uv-sbom: Skill for Claude Code

.claude/skills/ideate/SKILL.md

ideate is a skill for Claude Code from Taketo-Yoda/uv-sbom. It costs 19 tokens per session (1,676 once invoked), scanned A, original, MIT.

A feature-planning workflow that turns a raw product idea into a detailed GitHub Issue. It asks about the problem and users, checks scope and value, compares alternatives, and prepares a technical specification.

In plain words
What is it for?
Use it to triage feature ideas, assess differentiation, define expected output, and create an English-language Issue ready for implementation.
Why use it?
An idea is not yet an implementation plan: its users, value, limits, and technical details may be unclear. This workflow exposes those gaps before development begins.

Skill for Claude Code

Written for Claude Code: installed under .claude/. Also seen: mentions CLAUDE.md.

This is Taketo-Yoda/uv-sbom's own configuration. It tells Claude Code how to work on uv-sbom itself, so it is not a mod to install elsewhere. Copy it as a starting point and replace the rules that are about this project. Everything uv-sbom configures →

Reuse

Borrowing it

Nothing to install: this file belongs to Taketo-Yoda/uv-sbom. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file
curl -O https://raw.githubusercontent.com/Taketo-Yoda/uv-sbom/develop/.claude/skills/ideate/SKILL.md
Clone the repo
git clone --depth 1 https://github.com/Taketo-Yoda/uv-sbom

Made for: Claude Code.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for ideate

README.md
[![agentmods](https://agentmods.dev/badge/skills/taketo-yoda/uv-sbom/ideate/github.svg)](https://agentmods.dev/skills/taketo-yoda/uv-sbom/ideate)
Your own site
<a href="https://agentmods.dev/skills/taketo-yoda/uv-sbom/ideate"><img src="https://agentmods.dev/badge/skills/taketo-yoda/uv-sbom/ideate/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for ideate

Your own site · 80×15
<a href="https://agentmods.dev/skills/taketo-yoda/uv-sbom/ideate"><img src="https://agentmods.dev/badge/skills/taketo-yoda/uv-sbom/ideate.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 19 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 1,676 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00019 $0.01676
Opus 5.5 $0.00008 $0.00670
Sonnet 5.5 $0.00004 $0.00335
Haiku 4.5 $0.00002 $0.00168

Measured 1mo ago against content hash 477c2075439e, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

ideate scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.claude/skills/ideate/SKILL.md · 172 lines

How it starts

The opening of the file, as written. The whole thing — 172 lines — stays where its author put it; the contents beside it link to each section on GitHub.

/ideate - Feature Ideation Skill

Orchestrates the complete workflow from a feature idea to a fully-formed, vision-aligned GitHub Issue ready for autonomous implementation.

Language Requirement

IMPORTANT: All outputs (Issue title, body, comments) MUST be written in English.

Workflow Overview

Raw Idea → Triage → Competitive Analysis → Technical Specification → Issue Creation

Steps

Step 1: Capture the Feature Idea (MANDATORY)

Ask the user (if not already provided):

  • What problem does this feature solve?
  • Who is the target user? (developer / security engineer / compliance reviewer)
  • What should the output look like? (if it affects SBOM output)

Do NOT proceed to Step 2 until this information is captured.

Step 2: Run Feature Triage (MANDATORY)

Read .claude/feature-triage.md and apply the 4-step checklist.

Output the triage result in this format:

Triage Result:
- Step 1 (Scope): PASS / STOP (reason: ...)
- Step 2 (Value): PASS (criteria: A/B/C) / FAIL
- Step 3 (Differentiation): D: yes/no, E: yes/no, F: yes/no
- Step 4 (Output Quality): PASS / FAIL
- Priority: HIGH / MEDIUM / LOW / OUT OF SCOPE

If triage result is OUT OF SCOPE or STOP: stop and explain why. If triage result is PASS: continue to Step 3.

The triage result block goes into the AI section under ## Triage & Competitive Analysis. A single human-facing line — **Priority**: HIGH / MEDIUM / LOW — goes at the end of ## Summary in the human section.

Step 3: Competitive Analysis (MANDATORY for HIGH/MEDIUM priority)

For features that pass triage at HIGH or MEDIUM priority, briefly check:

  1. Does cyclonedx-python, pip-audit, or Syft already offer this? (check .claude/competitive-landscape.md if it exists)
  2. If yes: is our version differentiated enough? How?
  3. If no: note this as a potential differentiator.

Include the competitive analysis finding in the AI section under ## Triage & Competitive Analysis, directly below the triage result. If it is the Issue's main justification, also state it as one bullet in ## Why.

Read the full file on GitHub · 172 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 1mo ago Changed · +37 lines 477c2075439e
  2. 1mo ago First seen · 135 lines · 19 tokens per session scan A 73b15d2abc21

Subscribe to this mod's changes

ideate is a skill published in the GitHub repository Taketo-Yoda/uv-sbom (6 stars, last pushed yesterday), licensed MIT. It adds 19 tokens to every session and 1,676 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-04.