. Built to…
stack-absorb
Manually distribute working-tree changes (or a batch of edits already made on the current branch) across the correct branches of a Graphite (gt) stack, when gt absorb's blame-based auto-split doesn't match the logical grouping - e.g. new code with no prior line to blame onto, or changes that conceptually belong with a…
harness-test-writer
Add regression test cases to the Bifrost provider harness (the Postman collection run via make run-provider-harness-test) based on a merged PR or a GitHub issue. Fetches the PR/issue, traces the affected wire path in the codebase, checks existing harness coverage, designs cases following harness conventions, inserts…
review-pr
Reviews a PR or diff with multi-angle finders and adversarial verification, then reports a findings table, a merge/no-merge recommendation, required followups, and offers to create a follow-up PR. Use when the user types /review-pr [PR# | branch | path].