Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add wan-huiyan/claude-ecosystem-hygiene --skill skill-portfolio-repo-placement-scangit clone --depth 1 https://github.com/wan-huiyan/claude-ecosystem-hygieneWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/wan-huiyan/claude-ecosystem-hygiene/skill-portfolio-repo-placement-scan)<a href="https://agentmods.dev/skills/wan-huiyan/claude-ecosystem-hygiene/skill-portfolio-repo-placement-scan"><img src="https://agentmods.dev/badge/skills/wan-huiyan/claude-ecosystem-hygiene/skill-portfolio-repo-placement-scan/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/wan-huiyan/claude-ecosystem-hygiene/skill-portfolio-repo-placement-scan"><img src="https://agentmods.dev/badge/skills/wan-huiyan/claude-ecosystem-hygiene/skill-portfolio-repo-placement-scan.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00291 | $0.01895 |
| Opus 5 | $0.00146 | $0.00948 |
| Sonnet 5 | $0.00058 | $0.00379 |
| Haiku 4.5 | $0.00029 | $0.00189 |
Grade A, and why
skill-portfolio-repo-placement-scan scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 142 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Skill-Portfolio → Repo Placement Scan
When you maintain dozens of authored skills and several themed repos (bundles,
marketplaces, lesson collections), skills end up in the wrong place or nowhere: a
worktree lesson that belongs in the parallel-agents bundle sits loose in
~/.claude/skills/, a repo's published copy of a skill drifts behind the local one, or
the same skill gets copied into two repos and the copies diverge. This skill maps the
portfolio to the repos cleanly.
The output is a recommendation report — per repo: ADD / UPDATE / CROSS-LINK / NOTES. Do not mutate any repo as part of this scan; mutating is a separate, confirmed step.
Why the naive approach fails (read this first)
The instinct is "grep skill names/descriptions for each repo's theme keywords and recommend the matches." That produces garbage, for three reasons this skill exists to prevent:
-
Repos are not homogeneous — match on FUNCTION, not theme. A liberal lesson collection absorbs any on-theme lesson; a curated workflow bundle has a high bar and should reject general lessons that merely share keywords. Each repo needs its own function-level inclusion test, not a shared keyword filter. Expected yield differs wildly per repo (high / moderate / low / near-zero) — and "nothing fits" is a correct, valuable answer for a focused repo.
-
Portfolio duplication. Many candidates are already homed — as their own standalone repo, or inside a sibling target repo. Recommending those as ADDs creates cross-repo copies that drift. They must be detected and downgraded to CROSS-LINK (mention in README, don't bundle).
-
"Update" needs a real method. The installed copy at
~/.claude/skills/<name>is often just stale install-lag, not an improvement — so it isn't automatically the source of truth. UPDATE detection means comparingversion:/last_verified:frontmatter (and body size) between the repo copy and the most-developed local copy, and reporting the direction of divergence.
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago First seen · 142 lines · 291 tokens per session scan A baa457a6a592
skill-portfolio-repo-placement-scan is a skill published in the GitHub repository wan-huiyan/claude-ecosystem-hygiene (1 stars, last pushed 26d ago), licensed MIT. It adds 291 tokens to every session and 1,895 once invoked, about $0.0015 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
session-handoff
End-of-session handoff that captures session knowledge, dispatches output across the canonical 7-bucket docs/ taxonomy (decisions/runbooks/analysis/references/reviews/handoffs/deliverables — aligned with memory-hygiene v3.3), triggers a doc-freshness reverse-lint + skill-freshness audit to catch stale normative…
successor-handoff
Use when orchestrating long-running autonomous work — overnight runs, multi-hour research, multi-track experiments, 10+ hour jobs — where a single Claude context window cannot hold the full run. Establishes a lean parent orchestrator, file-first subagents, and successor-handoff (fresh subagent spawned mid-run when…
ghost-blog
This skill should be used when the user wants to interact with a Ghost blog via its Content and Admin APIs. Relevant when the user says things like 'list my blog posts', 'create a new draft', 'publish my draft', 'schedule a post for tomorrow', 'upload an image to my blog', 'manage blog tags', 'show my Ghost site…
top-design
Create award-winning, immersive web experiences at the level of Awwwards-featured agencies. Use when the user mentions "Awwwards quality", "make my site stunning", "scroll animations", "parallax storytelling", "cinematic web design", "portfolio site", or "brand experience". Also trigger when elevating a standard…
traction-eos
Implement the Entrepreneurial Operating System (EOS) to align vision and execution across a company. Use when the user mentions "EOS", "Entrepreneurial Operating System", "V/TO", "quarterly rocks", "Level 10 meetings", "accountability chart", "IDS process", "my company feels chaotic", "we keep having the same…
create-app
Guided journey from a raw app idea to a validated, cleanly architected first version that ships on a sustainable cadence. Orchestrates ten skills phase by phase - lean-startup, design-sprint, clean-architecture, domain-driven-design, clean-code, pragmatic-programmer, system-design, ios-hig-design, 37signals-way…