Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add commands/missingpackage/nightshift/nightshift-setupgit clone --depth 1 https://github.com/MissingPackage/nightshiftWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00020 | $0.00616 |
| Opus 5 | $0.00010 | $0.00308 |
| Sonnet 5 | $0.00004 | $0.00123 |
| Haiku 4.5 | $0.00002 | $0.00062 |
Grade B, and why
nightshift-setup scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Reads agent configuration directoriesmediumAgent snooping
.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.
status line? it edits ~/.claude/settings.json, backs it up first, and touches nothing else"* — and What it actually says
Complete this machine's Nightshift installation.
A Claude Code plugin carries skills, agents, commands and hooks. It does not carry the five
executable workflows, the ~/.claude/ORCHESTRATION.md the skills cite by path, or the status
line — those need files in ~/.claude, which is what this command puts there. It installs
nothing the plugin already provides: a second copy of a hook fires twice.
Run it in three steps and report what actually happened.
1. Find the plugin root. $CLAUDE_PLUGIN_ROOT if the environment carries it; otherwise the
newest match of ~/.claude/plugins/cache/nightshift/nightshift/*/:
ROOT="${CLAUDE_PLUGIN_ROOT:-$(ls -d "$HOME"/.claude/plugins/cache/nightshift/nightshift/*/ 2>/dev/null | sort -V | tail -1)}"
printf 'plugin root: %s\n' "$ROOT"
If that resolves to nothing, stop and say so: the plugin is not installed, and the right move is
/plugin install nightshift@nightshift or the plain ./install.sh from a clone — not this command.
2. Install the complement. Show the user what it would change first, then do it:
bash "$ROOT/install.sh" --plugin --dry-run
bash "$ROOT/install.sh" --plugin
The status line writes to settings.json, so it stays opt-in. Ask once — "set the nightshift-hud
status line? it edits ~/.claude/settings.json, backs it up first, and touches nothing else" — and
only on a yes:
bash "$ROOT/install.sh" --plugin --settings
3. Verify, and report the real numbers.
bash "$ROOT/verify-install.sh" --plugin
Report the pass/fail/warn line as printed. Two failures have a known remedy — give it instead of
the raw text: plugin-owned surface duplicated means a plain ./install.sh ran here too, so the
same skills and hooks exist twice (remove them from ~/.claude, or drop the plugin and keep the
installer alone); hooks registered twice means a plain --settings merge added a hooks block on
top of the plugin's registration, so every hook fires once per registration (remove that block).
One warn is expected and not a problem: hook fixtures are skipped, because in this channel the
hooks run from the plugin root rather than ~/.claude/hooks.
Restart the session afterwards if the status line was set — it is read at startup.
$ARGUMENTS
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 59 lines · 20 tokens per session scan B 0a7576b7f313
nightshift-setup is a command published in the GitHub repository MissingPackage/nightshift (2 stars, last pushed 15d ago), licensed MIT. It adds 20 tokens to every session and 616 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it B with 1 finding (reads agent configuration directories). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other commands, from other repositories
research
Research a technical or product question.
safe-build
Build the application for development or production.
update
Use when: search results seem noisy, after bulk imports, or for periodic memory/registry maintenance.
plan-workflow
Generate a skill chain plan for a high-level goal by analyzing the skills registry for input/output compatibility.
music-suno-prompt
Grounded Suno prompt synthesis from local knowledge corpus + persona canon + label canon. No vibes-prompting.
lrn
Execute the /vibeguard:learn command. $ARGUMENTS.