Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/slbug/claude-ruby-grape-rails/initnpx skills add slbug/claude-ruby-grape-rails --skill initgit clone --depth 1 https://github.com/slbug/claude-ruby-grape-railsWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00048 | $0.03591 |
| Opus 5 | $0.00024 | $0.01795 |
| Sonnet 5 | $0.00010 | $0.00718 |
| Haiku 4.5 | $0.00005 | $0.00359 |
Grade B, and why
rb:init scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Reads agent configuration directoriesmediumAgent snooping
.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.
in `~/.claude/settings.json`: How it starts
The opening of the file, as written. The whole thing — 284 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Plugin Initialization
Write a managed block of project-specific stack notes into the
project's CLAUDE.md. Do NOT write Iron Laws or Advisory
Preferences into CLAUDE.md — inject-rules.sh delivers them at
runtime on SessionStart + SubagentStart.
Block-reach contract:
| Consumer | Sees CLAUDE.md block? |
|---|---|
| Main session (interactive Claude) | YES |
Subagent spawned WITHOUT omitClaudeMd: true |
YES |
Specialist subagent with omitClaudeMd: true (most reviewers/analyzers) |
NO — relies on inject-rules.sh SubagentStart for Iron Laws + Preferences only; no stack notes |
Plan the block content for main-session skill bodies (/rb:plan,
/rb:review, /rb:verify, /rb:work). Do NOT inject content
needed by specialist subagents into this block; surface it through
their per-agent prompt or the inject-rules.sh runtime payload.
Usage
/rb:init— Fresh install/rb:init --update— Update existing managed block
Detect the Stack
Check the project before writing anything.
Detection rules:
- Always run
${CLAUDE_PLUGIN_ROOT}/bin/detect-stackfirst. - Prefer exact
*_VERSIONvalues from that script when writing the managed-block header. - Use plain
detectedonly as a last resort when a direct gem is present but no resolved lockfile version is available. - Never use broad substring regexes like
/rails \(([^)]+)\)/against rawGemfile.lock; they can falsely match gems such asrubocop-rails. - Read these detector keys before deciding what ORM/package
guidance to inject:
- ORM:
DETECTED_ORMS,PRIMARY_ORM - Rails shape:
RAILS_COMPONENTS,FULL_RAILS_APP - Ruby:
RUBY_VERSION(placeholder source).INTERPRETER_RUBY_VERSIONis informational only — emitted when interpreter differs from project pin. - Packages:
PACKAGE_LAYOUT,PACKAGE_LOCATIONS,HAS_PACKWERK,PACKAGE_QUERY_NEEDED
- ORM:
- If
PACKAGE_QUERY_NEEDED=true, ask the user:No Packwerk detected. Do you have something similar implemented? Provide modules/packages location and their stack/ORM. - If
DETECTED_ORMScontains BOTHactive_recordANDsequel(mixed-ORM repo), run theMIXED_ORM_SECTIONinterview (per${CLAUDE_SKILL_DIR}/references/conditional-sections.md§ "MIXED_ORM_SECTION") regardless ofPACKAGE_QUERY_NEEDEDvalue.detect-stackdoes NOT emit per-package ORM ownership — interview is the only source. Skip when only one ORM detected. - Do not reimplement stack detection inline in chat or ad-hoc Ruby snippets.
detect-stackis the source of truth. - If
${CLAUDE_PLUGIN_ROOT}/bin/detect-stackis missing or fails, STOP and explain that plugin stack detection is unavailable instead of inventing a fallback parser.
What ships with it
3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 284 lines · 48 tokens per session scan B e0a3d56cd0e6
rb:init is a skill published in the GitHub repository slbug/claude-ruby-grape-rails (7 stars, last pushed 3d ago), licensed MIT. It adds 48 tokens to every session and 3,591 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it B with 1 finding (reads agent configuration directories). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
opencli-sitemap-author
Use when creating or maintaining OpenCLI site sitemaps: agent-facing navigation, page-state, action, workflow, API-reference, pitfall, and fallback knowledge for a website. Use after browser exploration discovers durable site context, when a sitemap is stale, or when promoting local site knowledge into the repo.
golden-rss
Use when testing the rss golden build.
omh-code-review
This is a Hermes-native code-review workflow skill.
redteam-web-detail-pack
Routing and boundary guidance for authorized general web application security testing. Use as a web testing router when the attack surface should be dispatched to more specific web vulnerability skills.
android-pentest
安卓应用渗透测试 — APK分析、Hook、自动化测试、运行态驱动、签名恢复、抓包分析.
studio
Architecture Studio control plane — initialize or inspect a studio workspace, create and register projects, or route an architecture/AEC task to the right agent or skill. Use when the user runs /as:studio, asks to set up or open their studio, manage its projects, or describes a task without naming a skill.