Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add shinpr/ai-coding-project-boilerplate --skill coding-standardsgit clone --depth 1 https://github.com/shinpr/ai-coding-project-boilerplateWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/shinpr/ai-coding-project-boilerplate/coding-standards)<a href="https://agentmods.dev/skills/shinpr/ai-coding-project-boilerplate/coding-standards"><img src="https://agentmods.dev/badge/skills/shinpr/ai-coding-project-boilerplate/coding-standards/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/shinpr/ai-coding-project-boilerplate/coding-standards"><img src="https://agentmods.dev/badge/skills/shinpr/ai-coding-project-boilerplate/coding-standards.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Excessive Agency · line 16 Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.Fix: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00030 | $0.02714 |
| Opus 5.5 | $0.00012 | $0.01086 |
| Sonnet 5.5 | $0.00006 | $0.00543 |
| Haiku 4.5 | $0.00003 | $0.00271 |
Grade A, and why
coding-standards scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 217 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Universal Coding Standards
Technical Anti-patterns (Red Flag Patterns)
When any pattern below is detected, pause implementation and record: the triggered pattern, affected current requirement, smallest compliant alternative, and verification needed to resume. Resume when the alternative removes the pattern or a documented requirement justifies retaining it.
Code Quality Anti-patterns
- Writing similar code 3 or more times - Violates Rule of Three
- Multiple responsibilities mixed in a single file - Violates Single Responsibility Principle (SRP)
- Defining same content in multiple files - Violates DRY principle
- Making changes without checking dependencies - Potential for unexpected impacts
- Disabling code with comments - Should use version control
- Error suppression - Hiding problems creates technical debt
- Type assertions standing in for a guarantee - Declaring a type that neither a runtime check nor an existing contract establishes
Design Anti-patterns
- "Make it work for now" thinking - Accumulation of technical debt
- Patchwork implementation - Unplanned additions to existing code
- Symptomatic fixes - Surface-level fixes that don't solve root causes
- Unplanned large-scale changes - Lack of incremental approach
Basic Principles
Inspect until the evidence identifies the lowest-total-complexity solution that delivers the required user, operator, or maintainer value while keeping the system correct and maintainable.
- Evidence-Bounded Refactoring - Refactor code that blocks the current outcome, is changed by the current task, or fails an applicable quality check; use small behavior-preserving steps. Report other findings with their owning boundary and evidence without expanding the active change
- Current-Requirement Code Only - Introduce code paths, capabilities, infrastructure, abstractions, or speculative edge-case handling when a current requirement, verified constraint, or evidence-backed material risk requires them (YAGNI)
- Design Convergence - Deliver the current required outcome with the least new design surface. Before introducing persistent state, a public or cross-boundary contract, a behavioral mode, a reusable abstraction, or a component split, record what the existing capabilities already deliver, what they fail to deliver for the current outcome, and why the addition is the smallest thing that closes that gap
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago Changed · -14 lines a0f2bf3b4a46
- 7d ago Changed · -3 lines 85d4708c9d62
- 26d ago Changed · -24 lines 16abdd5a91de
- 1mo ago Changed · -1 lines c967c13d590c
- 1mo ago Changed · -9 lines 2f7a2b8beaf7
- 1mo ago Changed a463d874ffca
- 1mo ago First seen · 268 lines · 30 tokens per session scan A 155f68b56413
coding-standards is a skill published in the GitHub repository shinpr/ai-coding-project-boilerplate (234 stars, last pushed 5d ago), licensed MIT. It adds 30 tokens to every session and 2,714 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
output-eval-error-analysis
Systematically review workflow traces to identify failure modes before building evaluators. Use when starting an eval project, after significant pipeline changes, or when production quality drops.
install-jazz-github-action
Set up Jazz as a GitHub Action for automated PR code review and on-demand /jazz PR assistance. Use when the user asks to add Jazz to CI, create a GitHub Action workflow, set up PR review automation, enable /jazz commands on PRs, or integrate Jazz with GitHub.
V3 CLI Modernization
CLI modernization and hooks system enhancement for claude-flow v3. Implements interactive prompts, command decomposition, enhanced hooks integration, and intelligent workflow automation.
panning-for-gold
Triage raw unstructured input (transcripts, brain dumps) into evaluated thread inventories and a synthesized gold-found file. Four phases: front-gate, extract, evaluate, synthesize. Use when you say "pan for gold", "triage transcript", "synthesize gold-found", or hand it a voice transcript or brain dump. Do NOT use…
avoiding-manufactured-work
Detect and stop manufactured work after a deliverable appears done, and classify a post-completion finding into the four contract classes builder-ethos.md delegates here. Use when a worker has produced a plan, issue, PR, backlog item, research artifact, or follow-up task and you need to verify it was demanded by a…
reuse-before-you-write
Use before writing any new function, helper, component or module - find what the repository, the standard library and the installed dependencies already provide, and use an established library instead of hand-rolled code for a non-trivial problem.