Borrowing it
Nothing to install: this file belongs to racecraft-lab/racecraft-plugins-public. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/racecraft-lab/racecraft-plugins-public/main/.claude/skills/scaffold-skill/SKILL.mdgit clone --depth 1 https://github.com/racecraft-lab/racecraft-plugins-publicWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/racecraft-lab/racecraft-plugins-public/scaffold-skill)<a href="https://agentmods.dev/skills/racecraft-lab/racecraft-plugins-public/scaffold-skill"><img src="https://agentmods.dev/badge/skills/racecraft-lab/racecraft-plugins-public/scaffold-skill/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/racecraft-lab/racecraft-plugins-public/scaffold-skill"><img src="https://agentmods.dev/badge/skills/racecraft-lab/racecraft-plugins-public/scaffold-skill.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00091 | $0.00777 |
| Opus 5.5 | $0.00036 | $0.00311 |
| Sonnet 5.5 | $0.00018 | $0.00155 |
| Haiku 4.5 | $0.00009 | $0.00078 |
Grade A, and why
scaffold-skill scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 69 lines — stays where its author put it; the contents beside it link to each section on GitHub.
scaffold-skill
Scaffolds a new skill in a marketplace plugin. Both user-invocable and Claude-invocable.
Inputs to ask for
- Plugin — which plugin (default:
speckit-pro) - Skill name — kebab-case, e.g.
my-skill - Description — one sentence with concrete trigger phrases (the description is what Claude matches on; vague descriptions = skill never fires)
- Codex mirror — required for a
speckit-proskill: Layer 1 fails whenskills/<name>/has nocodex-skills/<name>/SKILL.md. Create it with the Codex frontmatter and sidecar described below. - References / scripts — does the skill need supporting files? Default: no (start minimal per CLAUDE.md "Simplest change" rule)
What this creates
<plugin>/skills/<name>/
└── SKILL.md
With frontmatter:
---
name: <name>
description: <description>
license: MIT
---
Codex mirror (required for speckit-pro):
<plugin>/codex-skills/<name>/
├── SKILL.md
└── agents/openai.yaml
The Codex SKILL.md frontmatter carries name and description only: Layer 1 rejects the Claude Code-only keys license, user-invocable, disable-model-invocation, and argument-hint there. Copy the agents/openai.yaml shape from a sibling Codex skill.
Optional references/ and scripts/ subdirs (only if user said yes).
Post-create
First, if you created a Codex mirror, add the new skill's name to validate_codex_skills_SKILLS in tests/speckit-pro/layer1-structural/validate-skill-contracts.py. Layer 1 runs the Codex frontmatter checks only for skills listed there, so a Layer 1 run before registration can pass invalid Codex frontmatter.
Then run Layer 1 from the repository root:
python3 tests/speckit-pro/run-all.py --layer 1
If Layer 1 fails, fix the SKILL.md before reporting success. A new skill under speckit-pro/ changes shipped source, so also run python3 scripts/refresh-release-artifacts.py; the artifact-consistency CI job fails without it.
What this does NOT do
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago Changed a3706e6ec975
- 1mo ago First seen · 69 lines · 91 tokens per session scan A d388186a5b2b
scaffold-skill is a skill published in the GitHub repository racecraft-lab/racecraft-plugins-public (5 stars, last pushed 6d ago), licensed MIT. It adds 91 tokens to every session and 777 once invoked, about $0.0004 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
build-executor
Execute an active direct request or approved planned change. Native continuous implementation is the default; existing legacy changes retain their recorded contract obligations.
contract-builder
Maintain an execution contract only for an existing legacy change that requires one. New direct/planned changes do not invoke this skill when a contract is absent.
codex-issue-coordinator
Coordinates a large batch of GitHub issues through separate Codex worker threads, tested pull requests, review loops, and gated merges. Use when the user asks one Codex thread to manage several coding sessions or complete a parent issue, milestone, or issue batch.
plan
Turns a reviewed spec or decided brief into ordered tasks for separate agent runs. Use for implementation tasks, tracker tickets, or useful milestones. Do not use for one coding task or its short execution outline.
review
Uses a fresh agent to review an implementation change without editing it. Checks behavior, security, regressions, complexity, tests, docs, and missing proof. Use for code, PR, diff, security, second-opinion, or pre-merge reviews.
html-doc
Generates a polished, static HTML reading view from an existing Markdown PRD or technical design. Use when a user asks to render, present, visualize, or make a PRD or design document easier for humans to read in a browser.