Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/fatmo666/CaushellWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/plugins/fatmo666/caushell/claude-code)<a href="https://agentmods.dev/plugins/fatmo666/caushell/claude-code"><img src="https://agentmods.dev/badge/plugins/fatmo666/caushell/claude-code/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/plugins/fatmo666/caushell/claude-code"><img src="https://agentmods.dev/badge/plugins/fatmo666/caushell/claude-code.svg" alt="Reviewed on agentmods" width="80" height="20"></a>Grade A, and why
caushell-claude scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
{
"name": "caushell-claude",
"version": "0.0.9",
"description": "Session-aware shell guardrails for Claude Code backed by the Caushell runtime.",
"author": {
"name": "Caushell"
},
"homepage": "https://github.com/fatmo666/Caushell",
"repository": "https://github.com/fatmo666/Caushell",
"license": "Apache-2.0",
"userConfig": {
"hook_path": {
"type": "file",
"title": "caushell-claude-hook path",
"description": "Optional explicit path to the native caushell-claude-hook executable. If unset, caushell-claude uses CAUSHELL_CLAUDE_HOOK_PATH, caushell-claude-hook on PATH, CAUSHELL_REPO_ROOT, or a source checkout target/debug path."
},
"runtime_path": {
"type": "file",
"title": "caushell path",
"description": "Optional explicit path to caushell. If unset, caushell-claude resolves caushell from PATH."
},
"store_root": {
"type": "directory",
"title": "Session store root",
"description": "Directory where Caushell persists Claude session events and snapshots"
},
"socket_root": {
"type": "directory",
"title": "Socket root",
"description": "Directory for per-workspace Caushell daemon sockets and logs"
}
}
}
What it installs
The manifest is a name and a version. 2 skills, 5 hooks travel with it, and installing the plugin installs all of them — 41 tokens a session between them. Each is measured on its own page, and each can be installed alone.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 34 lines scan A 9d2385a228bb
caushell-claude is a plugin published in the GitHub repository fatmo666/Caushell (5 stars, last pushed yesterday), licensed Apache-2.0. Its token cost is not measured: this kind of file is read by the harness, not the model. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other plugins, from other repositories
makoto
Form-based session record holds before writes, commit/push and final answers.
agentguards-claude-selfhosted
LLM security guardrails for Claude Code, for a self-hosted AgentGuards appliance — jailbreak detection, prompt-injection and web-content scanning, data-exfiltration blocking, and destructive-command authorization, enforced entirely by hooks. No bundled MCP server: Claude Code's .mcp.json cannot point at a…
smart-approval
AI permission tier for Claude Code Bash commands: deny-list gate plus smart AI evaluation for unknown commands. Requires Claude Code >= 2.0.45, shfmt, jq (brew install shfmt jq).
agentguards-gemini
MCP configuration declaring 1 server: agentguards.
agentlint
Claude Code marketplace wrapper for AgentLint's AI-agent guardrail engine. 77 rules across 8 packs, hybrid AgentChute security feeds, circuit-breaker visibility, inline-ignore reasons.
claude-timestamp
Time awareness for coding agents, in Claude Code and Codex: in Claude Code, stamps every message with the local time and how long the turn took; in both, tells the agent when a turn runs long, a tool call is slow or work resumes after a gap, remembers how long each command usually takes in a project, and reports where.