hotpatch

hotpatch is a command for Claude Code from jamditis/claude-skills-journalism. It costs 25 tokens per session (1,054 once invoked), scanned A, original, MIT.

A guarded command for urgent npm or Bun package installs. It scans a package for supply-chain risks before installing it with lifecycle scripts disabled and the normal cooldown bypassed.

In plain words
What is it for?
Use it to check and install a named npm or Bun package when waiting for the normal install cooldown is not practical.
Why use it?
It lets you handle an urgent install without skipping the safety scan. It also reduces risk from package install scripts running automatically.

Command for Claude Code

Written for Claude Code: shipped in a Claude Code plugin. Also seen: reads .claude/ paths.

Part of the security-toolkit plugin — 4 skills, 1 command shipped together

Good fit Use it to check and install a named npm or Bun package when waiting for the normal install cooldown is not practical.

Compare 6 commands from other repositories ↓
Install with agentmods
npx agentmods add commands/jamditis/claude-skills-journalism/hotpatch
Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Clone the repo
git clone --depth 1 https://github.com/jamditis/claude-skills-journalism

Made for: Claude Code.

Or install security-toolkit, the plugin that ships this one along with the rest of its 4 skills, 1 command.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for hotpatch

README.md
[![agentmods](https://agentmods.dev/badge/commands/jamditis/claude-skills-journalism/hotpatch.svg)](https://agentmods.dev/commands/jamditis/claude-skills-journalism/hotpatch)
Your own site
<a href="https://agentmods.dev/commands/jamditis/claude-skills-journalism/hotpatch"><img src="https://agentmods.dev/badge/commands/jamditis/claude-skills-journalism/hotpatch.svg" alt="Measured on agentmods" height="20"></a>
Per session 25 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.
When invoked 1,054 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 1 finding. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00025 $0.01054
Opus 5 $0.00013 $0.00527
Sonnet 5 $0.00005 $0.00211
Haiku 4.5 $0.00003 $0.00105

Measured 2d ago against content hash e59724236172, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-07, from the pricing page.

Security

Grade A, and why

hotpatch scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

- `curl -fsSL "https://registry.npmjs.org/<encoded-name>"`, get metadata
security-toolkit/commands/hotpatch.md · 73 lines

How it starts

The opening of the file, as written. The whole thing — 73 lines — stays where its author put it; the contents beside it link to each section on GitHub.

/security-toolkit:hotpatch

/security-toolkit:hotpatch <pkg>[@<version>] [--manager npm|bun]

This command runs the supply-chain pre-install scan defined in the supply-chain-hardening skill, then performs an --ignore-scripts install with the cooldown bypassed if the scan is clean.

The command is the gate. The trigger phrase "hotpatch" should not bypass the cooldown without the scan; if no scan tooling is available on the machine, perform the equivalent checks in-conversation before installing.

Execution path

  1. Look for a local scan script. Check ~/.claude/hotpatch.sh (officejawn convention), ./hotpatch.sh, ./scripts/hotpatch.sh, and any path stored in $HOTPATCH_SCRIPT. If found:

    <script> <pkg>[@<version>] [--manager npm|bun]
    

    Pass through --yes only if the user has explicitly authorized non-interactive execution. Pass through --force only if the user has reviewed red flags from a prior run and approved.

  2. If no local script exists, perform the scan in-conversation using the supply-chain-hardening skill's heuristics. Briefly:

    • curl -fsSL "https://registry.npmjs.org/<encoded-name>", get metadata
    • Resolve the requested version, extract unpackedSize, fileCount, dist.tarball, time[version], and any deprecated flag
    • Download the tarball to a mktemp -d directory
    • Extract under bwrap --ro-bind /usr /usr --unshare-all --die-with-parent --bind ... (Linux) or sandbox-exec (macOS), never extract into the cwd, never extract without sandboxing
    • Parse package.json for risky patterns (see SKILL.md "Static checks" table)
    • Diff size + fileCount against the most recent stable prior version (skip prereleases, -dev, -rc, -beta)
    • Hit OSV.dev: POST https://api.osv.dev/v1/query with {"package":{"name":"<name>","ecosystem":"npm"},"version":"<version>"}, no auth required
    • Render a report with RED (block install) and YELLOW (warn) flags
  3. If any RED flags fire, do NOT install. Surface the flags, recommend either picking a different version, waiting out the cooldown, or, if the user has confirmed they understand the risk, passing --force on a re-run. Do not auto---force without explicit user confirmation.

Read the full file on GitHub · 73 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2d ago First seen · 73 lines · 25 tokens per session scan A e59724236172

Subscribe to this mod's changes

hotpatch is a command published in the GitHub repository jamditis/claude-skills-journalism (387 stars, last pushed 2d ago), licensed MIT. It adds 25 tokens to every session and 1,054 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-05.

Related

Other commands, from other repositories

export-latex

Export the current paper draft to production-ready LaTeX (.tex) and PDF using the arxiv-style template. Converts draft.md + references.bib + figures/ into a complete LaTeX project with resolved citations, tables, and figures. Compiles to PDF automatically.

TobiasBlask/open-paper-machine · 55 tokens

analyze-writing

Analyze academic writing quality of the current draft. Checks for passive voice overuse, weak openings, hedging balance, readability, sentence length variation, and word repetitions. Produces a writing quality report with specific improvement suggestions per section.

TobiasBlask/open-paper-machine · 46 tokens

review-paper

Simulate a double-blind peer review of the current paper. Generates 2 independent reviewer reports in the style of top IS/CS conferences (ICIS, ECIS, MISQ level). Each report includes Summary, Strengths, Weaknesses, Minor Comments, and Overall Recommendation. Output is saved as simulatedreviews.md and can be fed…

TobiasBlask/open-paper-machine · 79 tokens

scooping-check

Scooping risk assessment — is someone else working on your research idea? Identifies competing groups, assesses pace of publication, evaluates whether the core insight is "in the air", and provides a watch list with search terms, key researchers, and venues to monitor.

TobiasBlask/open-paper-machine · 52 tokens

triage-project

Strategic project triage — should you continue, pivot, or kill your current research project? Evaluates 5 signals (results, competition, impact, effort, motivation) and delivers a clear Continue/Pivot/Kill recommendation. For Pivot: suggests concrete new framing. For Kill: suggests what to salvage.

TobiasBlask/open-paper-machine · 62 tokens

brainstorm

Creative research brainstorming — generate ideas researchers within a single field would miss. Cross-field connections, assumption challenges, alternative framings, and wild cards. Produces bold, specific, surprising ideas rather than safe incremental ones.

TobiasBlask/open-paper-machine · 43 tokens