kendex: Skill for Claude Code

.agents/skills/code-quality/SKILL.md

code-quality is a skill for Claude Code from vanillagreencom/kendex. It costs 32 tokens per session (2,980 once invoked), scanned C, original, MIT.

A set of rules for writing and changing code safely, with emphasis on explicit errors, checked assumptions, and correct handling of edge cases. It also uses each project’s own instructions.

In plain words
What is it for?
Use it before modifying code to guide implementation and review of error paths, invariants, boundary values, empty input, retries, and dependency failures.
Why use it?
It helps prevent silent wrong results, ignored failures, unsafe fallbacks, and code that does not handle unusual input or interrupted operations.

Skill for Claude Code

Written for Claude Code: user-invocable in frontmatter. Also seen: installed under .agents/ (shared by several agents).

This is vanillagreencom/kendex's own configuration. It tells Claude Code how to work on kendex itself, so it is not a mod to install elsewhere. Copy it as a starting point and replace the rules that are about this project. Everything kendex configures →

Reuse

Borrowing it

Nothing to install: this file belongs to vanillagreencom/kendex. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file
curl -O https://raw.githubusercontent.com/vanillagreencom/kendex/main/.agents/skills/code-quality/SKILL.md
Clone the repo
git clone --depth 1 https://github.com/vanillagreencom/kendex

Made for: Claude Code.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for code-quality

README.md
[![agentmods](https://agentmods.dev/badge/skills/vanillagreencom/kendex/code-quality/github.svg)](https://agentmods.dev/skills/vanillagreencom/kendex/code-quality)
Your own site
<a href="https://agentmods.dev/skills/vanillagreencom/kendex/code-quality"><img src="https://agentmods.dev/badge/skills/vanillagreencom/kendex/code-quality/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for code-quality

Your own site · 80×15
<a href="https://agentmods.dev/skills/vanillagreencom/kendex/code-quality"><img src="https://agentmods.dev/badge/skills/vanillagreencom/kendex/code-quality.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 32 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 2,980 The whole file, excluding the scripts and references it only reads on demand.
Security scan C 1 finding. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00032 $0.02980
Opus 5.5 $0.00013 $0.01192
Sonnet 5.5 $0.00006 $0.00596
Haiku 4.5 $0.00003 $0.00298

Measured 8d ago against content hash f27ea58213f1, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade C, and why

code-quality scanned grade C with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Hidden instructionshighPrompt injection

Directives inside HTML comments, invisible characters or bidirectional overrides are read by the model and not by the person reviewing the file.

<!-- kendex:project-instructions:start -->
.agents/skills/code-quality/SKILL.md · 131 lines

How it starts

The opening of the file, as written. The whole thing — 131 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Project Instructions

Problems with a kendex-owned skill go through kendex report; check ownership in the file first.

React

  • A store selector returns a stable reference: never mint an array, object or Set inside one, since a fresh value re-renders forever and blanks the page.
  • An effect that positions or measures rendered content takes what is drawn as its trigger, not a list of state names; the exhaustive-dependencies lint checks only what the effect reads.

Platform rules

Enforce a rule on the platform where it can hold it (GitHub settings and rulesets, a harness's own settings). Keep a hook, script or instruction guard only where it cannot, and state why at the guard.

Compatibility

From 1.0, kendex keeps a retired consumer-visible form reading, with one warning that names the new form, until the next major release. This overrides § Cleanup's no-shim line here; the rule is changelog.d/README.md § Release standard.

Code Quality

Repo-specific standards live in each repo's ## Project Instructions section and add to these rules. Before changing code, load the reference for each affected stack under § Language Discipline.

Core Principle

Do not trade correctness for a smaller change. A failed check limits the evidence; it does not establish a product defect. Name the reachable failure before claiming user impact.

Correctness

  • Fix the cause in its existing owner. If the correct fix exceeds the scope, report that conflict instead of adding a workaround.
  • A dependency failure must not become a passing result or a default value. A required gate refuses when it cannot read or evaluate its evidence. An advisory check reports unavailable with the cause. An absent or unknown application input is a separate contract choice; state why refusing it is necessary where that choice is made.
  • When changing a state with mutually exclusive cases, use one tagged value with exhaustive handling. Do not start a refactor of untouched fields without a reachable invalid state.
  • A gate, guard or scanner adds no enumerated exemption list. State the rule at the point where the code cannot judge.
  • An unexpected branch asserts or returns the violated invariant. An error names the failed operation, not a neighbouring dependency.
  • An automated tool's refusal or notice starts with a stable key and the value acted on. Put the human explanation on later lines. Keep each diagnostic in one place.

Read the full file on GitHub · 131 lines

Files

What ships with it

5 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 8d ago Changed f27ea58213f1
  2. 9d ago Changed · +1 lines 1d94c3a9ef43
  3. 14d ago Changed · +2 lines 18525758b0c8
  4. 16d ago Changed · +2 lines c9d4b05ae257
  5. 19d ago Changed · -1 lines a67334a8f6ce
  6. 21d ago Changed · +4 lines 522b010e99d0
  7. 23d ago Changed · -25 lines scan E → C 2e73718d7cec
  8. 24d ago Changed · +5 lines f43da3e443a2
  9. 25d ago Changed · +1 lines cc0c27691300
  10. 26d ago First seen · 142 lines · 32 tokens per session scan E b06b6845bf48

Subscribe to this mod's changes

code-quality is a skill published in the GitHub repository vanillagreencom/kendex (87 stars, last pushed yesterday), licensed MIT. It adds 32 tokens to every session and 2,980 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it C with 1 finding (hidden instructions). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.