Borrowing it
Nothing to install: this file belongs to pantoum-spfx/pantoum. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/pantoum-spfx/pantoum/main/.claude/skills/pantoum-conventions/SKILL.mdgit clone --depth 1 https://github.com/pantoum-spfx/pantoumWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/pantoum-spfx/pantoum/pantoum-conventions)<a href="https://agentmods.dev/skills/pantoum-spfx/pantoum/pantoum-conventions"><img src="https://agentmods.dev/badge/skills/pantoum-spfx/pantoum/pantoum-conventions/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/pantoum-spfx/pantoum/pantoum-conventions"><img src="https://agentmods.dev/badge/skills/pantoum-spfx/pantoum/pantoum-conventions.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00009 | $0.00457 |
| Opus 5.5 | $0.00004 | $0.00183 |
| Sonnet 5.5 | $0.00002 | $0.00091 |
| Haiku 4.5 | $0.00001 | $0.00046 |
Grade A, and why
pantoum-conventions scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Runs shell commandslowCapability
Expected in a hook, worth knowing in a rule or an instructions file.
- Use `child_process.execSync` for commands, not shell-specific syntax What it actually says
PANTOUM Conventions
These conventions are automatically applied when working in the PANTOUM codebase.
Template Safety
All AI prompts live in src/templates/*.md. Changes to templates affect how Claude Code interacts with user codebases during upgrades.
Rules:
- Any change to a template file requires re-testing against the PuntoBello suite of SPFx solutions
- Do not hardcode prompts in source code — use the template system
- Templates use Mustache-style substitution (
{{variable}}) and conditional blocks ({{#if condition}}...{{/if}})
SDK Caution
The Claude Agent SDK (@anthropic-ai/claude-agent-sdk) is a critical dependency. Version changes can alter AI behavior during upgrades.
Rules:
- Do not upgrade the Agent SDK without testing against real SPFx solutions
- Document any SDK version changes in commit messages
- If upgrading, verify that metrics tracking (tokens, cost, tools) still works correctly
Defaults Source of Truth
src/defaults.ts is the single source of truth for all default values.
Rules:
- Never define default values in
src/cli.tsor other files - All files that need defaults must import from
src/defaults.ts - When adding a new setting, add the default in
src/defaults.tsfirst
Cross-Platform Scripts
All scripts must work on Windows, macOS, and Linux.
Rules:
- Use Node.js (
#!/usr/bin/env node) for scripts, not bash or PowerShell - Use
path.join()for paths, not hardcoded separators - Use
child_process.execSyncfor commands, not shell-specific syntax - Exception:
scripts/sync-to-public.shis bash (only runs on dev machine)
Security
Rules:
- No web browsing in AI prompts — all migration instructions must be self-contained
- WebFetch and WebSearch tools are intentionally removed from the adapter
- Never include API keys, tokens, or credentials in templates or committed files
- Sanitize user input at system boundaries
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2mo ago First seen · 54 lines · 9 tokens per session scan A c0e49e82af60
pantoum-conventions is a skill published in the GitHub repository pantoum-spfx/pantoum (6 stars, last pushed 2mo ago), licensed MIT. It adds 9 tokens to every session and 457 once invoked, about $0.0000 per session on Opus 5.5. A static security scan graded it A with 1 finding (runs shell commands). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
pantoum-conventions compared with skills from other repositories
| Mod | Type | Stars | Last push | Licence | Scan | Tokens | Works with |
|---|---|---|---|---|---|---|---|
| pantoum-conventionspantoum-spfx/pantoum | Skill | 6 | 2mo ago | MIT | A | 9 | Claude Code |
| metabot-teamxvirobotics/metabot | Skill | 1.0k | 12d ago | MIT | A | 33 | Claude Code, Codex |
| five-whyswesammustafa/Claude-Code-Everything-You-Need-to-Know | Skill | 3.5k | 3d ago | none | A | 53 | Claude Code |
| tddwesammustafa/Claude-Code-Everything-You-Need-to-Know | Skill | 3.5k | 3d ago | none | A | 4 | Claude Code |
| check-linkswesammustafa/Claude-Code-Everything-You-Need-to-Know | Skill | 3.5k | 3d ago | none | A | 44 | Claude Code, Codex |
| review-checklistwesammustafa/Claude-Code-Everything-You-Need-to-Know | Skill | 3.5k | 3d ago | none | A | 25 | Claude Code, Codex |
| changelogwesammustafa/Claude-Code-Everything-You-Need-to-Know | Skill | 3.5k | 3d ago | none | A | 28 | Claude Code |