Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/BFRKQSB7/balance-hudWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/commands/bfrkqsb7/balance-hud/setup)<a href="https://agentmods.dev/commands/bfrkqsb7/balance-hud/setup"><img src="https://agentmods.dev/badge/commands/bfrkqsb7/balance-hud/setup.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00008 | $0.10244 |
| Opus 5 | $0.00004 | $0.05122 |
| Sonnet 5 | $0.00002 | $0.02049 |
| Haiku 4.5 | $0.00001 | $0.01024 |
Grade D, and why
setup scanned grade D with 3 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks for rootmediumPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
chmod 700 "$PREVIOUS_COMMAND_DIR" 2>/dev/null || true Reads agent configuration directoriesmediumAgent snooping
.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.
1. Find the most recent backup: `ls -t ~/.claude/settings.json.bak.* | head -1` Recursive force deletehighDestructive command
rm -rf with a variable or a broad path is one typo away from removing the wrong tree.
rm -rf "$CLAUDE_DIR/plugins/cache"/*/balance-hud How it starts
The opening of the file, as written. The whole thing — 744 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Note: Placeholders like {RUNTIME_PATH}, {SOURCE}, and {GENERATED_COMMAND} should be substituted with actual detected values.
Step 0: Detect Ghost Installation (Run First)
Check for inconsistent plugin state that can occur after failed installations:
macOS/Linux:
# Check 1: Cache exists?
CLAUDE_DIR="${CLAUDE_CONFIG_DIR:-$HOME/.claude}"
CACHE_EXISTS=$(ls -d "$CLAUDE_DIR/plugins/cache"/*/balance-hud 2>/dev/null && echo "YES" || echo "NO")
# Check 2: Registry entry exists?
REGISTRY_EXISTS=$(grep -q "balance-hud" "$CLAUDE_DIR/plugins/installed_plugins.json" 2>/dev/null && echo "YES" || echo "NO")
# Check 3: Temp files left behind?
TEMP_FILES=$(ls -d "$CLAUDE_DIR/plugins/cache/temp_local_"* 2>/dev/null | head -1)
echo "Cache: $CACHE_EXISTS | Registry: $REGISTRY_EXISTS | Temp: ${TEMP_FILES:-none}"
Windows (PowerShell):
$claudeDir = if ($env:CLAUDE_CONFIG_DIR) { $env:CLAUDE_CONFIG_DIR } else { Join-Path $HOME ".claude" }
$cache = (Get-ChildItem (Join-Path $claudeDir "plugins\cache") -Directory | ForEach-Object { Test-Path (Join-Path $_.FullName "balance-hud") }) -contains $true
$registry = (Get-Content (Join-Path $claudeDir "plugins\installed_plugins.json") -ErrorAction SilentlyContinue) -match "balance-hud"
$temp = Get-ChildItem (Join-Path $claudeDir "plugins\cache\temp_local_*") -ErrorAction SilentlyContinue
Write-Host "Cache: $cache | Registry: $registry | Temp: $($temp.Count) files"
Interpreting Results
| Cache | Registry | Meaning | Action |
|---|---|---|---|
| YES | YES | Normal install (may still be broken) | Continue to Step 1 |
| YES | NO | Ghost install - cache orphaned | Clean up cache |
| NO | YES | Ghost install - registry stale | Clean up registry |
| NO | NO | Not installed | Continue to Step 1 |
If temp files exist, a previous install was interrupted. Clean them up.
Cleanup Commands
If ghost installation detected, ask user if they want to reset. If yes:
macOS/Linux:
CLAUDE_DIR="${CLAUDE_CONFIG_DIR:-$HOME/.claude}"
# Remove orphaned cache (handles both direct and marketplace installs)
rm -rf "$CLAUDE_DIR/plugins/cache"/*/balance-hud
# Remove temp files from failed installs
rm -rf "$CLAUDE_DIR/plugins/cache/temp_local_"*
# Reset registry (removes ALL plugins - warn user first!)
# Only run if user confirms they have no other plugins they want to keep:
echo '{"version": 2, "plugins": {}}' > "$CLAUDE_DIR/plugins/installed_plugins.json"
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 744 lines · 8 tokens per session scan D 016e5244990c
setup is a command published in the GitHub repository BFRKQSB7/balance-hud (2 stars, last pushed 22d ago), licensed MIT. It adds 8 tokens to every session and 10,244 once invoked, about $0.0000 per session on Opus 5. A static security scan graded it D with 3 findings (asks for root, reads agent configuration directories, recursive force delete). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other commands, from other repositories
skill-refresh
You are running inside a headless Claude Code session in the neo4j-skills repository. Goal: scan Neo4j release notes and deprecation pages, then update any SKILL.md and references/ files that are stale, outdated, or missing new features. Open no PRs or commits — output only file edits. The workflow will handle git and…
brand-setup
Configure a new brand profile with colors, fonts, logo, visual style, platforms, and compliance rules.
screens
Structures product UX screen design — inventory, flow, states, and reusable briefs for external design tools — without generating pixels or UI code.
review
Cold re-quiz on code that already shipped — your own session commits, not the change in front of you.
qa
Smoke or browser-walk a running app. Report only. Do not implement. Do not merge.
reset
Guided teardown of an organic-os site - what gets deregistered automatically, what you must delete or revoke yourself, and why.