Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add openEHR/ai-plugins --skill scaffoldgit clone --depth 1 https://github.com/openEHR/ai-pluginsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/openehr/ai-plugins/scaffold)<a href="https://agentmods.dev/skills/openehr/ai-plugins/scaffold"><img src="https://agentmods.dev/badge/skills/openehr/ai-plugins/scaffold/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/openehr/ai-plugins/scaffold"><img src="https://agentmods.dev/badge/skills/openehr/ai-plugins/scaffold.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00054 | $0.02688 |
| Opus 5.5 | $0.00022 | $0.01075 |
| Sonnet 5.5 | $0.00011 | $0.00538 |
| Haiku 4.5 | $0.00005 | $0.00269 |
Grade A, and why
scaffold scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 136 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Install or upgrade the standard file set in the repository at the current directory: a
specifications-XX repo, or a new empty one. $ARGUMENTS may name the component. The file set, its
variables and its revision history are in ${CLAUDE_SKILL_DIR}/assets/template-set.json;
${CLAUDE_SKILL_DIR}/scripts/scaffold.py (Python 3.8+, standard library only) performs the file
operations. Let the script write the managed files; edit by hand only in the cases that steps 3 and 5
name. If python3 is missing, say so and stop. In a tool that does not expand ${CLAUDE_SKILL_DIR},
use the directory that holds this SKILL.md.
The set covers AsciiDoc specification repos, with an optional BMM schema. In an OpenAPI repo such as
specifications-ITS-REST, pin agents, claude-md and asciidoctorconfig (step 4): they are
AsciiDoc-specific. The script never offers a BMM schema to the ITS-XML, ITS-BMM, ITS-JSON and
ITS-REST repos, which hold no model of their own, and rejects a bmm_schema_id there. Pin bmm in
any other new repo that has no model.
The root README is README.md. A README.adoc in its place is planned as convert and rewritten as
Markdown by hand (step 5), because the script cannot translate AsciiDoc.
A new repository (plan mode init) also gets computable/BMM/<bmm_schema_id>.bmm.json (file id
bmm). The script asks the local ghcr.io/openehr/bmm-publisher image for the schemas it bundles
and copies the highest version for the component. When the image bundles none, it writes an empty
schema: one root package org.openehr.<name>, no classes, BASE included for other components, and
rm_release equal to first_release. The check needs Docker and the image, and never pulls it.
Existing repositories are not offered a schema.
Steps
- Plan. Run
python3 ${CLAUDE_SKILL_DIR}/scripts/scaffold.py plan --repo ., adding--var component=<id>when$ARGUMENTSnames one. It writes nothing and prints JSON:mode,repo,variables(each with its source),missing_variables,invalid_variables,files,migration_steps,warnings,todo_markers. Confirm thatrepois the repository root the user means. The modes areinit(none of the files exist yet),upgrade(some do:recorded_revisionis null when the repo was never scaffolded, otherwise it is older thanlatest_revisionandmigration_pathlists the revisions to apply, in order) andcurrent. If the output is{"error": ...}, show the message and stop; do not edit.claude/scaffold.jsonto get past it (for example "update the openehr-specs plugin" means a newer plugin scaffolded this repo). - Variables. When
statusisneeds_input, ask for each missing or invalid variable, then plan again with--var name=value. A variable whose source isdefaultor starts withinferredis a guess. Ask the user to confirm the ones that matter (license,jira_project,bmm_schema_id,bmm_dependencies,default_branch,published_url, andfirst_releaseonly when the plan createsmanifest.jsonor a new empty BMM schema, the files that use it) and list the rest in one line. In a new repository,bmm_schema_idcomes frominferred: bmm-publisher imageorinferred: new empty schema. Never invent a title, a Jira key or a filter id. Values the user confirmed earlier are recorded in.claude/scaffold.jsonand kept; a recorded default is not, so a BMM schema added later shows up as a new guess to confirm.--overwriteand--pinaccept only the file ids andagents:<region>ids thatfileslists; anything else is an error. - Review. Summarise the
filesby action and ask before applying. Show thedetailof everymerge,conflictandexistsentry (aLICENSEthat differs from the standard text) and everywarningsentry.create,merge,update: the script writes. For.claude/settings.json, say what it grants: theopenehrmarketplace, four enabled plugins, pre-approvedgit add,git commitandgit diff, WebFetch onspecifications.openehr.org, and three read-only Atlassian MCP calls. If the user wants thegit addandgit commitrules gone, remove them from the file after applying: later runs leave out what the user removed, and add only what a newer revision introduces.createforbmm: say from itsdetailwhether the schema is copied from the image or new and empty.blocked(onlybmm): the image could not be checked, anddetailsays why. Offer to start Docker, or to rundocker pull ghcr.io/openehr/bmm-publisher(a large download; ask first), and plan again. Or create the empty schema thedetailnames with--var bmm_schema_id=<id>. Applying anyway writes the other files without a schema;--overwrite bmmadds one later.convert(onlyreadme): theconvert_fromfile (README.adoc) stands whereREADME.mdbelongs. Say that step 5 rewrites it as Markdown, or merges it into the existingREADME.mdwhendetailsays so, and ask.exists,exists-alternative(for exampleREADME.rst),unchanged,pinned,skipped(no BMM schema for an existing repository, where--overwrite bmmasks for one, nor for an ITS repository): nothing to do. Aconflictwhosedetailsays the file is a symbolic link cannot be resolved with--overwrite: the user has to replace the link first.conflict:detailsays whether the file was edited since it was scaffolded or simply differs. Show the difference withdiff --repo . --file <id>(repeat the--varoptions), then ask: keep it, take the template (--overwrite <id>), or leave it alone for good (--pin <id>). InAGENTS.md, each entry offiles[].regionshas its own action and id: use it as--overwrite agents:<region>or--pin agents:<region>. Regions markedupdateoraddare written even when another region conflicts;removedmeans the user deleted the region, and nothing is done.upgrade-manual:AGENTS.mdexists without scaffold regions. Print the template withrender --repo . --file agents(repeat the--varoptions), compare it with the file, and offer to edit the file so the shared sections sit between the<!-- openehr-scaffold:begin <id> -->markers, or to pin it.migration_steps: show them, with eachnoteas a manual step. The file actions shown are for the tree as it is now;applyre-plans after running the steps and returns each step'sresult.- Nothing but
unchanged,exists,exists-alternative,pinnedandskipped, and nomigration_steps: report "up to date" and stop. - A directory that is not a git repository: offer
git init -b <default_branch>; if git itself is missing, say so.
- Apply. Run the same command with
apply, repeating the--varoptions and adding the--overwriteand--pinoptions the user chose. Check that the output hasapplied: true;status: needs_inputmeans nothing was written. The script never changes an existing seed file (manifest.json,LICENSE,README.md, a BMM schema), never rewrites a hand-edited file or region without--overwrite, and records the revision, variables and file hashes in.claude/scaffold.json. - Finish. List
written. For eachtodo_markersentry (aTODO(scaffold)comment inAGENTS.md), offer to fill it from the repo's content and delete the comment once it is filled. Whenmanifest.jsonwas created, point out that itsspecificationslist starts empty (skillopenehr-specs:authoring). When an empty BMM schema was created, point out that classes go into it (skillopenehr-specs:bmm-authoring, which also checks it) and the class tables are generated from it (skillopenehr-specs:class-generation); until then bmm-publisher warns about the empty package. For aconvertthe user agreed to, rungit mv README.adoc README.md(a plain rename outside git), then rewrite the file as GitHub Markdown by${CLAUDE_SKILL_DIR}/references/readme-markdown.md, keeping all of its content. WhenREADME.mdalready existed, merge the AsciiDoc file's content into it instead, and delete the AsciiDoc file. Showgit diff -M, then plan again:README.mdis nowexists. Do not commit; if the user asks for a commit message, follow the Conventions section of the repo'sAGENTS.md.
What ships with it
17 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- assets/template-set.json 8.4 KB
- assets/templates/agents-md.tmpl 7.3 KB
- assets/templates/asciidoctorconfig.tmpl 65 B
- assets/templates/bmm-json.tmpl 679 B
- assets/templates/claude-md.tmpl 416 B
- assets/templates/claude-settings.json.tmpl 723 B
- assets/templates/gitignore.tmpl 233 B
- assets/templates/license-apache-2.0.txt 11 KB
- assets/templates/license-cc-by-sa-3.0.txt 22 KB
- assets/templates/manifest-json.tmpl 422 B
- assets/templates/readme-md.tmpl 540 B
- migrations/0002.json 395 B
- migrations/0003.json 42 B
- migrations/0004.json 42 B
- references/maintaining.md 14 KB
- references/readme-markdown.md 2.6 KB
- scripts/scaffold.py 61 KB runs code
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 7d ago Changed · +34 lines · +12 tokens per session 2ad2beccab3f
- 8d ago Changed · +4 lines f522f47a2521
- 9d ago First seen · 98 lines · 42 tokens per session scan A bc08ce48cae5
scaffold is a skill published in the GitHub repository openEHR/ai-plugins (3 stars, last pushed yesterday), licensed Apache-2.0. It adds 54 tokens to every session and 2,688 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-08.
Other skills, from other repositories
chief-operating-officer
Owns execution: how work actually gets done across the organization, including process, program management, capacity, vendors, supply chain, and service delivery. Use this when execution is the problem rather than strategy, to design or fix a process, to resolve cross-functional handoff failures, to plan capacity, to…
chief-product-officer
Owns what gets built and why: product strategy, roadmap, discovery, user experience, and the definition of success for each release. Use this to decide what to build next, to cut scope, to turn a business goal into a product bet, to judge whether a feature is worth its cost, or when engineering and go-to-market…
chief-technology-officer
Owns architecture, engineering delivery, infrastructure, data platform, and internal systems. Use this for build-versus-buy calls, technology selection, architectural direction, engineering capacity and delivery risk, technical debt tradeoffs, platform and tooling decisions, or when a technical choice has business…
customer-success-management
Runs the ongoing relationship with accounts after the sale — segmenting coverage against account value, building a health score that predicts rather than describes, running reviews customers find worth attending, forecasting renewals honestly, and finding expansion that follows usage instead of quota. Use this to…
chief-information-officer
The CIO's remit — running the technology the company works on, service quality, IT spend, and the boundary with product engineering. Use this to set IT priorities, decide what IT owns versus engineering, structure IT spend or an IT roadmap, judge whether to build, buy or outsource, or work out why IT is seen as a cost…
service-desk
Runs the IT service desk — intake, triage, prioritization, escalation, knowledge, and the metrics that improve service rather than distort it. Use this to set up or fix a service desk, design ticket priority and escalation, reduce repeat contacts, structure a knowledge base, or work out why a desk hitting its targets…