Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/mblode/agent-skills/scaffold-clinpx skills add mblode/agent-skills --skill scaffold-cligit clone --depth 1 https://github.com/mblode/agent-skillsWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00151 | $0.01778 |
| Opus 5 | $0.00076 | $0.00889 |
| Sonnet 5 | $0.00030 | $0.00356 |
| Haiku 4.5 | $0.00015 | $0.00178 |
Grade A, and why
scaffold-cli scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 120 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Scaffold CLI
- IS: bootstrapping a brand-new TypeScript CLI or npm package (Node 24+, TypeScript 7) from the pinned templates in
references/. - IS NOT: a Next.js web app (use
scaffold-nextjs), folder structure or module contracts for an existing codebase (usecodebase-architecture), or shipping a release of an existing package (useautoship).
Low-freedom scaffold. Generate files exactly as templated, substituting only {{placeholder}} variables. Do not swap tools (no eslint, prettier, tsup, jest, chalk, or ora) or restructure the layout.
Reference Files
| File | Read When |
|---|---|
references/scaffold-configs.md |
Step 3: package.json, tsconfig, tsdown, gitignore, license, changeset config, GitHub Actions |
references/scaffold-source.md |
Steps 4-5: src/cli.ts, src/index.ts, src/types.ts, AGENTS.md, README.md, skills/SKILL.md |
references/agent-friendly-cli.md |
Step 4: agent-friendly CLI patterns (input validation, dry-run, confirmation, schema) |
references/post-scaffold.md |
Steps 6-7: post-scaffold commands, validation checklist, troubleshooting |
Scaffold Workflow
Copy this checklist to track progress:
Scaffold progress:
- [ ] Step 1: Gather project info
- [ ] Step 2: Create directory structure
- [ ] Step 3: Generate config files
- [ ] Step 4: Generate source files
- [ ] Step 5: Generate docs and skill
- [ ] Step 6: Run post-scaffold commands
- [ ] Step 7: Validate scaffold
Step 1: Gather project info
Ask only for what the user didn't provide:
| Variable | Example | Default | Used in |
|---|---|---|---|
{{name}} |
md-tools |
required | package.json name, README title |
{{description}} |
CLI tool to convert content to markdown |
required | package.json, README, SKILL.md |
{{bin}} |
md |
same as {{name}} |
package.json bin field, CLI examples |
{{repo}} |
acme/md-tools |
required | package.json repository, badges |
{{author}} |
Your Name |
required | package.json, LICENSE |
{{year}} |
2026 |
current year | LICENSE |
What ships with it
4 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 120 lines · 151 tokens per session scan A 8fcc3f561ed9
scaffold-cli is a skill published in the GitHub repository mblode/agent-skills (95 stars, last pushed 3d ago), licensed MIT. It adds 151 tokens to every session and 1,778 once invoked, about $0.0008 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
linea-dependency-maintenance
Safely plan and execute dependency maintenance for JavaScript/TypeScript (npm, pnpm) and GitHub Actions, including npm lockfiles, pnpm workspaces, catalogs, overrides, SHA-pinned action versions, release-age policies, audits, CI validation, Dependabot boundaries, PRs, and GitHub tracking issues. Use whenever the user…
zuke-write-build
Write or edit a Zuke build (zuke.ts) — the code-first, strongly-typed build system for Deno/TypeScript. Use when adding or changing targets, wiring dependencies, calling a tool wrapper (DenoTasks, NpmTasks, DockerTasks, ...), generating CI, or authoring/refactoring a zuke.ts build file. For first-time project…
ts-library
Use when authoring TypeScript libraries - covers project setup, package exports, build tooling (tsdown/unbuild), API design patterns, type inference tricks, testing, and release workflows. Patterns extracted from 20+ high-quality ecosystem libraries.
bootstrap-ts-oss
Bootstrap a new TypeScript open-source npm package with Bun, tsup, Biome, Husky, GitHub Actions CI/CD, and dual ESM/CJS publishing. Use when the user wants to create, scaffold, initialize, set up, or bootstrap a new TypeScript library, npm package, or open-source project.
scaffold-node
Scaffold a complete Node/TypeScript project with CI/CD, release pipeline, sr.yaml, .envrc, and standard files. Uses pnpm and biome. Loads on top of scaffold-project (run that first for cross-language standard files). Use when creating a new Node.js app, TypeScript library, or website, or when the user mentions "new…
client-setup
Create a vanilla tRPC client with createTRPCClient (), configure link chain with httpBatchLink/httpLink, dynamic headers for auth, transformer on links (not client constructor). Infer types with inferRouterInputs and inferRouterOutputs. AbortController signal support. TRPCClientError typing.