Getting it into your agent
This one installs as part of its plugin. Adding the marketplace and installing the plugin brings it with everything else the plugin ships.
/plugin marketplace add Ohswedd/praxis/plugin install praxisWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/ohswedd/praxis/best-practices)<a href="https://agentmods.dev/skills/ohswedd/praxis/best-practices"><img src="https://agentmods.dev/badge/skills/ohswedd/praxis/best-practices.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00138 | $0.01082 |
| Opus 5 | $0.00069 | $0.00541 |
| Sonnet 5 | $0.00028 | $0.00216 |
| Haiku 4.5 | $0.00014 | $0.00108 |
Grade A, and why
best-practices scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 60 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Best Practices
praxis applies established engineering best-practices based on the need: the minimal relevant set for the change at hand, matched to the repo's existing conventions. It never applies everything blindly; KISS and YAGNI are themselves part of the catalog.
How to use it
- Identify the change's domains from the spec/plan. A change usually touches two or three of: API design, data/persistence, domain modelling, security, concurrency, performance, architecture/structure, testing.
- Select the applicable families using the table below. Reach for the full
catalog only when you need the detail:
read
${CLAUDE_PLUGIN_ROOT}/skills/best-practices/reference/catalog.md. - Apply the minimal relevant set, consistent with existing repo patterns. Prefer the simplest solution that satisfies the principle (KISS/YAGNI). Do not introduce a pattern the problem doesn't warrant.
- Check against them in the audit: the vertical auditors already map to families (adversarial→OWASP, perf→complexity/N+1, regression→contracts). Note which best-practices you applied in the report.
Selection table (task signal → families to apply)
| The change… | Apply |
|---|---|
| adds/changes an HTTP endpoint | REST constraints, correct HTTP verbs, idempotency, safe methods, status codes, API versioning, rate limiting; OWASP (authz, input validation) |
| touches the database/schema | Normalisation (to the point that fits), transactions/ACID, indexing, N+1 avoidance, optimistic/pessimistic locking, migration safety |
| models a domain | DDD (bounded context, aggregate, value object, domain event), SoC, high cohesion/low coupling |
| structures code/classes | SOLID, composition over inheritance, DRY, Law of Demeter, appropriate GoF pattern, guard clauses/early return |
| handles auth / user input / secrets | OWASP Top 10 (injection, XSS, CSRF, SSRF), authN vs authZ, RBAC/ABAC, least privilege, password hashing+salting, TLS, input validation, CORS/CSP |
| is on a hot path / large data | Big-O awareness, caching/memoization, pagination, batching, lazy vs eager, connection pooling, avoid accidental quadratic |
| is concurrent/async | immutability, locks/mutex/semaphore correctness, avoid deadlock/race, idempotency, actor/producer-consumer where fitting |
| chooses an architecture | layered/hexagonal/clean/onion, modular monolith vs microservices (default to the simpler that fits), EDA/saga/outbox only when justified |
| distributed data consistency | CAP/PACELC trade-off stated explicitly, ACID vs BASE, eventual consistency, saga/outbox for cross-service writes |
| builds/changes user-facing UI | Front-end & UX: semantic HTML, WCAG accessibility, responsive/mobile-first, design tokens + system consistency (no magic values, no one-off variants), state completeness (loading/empty/error/disabled), Core Web Vitals budget, forms/validation UX, SEO fundamentals on public pages |
| any code | Clean Code (meaningful names, small functions, no magic numbers, pure functions where possible, self-documenting), no code smells, Boy Scout Rule |
| any behaviour change | Testing: right level per the test pyramid (unit/integration/contract/E2E), TDD/BDD where it fits |
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 7d ago First seen · 60 lines · 138 tokens per session scan A 28728f4f822c
best-practices is a skill published in the GitHub repository Ohswedd/praxis (1 stars, last pushed 1mo ago), licensed MIT. It adds 138 tokens to every session and 1,082 once invoked, about $0.0007 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
g-review
Run the review gate on the current branch diff. Runs the test suite, captures the diff, and dispatches code-lead, which verifies done conditions and reviews the diff itself. Issues MERGE READY or HOLD.
g-audit
Full-codebase or targeted code quality audit. Detects SOLID violations, code smells, architectural drift, dead code, and test coverage gaps. Targeted scope produces an inline report. Whole-codebase scope produces a prioritised roadmap milestone.
g-refactor
Guided refactor workflow — identify target, pre-analyse, spec, approve, execute, review. Accepts a scope path, an audit milestone file, or runs interactively. Safe-by-default: checks test coverage before execution and runs the full review gate after.
g-blast-radius
Analyse the blast radius of a planned change. Inputs a file path, feature name, or list of paths from a plan. Outputs the set of dependent files (forward and reverse references), a per-file volatility score (commit frequency proxy), and a total blast-radius rating (low / moderate / wide). Read-only.
refine-loop
Runs a safe, resumable refinement loop over a working repository. It discovers behavior-preserving improvements through four evidence-based lenses, ranks them by ROI, applies one small change at a time, verifies independently, and stops deterministically at diminishing returns or a safety limit. Use when explicitly…
no-mistakes
Validate committed feature-branch changes through the no-mistakes pipeline: intent, rebase, review, test, docs, lint, push, PR, and CI. Use when the user asks to run no-mistakes, ship safely, validate before pushing, or gate a change before it reaches upstream.