rule-config

rule-config is a skill for Claude Code from michaelChe956/Cadence-skills. It costs 27 tokens per session (3,720 once invoked), scanned A, original, MIT.

A configuration tool for maintaining project rules used by Claude Code and Codex, including rule files, project settings, backups, and related development-tool setup. Claude Code and Codex are AI coding assistants.

In plain words
What is it for?
Use it to initialize or update project-level assistant rules, migrate supported older formats, manage rule-related files, and configure optional tools such as CodeGraph or Playwright.
Why use it?
It reduces the risk of inconsistent or outdated instructions across rule files and preserves files before changes are made. It also reports configuration problems that need attention.

Skill for Claude Code

Written for Claude Code: Claude Code plugin machinery. Also seen: mentions CLAUDE.md; names the AskUserQuestion tool; mentions Claude Code.

Part of the cadence-init plugin — 13 skills shipped together

Good fit Use it to initialize or update project-level assistant rules, migrate supported older formats, manage rule-related files, and configure optional tools such as CodeGraph or Playwright.

Compare 6 skills from other repositories ↓
Install with agentmods
npx agentmods add skills/michaelche956/cadence-skills/rule-config
Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent
npx skills add michaelChe956/Cadence-skills --skill rule-config
Clone the repo
git clone --depth 1 https://github.com/michaelChe956/Cadence-skills

Made for: Claude Code.

Or install cadence-init, the plugin that ships this one along with the rest of its 13 skills.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for rule-config

README.md
[![agentmods](https://agentmods.dev/badge/skills/michaelche956/cadence-skills/rule-config/github.svg)](https://agentmods.dev/skills/michaelche956/cadence-skills/rule-config)
Your own site
<a href="https://agentmods.dev/skills/michaelche956/cadence-skills/rule-config"><img src="https://agentmods.dev/badge/skills/michaelche956/cadence-skills/rule-config/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for rule-config

Your own site · 80×15
<a href="https://agentmods.dev/skills/michaelche956/cadence-skills/rule-config"><img src="https://agentmods.dev/badge/skills/michaelche956/cadence-skills/rule-config.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 27 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 3,720 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe. Third-party audits
  • NVIDIA SkillSpector warn 7 Sept 2026
SkillSpector: 3 findings, up to high

These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →

  • high Privilege Escalation · line 81
    Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
    Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
  • medium MCP Rug Pull · line 58
    uvx/uv tool run commands without ==version create a rug-pull risk.
    Fix: Pin the version: uvx package-name==1.2.3
  • medium MCP Rug Pull · line 116
    uvx/uv tool run commands without ==version create a rug-pull risk.
    Fix: Pin the version: uvx package-name==1.2.3
How audits are shown
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00027 $0.03720
Opus 5 $0.00014 $0.01860
Sonnet 5 $0.00005 $0.00744
Haiku 4.5 $0.00003 $0.00372

Measured today against content hash a0cfcd6055d7, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-11, from the pricing page.

Security

Grade A, and why

rule-config scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.

The scan reads SKILL.md. This mod also ships 6 executable files (scripts/rule-config.py, tests/fixtures/invalidate-candidate.sh, tests/helpers/fake-codegraph.sh, …), listed below but not scanned — reading those needs a real analyzer, not pattern matching.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

cadence-init/skills/rule-config/SKILL.md · 128 lines

How it starts

The opening of the file, as written. The whole thing — 128 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Claude Code 与 Codex 规则配置

概述

配置 Claude Code 与 Codex 的规则:创建并维护 .claude/rules/ 下 7 个框架受管规则文件(模板携带共享 frontmatter 分桶:description/paths/agents/alwaysApply,Claude 消费 paths 条件加载、omp 消费索引与 rule:// 按需正文),内容 drift 时执行框架权威全覆盖;code-usage.md 按最终项目类型从 code-usage-coding.md / code-usage-noncoding.md 单选来源并以固定名称落地。流程还会将 CLAUDE.md 与 AGENTS.md 的 L0 受管区块升级到当前 v5(受支持旧版 v0~v4),创建 cadence/ 产物目录、迁移历史产物、保守合并 openspec/config.yaml,并按需配置 CodeGraph 与 Playwright;S11 omp 桥维护 .agents/rules/ 文件级软链集合与 .omp/AGENTS.md 受管活引用(语义见 references/merge-semantics.md §11.8);入口项目配置仅维护产物自动提交开关,不检测或写入技术栈。入口中的 ## 强制规则 不再以“缺失摘要行追加”为语义,而是执行强制规则章节规范化:创建、清理退役引用、按权威顺序重排并替换旧文案,同时保留无法识别的用户内容。所有需备份分支先将原文件复制归档到 cadence/legacy/<14位时间戳[-N]>/<相对项目根路径>,原位文件不动,再以 atomic_write 原子发布。

脚本报告始终提供不影响 overall 的顶层 warnings 数组;其实际 code 为 USER_LINES_KEPTDUPLICATE_H2ORPHAN_RULE6INVALID_TOGGLEL0_DEDUPs9-settings-unsafe(settings.json 无法安全合并时保守跳过权限写入)、s9-allow-conflict(用户显式 allow 与受管 deny 冲突时保守跳过该 deny)、OMP_BRIDGE_USER_FILE_KEPT.agents/rules/ 内用户文件保留/同名归档替换)、OMP_BRIDGE_MATERIALIZED(symlink 不可用降级物化副本),详情见 references/merge-semantics.md §11.3 与 §11.8。入口首个 ## 项目配置 章节还会确保唯一的“产物自动提交(design/plan/code)”开关:缺失时写入 关闭,合法用户值保留,非法值保留原文并报告 warning;既有技术栈等项目配置内容逐字保留,不由脚本检测或写入。Agent 读取时以 CLAUDE.md 为准、AGENTS.md 兜底;两者不一致按关闭处理并提示 ENTRY_TOGGLE_MISMATCH(这是读取层告警,不是脚本 warnings code)。

全部探测、非框架资产合并与受管文件写入由关联脚本 scripts/rule-config.py 以 dry-run / apply 两阶段完成;另有 verify 子命令执行只读五项自检,支持 --json 并以退出码 0/1 表示通过或发现漂移,适合在变更后核验并以报告为准;需要整体撤销权限区块时使用 --remove-permission-gate,详情均指向报告输出。框架受管规则文件绝不执行章节合并,也不生成“项目补充”或“原项目补充”。Agent 只负责定位脚本、按本文件编排调用、解读报告;当前系统无活跃冲突类型,两模式全程不经用户决策(决策文件机制休眠兜底,见 references/merge-semantics.md §11.6);不得由 Agent 自行读写目标项目的受管文件。合并与冲突处理的权威定义见 references/merge-semantics.md,本文件不重复其十张表。

参数模式

支持以下调用方式:

/rule-config
/rule-config no-interrupt
/rule-config --no-interrupt
  • 等价规范化(强制):命令参数中的裸 token no-interrupt--no-interrupt 完全等价,均进入 no-interrupt 模式;Agent 必须把裸 token no-interrupt 规范化为脚本的 --no-interrupt 标志后再调用脚本,不得把裸 token 原样透传给脚本。
  • 未携带上述 token:进入普通模式。
  • 两种模式互斥;no-interrupt 的权威合并与禁迁移规则不得应用于普通模式。

Read the full file on GitHub · 128 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. today Changed a0cfcd6055d7
  2. yesterday Changed · +1 lines 1998a35f6c68
  3. 11d ago First seen · 127 lines · 27 tokens per session scan A 379f4ae13afa

Subscribe to this mod's changes

rule-config is a skill published in the GitHub repository michaelChe956/Cadence-skills (11 stars, last pushed today), licensed MIT. It adds 27 tokens to every session and 3,720 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Related

Other skills, from other repositories

systematic-debugging

Use when encountering any bug, test failure, or unexpected behavior, before proposing fixes.

obra/superpowers · 21 tokens

local-ai-agents

Build local-first AI agents that run entirely on a developer workstation with Microsoft Foundry Local and Qwen function-calling models. Covers Small Language Models (SLMs), the OpenAI-compatible local endpoint, sandboxed local tools, local RAG with Chroma, local MCP servers, hybrid cloud/local routing, and the…

microsoft/ai-agents-for-beginners · 200 tokens

next-cache-components-adoption

Turn on Cache Components in a Next.js app and resolve the blocking routes it surfaces. Use when the user wants to enable, adopt, or migrate to Cache Components, flip the cacheComponents flag, work through a flood of blocking-prerender / instant validation errors, run the cache-components-instant-false codemod, or…

vercel/next.js · 95 tokens

insight-error-page

Write or audit an insight-kind error page for the Next.js dev overlay. Use when creating a new errors/ .mdx page, auditing an existing one, or checking that a page matches the framework fix cards. Covers page structure, title alignment, FixCard cards with Copy prompt button, code snippets, terminology verification…

vercel/next.js · 83 tokens

next-cache-components-optimizer

Drive a Next.js route to instant navigation by setting up an agentic loop, under Cache Components / PPR, on initial load (hard navigation) and client-side navigation (soft navigation). Encode the goal as a failing @next/playwright instant() e2e and work it to green, one verified route at a time; the shipped test then…

vercel/next.js · 170 tokens

next-partial-prefetching-adoption

Turn on Partial Prefetching in a Next.js app and work through the insights it surfaces. Use when the user wants to enable or adopt Partial Prefetching, flip the partialPrefetching flag, opt routes in with export const prefetch = 'partial', audit Link prefetch={true} behavior, preserve existing prefetched UI with…

vercel/next.js · 103 tokens