Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/mrclrchtr/supinpx agentmods add skills/mrclrchtr/supi/claude-md-improverWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/mrclrchtr/supi/claude-md-improver)<a href="https://agentmods.dev/skills/mrclrchtr/supi/claude-md-improver"><img src="https://agentmods.dev/badge/skills/mrclrchtr/supi/claude-md-improver/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/mrclrchtr/supi/claude-md-improver"><img src="https://agentmods.dev/badge/skills/mrclrchtr/supi/claude-md-improver.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Agent Snooping · line 92 Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.Fix: Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00039 | $0.03271 |
| Opus 5.5 | $0.00016 | $0.01308 |
| Sonnet 5.5 | $0.00008 | $0.00654 |
| Haiku 4.5 | $0.00004 | $0.00327 |
Grade A, and why
claude-md-improver scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 277 lines — stays where its author put it; the contents beside it link to each section on GitHub.
CLAUDE.md Improver
Audit, evaluate, and improve CLAUDE.md files across a codebase to ensure PI has optimal project context.
Workflow
Phase 1: SuPi Context Baseline Review
Do not read target instruction files yet. Start from the session context and available tool surface. When code_orientation is available, assume future agents use it routinely and repeatedly—not only as a fallback. Static facts that are on demand rather than automatically injected are still poor CLAUDE.md content when Orientation exposes them directly.
Purpose: This baseline is the primary evidence for scoring Criterion 7 (SuPi Context Overlap) in Phase 3. Separate context that arrives on the first turn from facts routinely obtained through Orientation so the audit preserves human reasoning rather than generated inventories.
Step 1 — Detect SuPi context surfaces. Scan the conversation context and available tools for:
| Source identifier | What to look for | Typical content |
|---|---|---|
supi-code-intelligence overview |
Hidden first-turn project overview | Every discovered module's name, description, selected manifest entrypoints, manifest-declared dependency arrows, detected languages |
code_orientation workspace focus |
Workspace Orientation | Root manifest, package names and paths, manifest-declared package relationships, direct root files and directories |
code_orientation directory/file focus |
Focused Orientation | Applicable instruction files, direct directory entries, package manifest/dependency facts, file outline/import/export observations |
native-pi |
Root/ancestor CLAUDE.md or AGENTS.md loaded into the system prompt | Project-wide instructions from the cwd chain |
| Other extensions | <extension-context source="..."> blocks |
Any other extension-delivered context |
Step 2 — Build the baseline. Record both first-turn and routine on-demand coverage:
| Source | Content Category | Already Covers | Scope |
|---|---|---|---|
supi-code-intelligence overview |
Complete discovered module graph | Module names, descriptions, entrypoints, dependency relationships, languages | Root-level / first turn |
code_orientation |
Workspace facts | Package paths, manifests, dependency relationships, direct root entries | Root-level / on demand |
code_orientation |
Directory and file facts | Direct entries, package declarations/dependencies, outlines/imports/exports | Package-specific / on demand |
code_orientation |
Instruction-file surfacing | Configured CLAUDE.md/AGENTS.md files for trusted directory focus, up to 200 lines per file |
Package-specific / on demand |
native-pi |
Root instructions | Context files in the cwd/ancestor chain | Root-level / first turn |
What ships with it
3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 277 lines · 39 tokens per session scan A 8e04869eab9c
claude-md-improver is a skill published in the GitHub repository mrclrchtr/supi (98 stars, last pushed today), licensed MIT. It adds 39 tokens to every session and 3,271 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
muse-delegate
Delegate a coding task to Muse Code (muse) as a background implementer, then review its diff and land it yourself. Use this whenever the user wants to hand implementation work to Muse — phrasings like "have Muse do X", "delegate this to Muse", "run it through Muse", or "use Muse to implement/fix/refactor" — or wants…
review
Review a change for correctness, security, and missing tests.
gh-address-comments
Help address review/issue comments on the open GitHub PR for the current branch using gh CLI; verify gh auth first and prompt the user to authenticate if not logged in.
pi-parity-review
Adversarially verify that a ported change is faithful to the original pi implementation (TS source + published npm build). Use after porting upstream pi changes, or standalone on any area of this repo ("is X faithful to pi?").
pi-go-review
Review ported Go code for idiomatic quality — that the port maximizes Go rather than transliterating TypeScript. Use after porting upstream pi changes, or standalone on any diff in this repo.
review-pr
Deeply review a GitHub pull request.