What is bulwark-scaffold?

A project setup tool for Bulwark, which provides development rules and supporting project tools. It creates a Justfile, log folders, a Bun-based toolchain, and optionally hooks; a Justfile is a file of named commands for project tasks, while Bun is a JavaScript runtime and package manager.

Preparing projects in supported languages, checking or installing Just and Bun, creating log directories, and configuring optional hooks.

It avoids manually creating the same project folders, commands, runtime setup, and optional hooks for each project.

bulwark-scaffold — Skill for Claude Code by QBall-Inc

Install

Getting it into your agent

This one installs as part of its plugin. Adding the marketplace and installing the plugin brings it with everything else the plugin ships.

Claude Code

/plugin marketplace add QBall-Inc/the-bulwark

Claude Code

/plugin install the-bulwark

Made for: Claude Code.

Or install the-bulwark, the plugin that ships this one along with the rest of its 30 skills, 17 agents, 6 hooks.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/qball-inc/the-bulwark/bulwark-scaffold/github.svg)](https://agentmods.dev/skills/qball-inc/the-bulwark/bulwark-scaffold)

Your own site

<a href="https://agentmods.dev/skills/qball-inc/the-bulwark/bulwark-scaffold"><img src="https://agentmods.dev/badge/skills/qball-inc/the-bulwark/bulwark-scaffold/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/skills/qball-inc/the-bulwark/bulwark-scaffold"><img src="https://agentmods.dev/badge/skills/qball-inc/the-bulwark/bulwark-scaffold.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 0 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 6,251 The whole file, excluding the scripts and references it only reads on demand.

Security scan D 3 findings. A grade says what 26 rules found in the file — not that it is safe.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00000	$0.06251
Opus 5	$0.00000	$0.03125
Sonnet 5	$0.00000	$0.01250
Haiku 4.5	$0.00000	$0.00625

Measured 11d ago against content hash f921c6d1bb12, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-11, from the pricing page.

Security

Grade D, and why

bulwark-scaffold scanned grade D with 3 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Downloads and executes remote codehighSupply chain

curl | sh runs whatever the server returns today, which is not necessarily what it returned when this was reviewed.

Print: " Linux: curl -fsSL https://bun.sh/install | bash"

Reads agent configuration directoriesmediumAgent snooping

.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.

| `~/.claude/settings.json` | User settings | Global user hooks |

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

Linux. Does NOT use curl|bash.

skills/bulwark-scaffold/SKILL.md · 557 lines

How it starts

The opening of the file, as written. The whole thing — 557 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Bulwark Scaffold

Initialize Bulwark infrastructure in a project by generating Justfile templates, creating the logs directory structure, and optionally configuring hooks.

Mandatory Execution Checklist (BINDING)

Every item below is mandatory. No deviations. No substitutions. No skipping. Skipping items violates SC1-SC3 (Skill Compliance Rules in Rules.md).

You are the orchestrator. Follow every item in order. Do NOT return to the user until all applicable items are checked.

Step 1 — Parse arguments: --force, --no-hooks, --with-permission-hook, --dry-run, --lang=<...> extracted from $ARGUMENTS
Step 2 — Detect project language: If --lang not supplied, project files inspected (package.json, pyproject.toml, Cargo.toml, go.mod, etc.); defaults to generic when no signal found
Step 3 — just runtime check: command -v just runs; if missing, follow Step 3 install path
Step 3.5a — bun runtime check: bash <resolved-installer-path> --verify invoked (NOT command -v bun — that bypasses version check); follow Step 3.5 install path if exit non-zero
Step 3.5b — Installer copy: scripts/install-bun.sh copied to ${CLAUDE_PROJECT_DIR}/scripts/ so Justfile recipes can reference it project-relatively
Step 3.6 — Existing Justfile check: If a Justfile is already present, abort unless --force (with backup created)
Step 4 — Dry-run check: If --dry-run, preview the planned writes and exit without modifying disk
Step 5 — Justfile generation: Template emitted from lib/templates/justfile-<lang>.just; bun + eval recipes (install-bun, verify-bun, eval-skill, eval-grade, eval) confirmed present in output
Step 6 — logs/ subdirectories: diagnostics/, validations/, debug-reports/ created
Step 7 — .gitignore: Bulwark log patterns appended idempotently
Step 8 — Hooks: If plugin-level hooks active, SKIP .claude/settings.json hook injection (anti-duplication)
Step 8a — Permission hook (opt-in): ONLY if --with-permission-hook — confirm trust (AskUserQuestion), merge PreToolUse entry into .claude/settings.json, copy bulwark-permission-hook.sh, record choice. Default (no flag) = NOT installed
Step 9 — Scaffold log: logs/scaffold-{ts}.yaml written with top-level reviewed_files: [...] (Stop-hook contract)
Step 10 — Report results: User-facing summary emitted listing files written, installer outcomes, and any skipped steps

Read the full file on GitHub · 557 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

11d ago First seen · 557 lines · 0 tokens per session scan D f921c6d1bb12

Subscribe to this mod's changes

bulwark-scaffold is a skill published in the GitHub repository QBall-Inc/the-bulwark (8 stars, last pushed yesterday), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 6,251 tokens. A static security scan graded it D with 3 findings (downloads and executes remote code, reads agent configuration directories, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Claude Code ai-coding-assistant ai-governance anthropic claude-code-plugin claude-code-skills

github-pr-review

Handles PR review comments and feedback resolution. Use when user wants to resolve PR comments, handle review feedback, fix review comments, address PR review, check review status, respond to reviewer, verify PR readiness, review PR comments, analyze review feedback, evaluate PR comments, assess review suggestions, or…

fvadicamo/dev-agent-skills · 95 tokens

privacy-guard

Prevents private infrastructure details (node hostnames, internal project names, local usernames and personal emails, absolute home paths, private and VPN IP ranges) from leaking into public repositories through commits, PRs, docs or release artifacts. Use when working in a public or soon-to-be-public repo, before…

fvadicamo/dev-agent-skills · 128 tokens

github-pr-merge

Merges GitHub Pull Requests after validating pre-merge checklist. Use when user wants to merge PR, close PR, finalize PR, complete merge, approve and merge, or execute merge. Runs pre-merge validation (tests, lint, CI, comments), confirms with user, merges with proper format, handles post-merge cleanup.

fvadicamo/dev-agent-skills · 72 tokens

github-pr-creation

Creates GitHub Pull Requests with automated validation and task tracking. Use when user wants to create PR, open pull request, submit for review, or check if ready for PR. Analyzes commits, validates task completion, generates Conventional Commits title and description, suggests labels. NOTE - for merging existing…

fvadicamo/dev-agent-skills · 75 tokens

git-commit

Creates git commits following Conventional Commits format with type/scope/subject. Use when user wants to commit changes, create commit, save work, or stage and commit. Enforces project-specific conventions from CLAUDE.md.

fvadicamo/dev-agent-skills · 49 tokens

resolve-plugins

Curate Claude Code skill / MCP / hook picks against live upstream sources and pin them in .claude/settings.json. Adding a process harness (a paired skill set) is an ordinary pick this door handles. Reads stack from docs/techstack.md, workflow signal from docs/overview.md + existing pins, then live-queries six source…

RockyHong/super-bootstrap · 133 tokens

bulwark-scaffold