A setup skill that initializes Archguardian, a project scanner for code checks, with configuration and a Git pre-commit hook. A pre-commit hook is an automatic check that runs before Git creates a commit.

Use it to initialize or reconfigure Archguardian, run an initial scan, set scan boundaries and severity rules, and create a baseline for existing findings.

It gives a new project a configured scan and catches configured problems during commits, while letting you review or adjust languages, folders, analyzers, and thresholds.

setup — Skill by ysfAskri

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods

npx agentmods add skills/ysfaskri/archguardian/setup

Any agent

npx skills add ysfAskri/archguardian --skill setup

Clone the repo

git clone --depth 1 https://github.com/ysfAskri/archguardian

Made for: Claude Code, Codex.

Per session 13 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 388 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. Scan, not verified.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5	$0.00013	$0.00388
Opus 5	$0.00006	$0.00194
Sonnet 5	$0.00003	$0.00078
Haiku 4.5	$0.00001	$0.00039

Measured 2d ago against content hash 1cd3cd9278db, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

setup scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.claude/skills/setup/SKILL.md · 51 lines

What it actually says

archguardian setup

Initialize archguardian in the current project.

Instructions

Check if archguardian is already installed:

ls .archguard.yml 2>/dev/null && echo "EXISTS" || echo "NOT_FOUND"

If already configured, read .archguard.yml and summarize the current settings. Ask if the user wants to reconfigure.
If not configured, run init:
```
npx archguardian init
```
After init, read the generated .archguard.yml and walk the user through key settings:
- Languages: Which languages to analyze
- Include/Exclude: Which directories to scan
- Analyzers: Which are enabled and their thresholds
- Severity: What blocks commits vs what just warns
Ask if they want to customize anything based on their project. Apply edits to .archguard.yml as needed.
Run a quick scan to show the initial state:
```
npx archguardian scan --format json
```
If there are many findings, suggest creating a baseline:
```
npx archguardian scan --update-baseline
```
Remind the user that the pre-commit hook is now installed and will run archguardian check automatically on every commit.

Tips

For monorepos, adjust the include patterns to target specific packages.
The severity.maxWarnings setting controls how many warnings are allowed before blocking a commit.
Suggest starting with security enabled and other analyzers at warning level, then tightening over time.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

2d ago First seen · 51 lines · 13 tokens per session scan A 1cd3cd9278db

Subscribe to this mod's changes

setup is a skill published in the GitHub repository ysfAskri/archguardian (4 stars, last pushed 6mo ago), licensed MIT. It adds 13 tokens to every session and 388 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Code review Git and workflow Planning ai-code architecture ast cli code-quality conventions

code-to-diagram

Analyze codebases and automatically generate architecture diagrams, flowcharts, and org charts. Uses AST parsing to map import dependencies for Python, JS/TS, Go, and Java, outputting Mermaid or SVG files. Triggered when users ask to visualize code architecture, understand dependencies, draw a flowchart, or create a…

zebbern/claude-code-guide · 74 tokens

truecourse-analyze

Run TrueCourse architecture analysis on this repository.

truecourse-ai/truecourse · 13 tokens

truecourse-hooks

Install, configure, or remove the TrueCourse pre-commit hook.

truecourse-ai/truecourse · 17 tokens

truecourse-fix

Fix TrueCourse violations that have suggested fixes.

truecourse-ai/truecourse · 13 tokens

truecourse-list

List TrueCourse violations found in this repository.

truecourse-ai/truecourse · 12 tokens

code-quality-review

Run a maintainability and structure review focused on abstraction quality, branching complexity, file growth, canonical ownership, duplication, and refactoring opportunities. Use when the user asks for code quality review, maintainability review, 代码质量审查, 可维护性审查, or comments about whether the change stays easy to…

bahayonghang/my-ai-cli-toolkit · 149 tokens