init

init is a skill for Claude Code from QBall-Inc/the-bulwark. It costs 49 tokens per session (5,405 once invoked), scanned B, original, MIT.

A setup and maintenance tool for Bulwark project governance, meaning the files that define project rules and working practices. It creates or verifies CLAUDE.md and rules.md files and can configure a status line, language server, and project scaffolding.

In plain words
What is it for?
Installing governance at project or user scope, verifying an existing setup, interactively updating canonical rule changes, and enabling optional tools.
Why use it?
It gives a project a consistent set of working rules and lets you check or review updates to those rules later.

Skill for Claude Code

Written for Claude Code: allowed-tools in frontmatter. Also seen: reads .claude/ paths; mentions CLAUDE.md; names the AskUserQuestion tool.

Runs only inside its plugin — its command needs a path that Claude Code sets for a plugin’s own hooks and for nothing else. Install the plugin, not this.

Part of the the-bulwark plugin — 30 skills, 17 agents, 6 hooks shipped together

Good fit Installing governance at project or user scope, verifying an existing setup, interactively updating canonical rule changes, and enabling optional tools.

Compare 6 skills from other repositories ↓
Install

Getting it into your agent

This one installs as part of its plugin. Adding the marketplace and installing the plugin brings it with everything else the plugin ships.

Claude Code
/plugin marketplace add QBall-Inc/the-bulwark
Claude Code
/plugin install the-bulwark

Made for: Claude Code.

Or install the-bulwark, the plugin that ships this one along with the rest of its 30 skills, 17 agents, 6 hooks.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for init

README.md
[![agentmods](https://agentmods.dev/badge/skills/qball-inc/the-bulwark/init.svg)](https://agentmods.dev/skills/qball-inc/the-bulwark/init)
Your own site
<a href="https://agentmods.dev/skills/qball-inc/the-bulwark/init"><img src="https://agentmods.dev/badge/skills/qball-inc/the-bulwark/init.svg" alt="Measured on agentmods" height="20"></a>
Per session 49 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 5,405 The whole file, excluding the scripts and references it only reads on demand.
Security scan B 2 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00049 $0.05405
Opus 5 $0.00024 $0.02703
Sonnet 5 $0.00010 $0.01081
Haiku 4.5 $0.00005 $0.00541

Measured 8d ago against content hash 54dd98c081ca, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-07, from the pricing page.

Security

Grade B, and why

init scanned grade B with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Reads agent configuration directoriesmediumAgent snooping

.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.

If `statusline: true` in state file, check that `~/.claude/settings.json` contains statusline configuration.

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

Platform support: Linux + macOS + WSL via `curl|bash` from `bun.sh/install`; Windows-native prints PowerShell instructions (`powershell -c "irm bun.sh/install.ps1 | iex"`). PATH integration writes to bun's default locati
skills/init/SKILL.md · 526 lines

How it starts

The opening of the file, as written. The whole thing — 526 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Bulwark Init

Initialize, verify, or update Bulwark governance for a project or user. Installs governance files and optionally configures statusline, LSP, and project scaffolding. The --update mode handles propagation of canonical template changes (added rules, new In-Session Protocol sections, etc.) into the user-owned files that init originally wrote — /plugin updates skills/agents/hooks but cannot touch user's CLAUDE.md / rules.md.

Usage

/the-bulwark:init                          # Interactive fresh install
/the-bulwark:init --scope=project          # Project scope, skip prompt
/the-bulwark:init --scope=user             # User scope
/the-bulwark:init --verify                 # Verify previous init completed
/the-bulwark:init --update                 # Review canonical template changes interactively
/the-bulwark:init --scope=project /path    # Project scope at specific path

Mode Routing

IF $ARGUMENTS contains "--verify":
    → Jump to VERIFY MODE (Stage 8)
ELIF $ARGUMENTS contains "--update":
    → Jump to UPDATE MODE (Stage 9)
ELSE:
    → Continue with INIT MODE (Stage 1)

The three modes are mutually exclusive. --verify and --update are different operations: --verify asserts the original install completed correctly (read-only health check); --update proposes per-section additions from updated canonical templates (mutating, but interactive — no section is written without user approval).


INIT MODE

Stage 1: Parse Arguments

Extract from $ARGUMENTS:

  • --scope=project or --scope=user → SCOPE
  • Remaining positional argument → TARGET_DIR (optional, defaults to current directory for project scope)

Stage 2: Pre-Flight — Cross-Scope Initialization Check

Check BOTH scopes regardless of which scope the user selected. This prevents silent conflicts where governance files exist at one scope and the user initializes at another.

Detect existing files at project scope:

  • ./CLAUDE.md (or <target-dir>/CLAUDE.md)
  • ./.claude/rules/rules.md (or <target-dir>/.claude/rules/rules.md)

Read the full file on GitHub · 526 lines

Files

What ships with it

4 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 8d ago First seen · 526 lines · 49 tokens per session scan B 54dd98c081ca

Subscribe to this mod's changes

init is a skill published in the GitHub repository QBall-Inc/the-bulwark (8 stars, last pushed today), licensed MIT. It adds 49 tokens to every session and 5,405 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it B with 2 findings (reads agent configuration directories, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Related

Other skills, from other repositories

github-pr-review

Handles PR review comments and feedback resolution. Use when user wants to resolve PR comments, handle review feedback, fix review comments, address PR review, check review status, respond to reviewer, verify PR readiness, review PR comments, analyze review feedback, evaluate PR comments, assess review suggestions, or…

fvadicamo/dev-agent-skills · 95 tokens

privacy-guard

Prevents private infrastructure details (node hostnames, internal project names, local usernames and personal emails, absolute home paths, private and VPN IP ranges) from leaking into public repositories through commits, PRs, docs or release artifacts. Use when working in a public or soon-to-be-public repo, before…

fvadicamo/dev-agent-skills · 128 tokens

github-pr-merge

Merges GitHub Pull Requests after validating pre-merge checklist. Use when user wants to merge PR, close PR, finalize PR, complete merge, approve and merge, or execute merge. Runs pre-merge validation (tests, lint, CI, comments), confirms with user, merges with proper format, handles post-merge cleanup.

fvadicamo/dev-agent-skills · 72 tokens

github-pr-creation

Creates GitHub Pull Requests with automated validation and task tracking. Use when user wants to create PR, open pull request, submit for review, or check if ready for PR. Analyzes commits, validates task completion, generates Conventional Commits title and description, suggests labels. NOTE - for merging existing…

fvadicamo/dev-agent-skills · 75 tokens

git-commit

Creates git commits following Conventional Commits format with type/scope/subject. Use when user wants to commit changes, create commit, save work, or stage and commit. Enforces project-specific conventions from CLAUDE.md.

fvadicamo/dev-agent-skills · 49 tokens

resolve-plugins

Curate Claude Code skill / MCP / hook picks against live upstream sources and pin them in .claude/settings.json. Adding a process harness (a paired skill set) is an ordinary pick this door handles. Reads stack from docs/techstack.md, workflow signal from docs/overview.md + existing pins, then live-queries six source…

RockyHong/super-bootstrap · 133 tokens