ordinus: Skill for Claude Code

.agents/skills/lavish/SKILL.md

lavish is a skill for Claude Code from muratgur/ordinus. It costs 61 tokens per session (1,618 once invoked), scanned A, original, MIT.

A tool for turning detailed agent responses into rich HTML pages that people can review, annotate, and send feedback on. It uses the lavish-axi command-line tool.

In plain words
What is it for?
Use it for interactive explainers, technical plans, comparisons, reports, diagrams, or reviewing a proposed code diff in a browser.
Why use it?
It gives complex plans, comparisons, diagrams, tables, reports, and code changes a visual review surface instead of leaving them as plain chat text.

Skill for Claude Code

Written for Claude Code: argument-hint in frontmatter. Also seen: installed under .agents/ (shared by several agents).

This is muratgur/ordinus's own configuration. It tells Claude Code how to work on ordinus itself, so it is not a mod to install elsewhere. Copy it as a starting point and replace the rules that are about this project. Everything ordinus configures →

Reuse

Borrowing it

Nothing to install: this file belongs to muratgur/ordinus. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file
curl -O https://raw.githubusercontent.com/muratgur/ordinus/master/.agents/skills/lavish/SKILL.md
Clone the repo
git clone --depth 1 https://github.com/muratgur/ordinus

Made for: Claude Code.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for lavish

README.md
[![agentmods](https://agentmods.dev/badge/skills/muratgur/ordinus/lavish/github.svg)](https://agentmods.dev/skills/muratgur/ordinus/lavish)
Your own site
<a href="https://agentmods.dev/skills/muratgur/ordinus/lavish"><img src="https://agentmods.dev/badge/skills/muratgur/ordinus/lavish/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for lavish

Your own site · 80×15
<a href="https://agentmods.dev/skills/muratgur/ordinus/lavish"><img src="https://agentmods.dev/badge/skills/muratgur/ordinus/lavish.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 61 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 1,618 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe. Third-party audits
  • NVIDIA SkillSpector warn 7 Sept 2026
SkillSpector: 13 findings, up to medium

These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →

  • medium MCP Rug Pull · line 14
    npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
    Fix: Pin the version: npx @scope/[email protected]
  • medium MCP Rug Pull · line 16
    npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
    Fix: Pin the version: npx @scope/[email protected]
  • medium MCP Rug Pull · line 17
    npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
    Fix: Pin the version: npx @scope/[email protected]
  • medium MCP Rug Pull · line 33
    npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
    Fix: Pin the version: npx @scope/[email protected]
  • medium MCP Rug Pull · line 34
    npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
    Fix: Pin the version: npx @scope/[email protected]
  • medium MCP Rug Pull · line 39
    npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
    Fix: Pin the version: npx @scope/[email protected]
  • medium MCP Rug Pull · line 50
    npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
    Fix: Pin the version: npx @scope/[email protected]
  • medium MCP Rug Pull · line 63
    npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
    Fix: Pin the version: npx @scope/[email protected]
  • medium MCP Rug Pull · line 66
    npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
    Fix: Pin the version: npx @scope/[email protected]
  • medium MCP Rug Pull · line 67
    npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
    Fix: Pin the version: npx @scope/[email protected]
  • medium MCP Rug Pull · line 68
    npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
    Fix: Pin the version: npx @scope/[email protected]
  • medium MCP Rug Pull · line 69
    npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
    Fix: Pin the version: npx @scope/[email protected]
  • medium MCP Rug Pull · line 70
    npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
    Fix: Pin the version: npx @scope/[email protected]
How audits are shown
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00061 $0.01618
Opus 5.5 $0.00024 $0.00647
Sonnet 5.5 $0.00012 $0.00324
Haiku 4.5 $0.00006 $0.00162

Measured 2mo ago against content hash d2c99f37344b, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

lavish scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2mo ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.agents/skills/lavish/SKILL.md · 72 lines

How it starts

The opening of the file, as written. The whole thing — 72 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Lavish Editor

Lavish Editor helps agents turn rich HTML artifacts into collaborative human review surfaces. Whenever you are about to give user a complex response that will be easier to understand via a rich / interactive page, consider using Lavish Editor. First generate an interactive HTML artifact according to user request, then run npx -y lavish-axi <html-file> so the user can visually review it, annotate elements or selected text, queue prompts, and send feedback back through npx -y lavish-axi poll.

You do not need lavish-axi installed globally - invoke it with npx -y lavish-axi <html-file>. If lavish-axi output shows a follow-up command starting with lavish-axi, run it as npx -y lavish-axi ... instead.

Request

$ARGUMENTS

If the request above is non-empty, the user invoked /lavish explicitly - build an HTML artifact for that request now, following the workflow below. If it is empty, infer what to visualize from the conversation.

When to use

Use lavish-axi when the user asks for a visual artifact, HTML explainer, interactive prototype, review surface, product or technical plan, comparison, report, or browser-based feedback loop

Workflow

  1. Create the HTML artifact (default location .lavish/<name>.html in the working directory).
  2. Run npx -y lavish-axi <html-file> to open or resume a review session in the browser.
  3. Run npx -y lavish-axi poll <html-file> to long-poll for the user's annotations, queued prompts, and browser-reported layout_warnings. The poll stays silent until the user acts or the real browser reports fresh layout warnings - leave it running, never kill it. If your harness limits how long a foreground command may run, run the poll as a background task; if it gets killed or times out anyway, just re-run it - queued feedback is never lost.
  4. If poll returns layout_warnings, fix overflow, clipped text, or overlapping unreadable content and re-check before involving the human.
  5. Apply human feedback, then poll again with --agent-reply "<message>" to reply in the browser and keep the loop going.
  6. Run npx -y lavish-axi end <html-file> when the review is finished.

Read the full file on GitHub · 72 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2mo ago First seen · 72 lines · 61 tokens per session scan A d2c99f37344b

Subscribe to this mod's changes

lavish is a skill published in the GitHub repository muratgur/ordinus (114 stars, last pushed 1mo ago), licensed MIT. It adds 61 tokens to every session and 1,618 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Related

Other skills, from other repositories

electron

Use when building, hardening, or shipping a cross-platform Electron desktop app — main/renderer/preload process model, typed contextBridge IPC, locking down nodeIntegration/contextIsolation/sandbox/CSP, or packaging with signing and auto-update. NOT a Rust-backed shell on the native webview (that is tauri), nor the…

ericrisco/rsc-harness · 77 tokens

electron-expert

Expert in Electron framework, desktop app development, IPC, and cross-platform packaging. Use when the user mentions desktop, Node.js, cross platform, Windows, macOS, or Linux, or when the task involves Electron Architecture, Process Types, IPC Communication, or App Lifecycle.

personamanagmentlayer/pcl · 59 tokens

ai-deployment-patterns

Guides expert-level ai deployment patterns implementation: ai-ml and devops decision frameworks, production-ready patterns, and concrete templates for ai deployment patterns workflows. Use when the user asks about ai deployment patterns, ai deployment patterns configuration, or ai-ml best practices for ai projects. Do…

FerroxLabs/wayland · 87 tokens

ai-evaluation-patterns

Guides expert-level ai evaluation patterns implementation: ai-ml and testing decision frameworks, production-ready patterns, and concrete templates for ai evaluation patterns workflows. Use when the user asks about ai evaluation patterns, ai evaluation patterns configuration, or ai-ml best practices for ai projects.…

FerroxLabs/wayland · 86 tokens

automation-architect

Workflow automation design using Zapier, Make, and n8n covering trigger-action architecture, multi-step automation workflows, error handling strategies, personal versus business automation patterns, ROI calculation, and a library of common automation recipes. Use when the user asks about automation architect, related…

FerroxLabs/wayland · 90 tokens

convert-audit

Score existing direct-response copy against The Donahoe Method's 8 frameworks: Four-Layer Open, Conversational Proof, Three Locks, Bullet System, Cascade Close, Greased Chute, Voice Rules + Bullshit Filter, Market Temperature. Produces a 0-100 normalized score, dimension-by-dimension findings, and prioritized rewrite…

FerroxLabs/wayland · 138 tokens