Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
/plugin marketplace add ssheleg/sheleg-devnpx agentmods add plugins/ssheleg/sheleg-dev/marketplacegit clone --depth 1 https://github.com/ssheleg/sheleg-devGrade A, and why
sheleg-dev scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
{
"name": "sheleg-dev",
"owner": {
"name": "ssheleg",
"url": "https://github.com/ssheleg"
},
"description": "Seven integration skills for the layer a product reaches once it has users: money in, tracking, errors, sign-in, and speed.",
"plugins": [
{
"name": "sheleg-dev",
"displayName": "Sheleg Dev",
"source": "./plugins/sheleg-dev",
"description": "The integration layer a product needs once it has users: Stripe subscription billing reconciled into your own database, crypto payments that survive over-payment and duplicate webhooks, ad and conversion tracking under Consent Mode v2, Google sign-in with the account-linking guards, the wider Google auth surface, and Core Web Vitals work that moves the score, and Sentry error tracking wired so it does not forward your own credentials to a third party and so a stack trace names the commit that caused it.",
"version": "0.11.2",
"author": {
"name": "ssheleg",
"url": "https://x.com/sshlg93"
},
"repository": "https://github.com/ssheleg/sheleg-dev",
"homepage": "https://github.com/ssheleg/sheleg-dev",
"license": "MIT",
"keywords": [
"stripe",
"subscriptions",
"stripe-billing",
"crypto-payments",
"webhooks",
"google-analytics",
"consent-mode",
"meta-pixel",
"google-auth",
"oauth2",
"core-web-vitals",
"claude-code",
"cursor"
],
"category": "development",
"$schema": "https://json.schemastore.org/claude-code-marketplace.json"
}
]
}
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 42 lines scan A fe96c6aebb61
sheleg-dev is a plugin published in the GitHub repository ssheleg/sheleg-dev (2 stars, last pushed 2d ago), licensed MIT. Its token cost is not measured: this kind of file is read by the harness, not the model. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other plugins, from other repositories
yolfi-agent
Yolfi crypto payment integration skill and bundled local MCP server for Claude Code.
stripekit-marketplace
Plugin marketplace listing 1 plugin: stripekit.
stripekit
Reconcile your Stripe catalog (products, prices, webhook, portal) and inspect your account — exposed to Claude as MCP tools.
stripe-skills
Stripe billing expert skills — MRR, churn, dunning, Radar, webhooks.
coinvoyage-paykit
Accept crypto payments in any Claude-built app. Community integration for CoinVoyage — supports BTC, Solana, Ethereum, Base, Arbitrum, Optimism, Polygon, BSC, Sui via @coin-voyage/paykit SDK and REST API. Bundles a skill that triggers on payment/checkout work and an MCP server that lets Claude create pay orders, check.
humanizer
Rewrite AI-sounding text so it reads naturally without changing what it says.