Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/patrickserrano/lacquernpx agentmods add skills/patrickserrano/lacquer/working-with-lacquerWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/patrickserrano/lacquer/working-with-lacquer)<a href="https://agentmods.dev/skills/patrickserrano/lacquer/working-with-lacquer"><img src="https://agentmods.dev/badge/skills/patrickserrano/lacquer/working-with-lacquer/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/patrickserrano/lacquer/working-with-lacquer"><img src="https://agentmods.dev/badge/skills/patrickserrano/lacquer/working-with-lacquer.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00035 | $0.02408 |
| Opus 5.5 | $0.00014 | $0.00963 |
| Sonnet 5.5 | $0.00007 | $0.00482 |
| Haiku 4.5 | $0.00003 | $0.00241 |
Grade A, and why
working-with-lacquer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 215 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Working With Lacquer
Lacquer renders shared content — CLAUDE.md regions, skills, commands, lint
configs, git hooks, CI workflows — from one repo into every project. A project
declares its shape in .lacquer.toml; lacquer sync writes the content;
lacquer audit checks the project against it and is wired into CI.
The rule that explains every mechanism below: a lacquer-managed file is identical to the lacquer's copy, or it is excluded. There is no third state. A quietly-edited copy is how one project's pre-commit hook ends up weaker than its CI while looking healthy.
Is this file mine?
lacquer audit # classifies every managed unit, lists the ones that aren't clean
lacquer status # each CLAUDE region's stamped version vs the lacquer's latest
If audit lists it, the lacquer owns it. Typically: .swiftlint.yml,
.swiftformat, biome.json, deno.jsonc, .pre-commit-config.yaml,
lefthook.yml, .github/workflows/<profile>-*.yml, .claude/skills/**,
.claude/commands/**, and the <!-- lacquer:… --> regions inside CLAUDE.md
/ AGENTS.md. Text outside those markers in a CLAUDE.md is the project's and
is preserved.
Exit codes
| Code | Means | Fix |
|---|---|---|
| 0 | clean | — |
| 1 | the command failed (bad manifest, I/O, missing profile) | read the message |
| 2 | usage error | — |
| 3 | a managed file was edited locally; sync would clobber it | see below |
| 4 | a project baseline is not met | meet it, or time-box a relaxation |
| 5 | lacquer doctor: a check proved it cannot fail |
fix the check |
| 6 | a stack on disk is not declared in .lacquer.toml |
lacquer adopt |
Recipes
Exit 3 — "a lacquer-managed file was edited in this project." Decide which is true, then do that one:
- The change should apply everywhere → make it in the lacquer repo, open a PR there, then re-sync this project. This is the default and usually the right answer.
- This project genuinely owns the file → add it to
[project].excludewith areason(and anuntilif it is temporary — see "Exclusions" below). The lacquer then neither distributes nor tracks it. - The edit was accidental →
lacquer sync(orsync --forceto take the lacquer's version over yours).
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago Changed · +3 lines · -78 tokens per session b9088d237410
- 2mo ago Changed · +1 lines · +4 tokens per session be8d7bccf359
- 2mo ago First seen · 211 lines · 109 tokens per session scan A f86955bb3ffa
working-with-lacquer is a skill published in the GitHub repository patrickserrano/lacquer (5 stars, last pushed 4d ago), licensed MIT. It adds 35 tokens to every session and 2,408 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
working-with-lacquer compared with skills from other repositories
| Mod | Type | Stars | Last push | Licence | Scan | Tokens | Works with |
|---|---|---|---|---|---|---|---|
| working-with-lacquerpatrickserrano/lacquer | Skill | 5 | 4d ago | MIT | A | 35 | Claude Code, Codex |
| jkavivsinai/jenkins-cli | Skill | 98 | 3d ago | MIT | A | 26 | Claude Code |
| ci-failuresGoldziher/ai-rulez | Skill | 167 | yesterday | MIT | A | 26 | Claude Code |
| go-tooling-securityfusengine/codex | Skill | 2 | 25d ago | none | A | 46 | Claude Code, Codex |
| golang-continuous-integrationalexastrum/skl | Skill | 10 | 4mo ago | MIT | A | 87 | Claude Code |
| gh-skillcli/cli | Skill | 47k | yesterday | MIT | A | 41 | Claude Code, Codex |
| cionsi/ginkgo | Skill | 9.1k | 4d ago | MIT | A | 151 | Claude Code |