Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/jamditis/claude-skills-journalismWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/commands/jamditis/claude-skills-journalism/hotpatch)<a href="https://agentmods.dev/commands/jamditis/claude-skills-journalism/hotpatch"><img src="https://agentmods.dev/badge/commands/jamditis/claude-skills-journalism/hotpatch.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00025 | $0.01054 |
| Opus 5 | $0.00013 | $0.00527 |
| Sonnet 5 | $0.00005 | $0.00211 |
| Haiku 4.5 | $0.00003 | $0.00105 |
Grade A, and why
hotpatch scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
- `curl -fsSL "https://registry.npmjs.org/<encoded-name>"`, get metadata How it starts
The opening of the file, as written. The whole thing — 73 lines — stays where its author put it; the contents beside it link to each section on GitHub.
/security-toolkit:hotpatch
/security-toolkit:hotpatch <pkg>[@<version>] [--manager npm|bun]
This command runs the supply-chain pre-install scan defined in the supply-chain-hardening skill, then performs an --ignore-scripts install with the cooldown bypassed if the scan is clean.
The command is the gate. The trigger phrase "hotpatch" should not bypass the cooldown without the scan; if no scan tooling is available on the machine, perform the equivalent checks in-conversation before installing.
Execution path
-
Look for a local scan script. Check
~/.claude/hotpatch.sh(officejawn convention),./hotpatch.sh,./scripts/hotpatch.sh, and any path stored in$HOTPATCH_SCRIPT. If found:<script> <pkg>[@<version>] [--manager npm|bun]Pass through
--yesonly if the user has explicitly authorized non-interactive execution. Pass through--forceonly if the user has reviewed red flags from a prior run and approved. -
If no local script exists, perform the scan in-conversation using the supply-chain-hardening skill's heuristics. Briefly:
curl -fsSL "https://registry.npmjs.org/<encoded-name>", get metadata- Resolve the requested version, extract
unpackedSize,fileCount,dist.tarball,time[version], and anydeprecatedflag - Download the tarball to a
mktemp -ddirectory - Extract under
bwrap --ro-bind /usr /usr --unshare-all --die-with-parent --bind ...(Linux) orsandbox-exec(macOS), never extract into the cwd, never extract without sandboxing - Parse
package.jsonfor risky patterns (see SKILL.md "Static checks" table) - Diff size + fileCount against the most recent stable prior version (skip prereleases,
-dev,-rc,-beta) - Hit OSV.dev:
POST https://api.osv.dev/v1/querywith{"package":{"name":"<name>","ecosystem":"npm"},"version":"<version>"}, no auth required - Render a report with
RED(block install) andYELLOW(warn) flags
-
If any RED flags fire, do NOT install. Surface the flags, recommend either picking a different version, waiting out the cooldown, or, if the user has confirmed they understand the risk, passing
--forceon a re-run. Do not auto---forcewithout explicit user confirmation.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 73 lines · 25 tokens per session scan A e59724236172
hotpatch is a command published in the GitHub repository jamditis/claude-skills-journalism (387 stars, last pushed 2d ago), licensed MIT. It adds 25 tokens to every session and 1,054 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-05.
Other commands, from other repositories
export-latex
Export the current paper draft to production-ready LaTeX (.tex) and PDF using the arxiv-style template. Converts draft.md + references.bib + figures/ into a complete LaTeX project with resolved citations, tables, and figures. Compiles to PDF automatically.
analyze-writing
Analyze academic writing quality of the current draft. Checks for passive voice overuse, weak openings, hedging balance, readability, sentence length variation, and word repetitions. Produces a writing quality report with specific improvement suggestions per section.
review-paper
Simulate a double-blind peer review of the current paper. Generates 2 independent reviewer reports in the style of top IS/CS conferences (ICIS, ECIS, MISQ level). Each report includes Summary, Strengths, Weaknesses, Minor Comments, and Overall Recommendation. Output is saved as simulatedreviews.md and can be fed…
scooping-check
Scooping risk assessment — is someone else working on your research idea? Identifies competing groups, assesses pace of publication, evaluates whether the core insight is "in the air", and provides a watch list with search terms, key researchers, and venues to monitor.
triage-project
Strategic project triage — should you continue, pivot, or kill your current research project? Evaluates 5 signals (results, competition, impact, effort, motivation) and delivers a clear Continue/Pivot/Kill recommendation. For Pivot: suggests concrete new framing. For Kill: suggests what to salvage.
brainstorm
Creative research brainstorming — generate ideas researchers within a single field would miss. Cross-field connections, assumption challenges, alternative framings, and wild cards. Produces bold, specific, surprising ideas rather than safe incremental ones.