Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add YuDefine/nuxt-supabase-starter --skill project-bootstrapgit clone --depth 1 https://github.com/YuDefine/nuxt-supabase-starterWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/yudefine/nuxt-supabase-starter/project-bootstrap)<a href="https://agentmods.dev/skills/yudefine/nuxt-supabase-starter/project-bootstrap"><img src="https://agentmods.dev/badge/skills/yudefine/nuxt-supabase-starter/project-bootstrap.svg" alt="Measured on agentmods" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Tool Misuse · line 27 Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).Fix: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00083 | $0.04854 |
| Opus 5 | $0.00042 | $0.02427 |
| Sonnet 5 | $0.00017 | $0.00971 |
| Haiku 4.5 | $0.00008 | $0.00485 |
Grade A, and why
project-bootstrap scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 250 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Project Bootstrap
原生 skill／命令入口以目前 runtime 實際提供的 catalog 為準；缺 slash UI 時讀取本文件與指定 references，使用同一 CLI 執行。metadata.clade.permission_tier 記錄工作性質，不提供原生權限。
把一個 repo 帶到「可開始業務開發的 Clade consumer」狀態。nuxt-supabase-starter 是新建 Nuxt 專案的產生器；Clade registry、init-consumer.ts、bp-scan.ts、golden paths 與 audits 是治理 SoT。本 skill 只編排它們，不複製各自判準。
<decision_boundary>
| Mode | 可觀察 predicate | 起點 | 完成輸出 |
|---|---|---|---|
new |
目標 repo 尚不存在，或使用者要求從 starter 建立 | project name + target path | scaffolded project + registered consumer + ready report |
adopt |
repo 已存在，但 Clade registry 查不到 | existing repo path | registered consumer + ready report |
若 repo 已在 registry/consumers.json，停止 onboarding，改回該 consumer 的一般工作流。例外：使用者明確授權把該 consumer 清掉從 starter 重建。可重複的 playground 重建走 node "$CLADE_HOME/scripts/rescaffold-playground.ts"（預設 CPMS / --db-host existing-server；--dry-run 只印步驟；--skip-gates 只驗 CLI）。不要自己複述 unregister / rm / CLI 順序——那支腳本是這條路徑的 SoT。不要把 registry 衝突讀成「改回一般工作流」。若使用者只要候選標準、不授權寫入，呼叫 /bp plan 後交付 plan，不繼續本 skill。
</decision_boundary>
Playground quality loop
標準必須先在 clade + starter 落地；playground（現為 CPMS）只拿來驗證。bootstrap-project result=READY 不是滿意——文件、CLI、AI 指引、資訊揭露、配套檔、/bp required 沒自動落地，都算缺口。
每一輪（腳本內不無限 loop）：
- 看：
node "$CLADE_HOME/scripts/inspect-new-project-round.ts" --consumer <target> - 記：機讀缺口進
tasks/new-project-quality-loop.jsonl；質性偏差（doc / cli / ai-guidance / disclosure）同一 schema 補一筆 - 修：只改 clade 或 starter。playground 當源頭改完不算
- 清：
node "$CLADE_HOME/scripts/rescaffold-playground.ts"（會再 inspect） - 對 ledger：過的 finding 關掉；還沒過的下一輪繼續
停手：inspect errorCount=0 且 ledger 沒有未關的質性缺口 且 使用者說滿意。Campaign SoT：tasks/2026-09-03-0018-new-project-quality-loop.md。
1. 建 intake sheet
先讀 references/intake.md，再 Read starter 的問題樹 SoT：
What ships with it
3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- today Changed · +5 lines 580d5492ad0f
- yesterday Changed · +8 lines d70e4db0cce4
- 2d ago Changed · +4 lines 87543da75f58
- 4d ago First seen · 233 lines · 83 tokens per session scan A 2b77887a0c99
project-bootstrap is a skill published in the GitHub repository YuDefine/nuxt-supabase-starter (45 stars, last pushed today), licensed MIT. It adds 83 tokens to every session and 4,854 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
boilerplate
Project scaffolding and boilerplate tools reference. Covers create-next-app, Vite, Astro, T3 stack, Django, Turborepo monorepo, Cookiecutter templates, Plop micro-generators, Hygen, Degit, and essential project files checklist.
web-design
A tool for designing and publishing single-page HTML websites, such as reports, landing pages, and data displays. It uses common web libraries for layouts, charts, icons, and responsive pages, then can deploy the result to Cloudflare Pages.
nw-finalize
Archives a completed feature to docs/evolution/, migrates lasting artifacts to permanent directories, and cleans up the temporary workspace. Use after all implementation steps pass and mutation testing completes.
nw-jtbd-workflow-selection
JTBD workflow classification and routing - ODI two-phase framework, five job types with workflow sequences, baseline type selection, workflow anti-patterns, and common recipes.
nw-fast-forward
Fast-forwards through remaining waves end-to-end without stopping for review between waves.
nw-new
Guided wizard to start a new feature. Asks what you want to build, recommends the right starting wave, and launches it.