Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
/plugin marketplace add viticci/shortcuts-playground-pluginnpx agentmods add plugins/viticci/shortcuts-playground-plugin/claudegit clone --depth 1 https://github.com/viticci/shortcuts-playground-pluginWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/plugins/viticci/shortcuts-playground-plugin/claude)<a href="https://agentmods.dev/plugins/viticci/shortcuts-playground-plugin/claude"><img src="https://agentmods.dev/badge/plugins/viticci/shortcuts-playground-plugin/claude.svg" alt="Measured on agentmods" height="20"></a>Grade A, and why
claude scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 48 lines — stays where its author put it; the contents beside it link to each section on GitHub.
{
"name": "shortcuts-playground",
"version": "1.2.1",
"description": "Build, validate, sign, and archive macOS/iOS Shortcuts directly from Claude Code. Ships a full Shortcuts knowledge base, target-gated macOS 27 Apple-derived grounding data, a Craig Loop validator, a build agent, and a PostToolUse hook that auto-validates every .xml/.shortcut file as it is written.",
"author": {
"name": "Federico Viticci",
"url": "https://www.macstories.net"
},
"homepage": "https://www.macstories.net",
"license": "MIT",
"keywords": [
"shortcuts",
"macos",
"ios",
"automation",
"apple",
"macstories",
"plist",
"workflow"
],
"userConfig": {
"output_dir": {
"type": "directory",
"title": "Shortcuts Playground output directory",
"description": "Directory where unsigned XML archives and signed .shortcut files are written. Example: /Users/you/Documents/Shortcuts Playground. Leave blank to fall back to ~/Documents/Shortcuts Playground.",
"sensitive": false
},
"signing_mode": {
"type": "string",
"title": "Default shortcuts sign mode",
"description": "Default mode passed to `shortcuts sign`. Use `anyone` to distribute publicly or `people-who-know-me` to restrict to your contacts. Leave blank for `anyone`.",
"sensitive": false
},
"target_macos": {
"type": "string",
"title": "Target macOS for validation",
"description": "Target macOS major version for action availability. Leave blank or use `auto` to detect the host. Use `27` only when building Golden Gate-only shortcuts, or `latest` to include every packaged OS snapshot.",
"sensitive": false
},
"target_platform": {
"type": "string",
"title": "Target platform for validation",
"description": "Target platform for action availability. Use `macos` for Mac shortcuts, `ios` for iPhone/iPad shortcuts, or `all` only when intentionally validating every packaged platform.",
What it installs
The manifest is a name and a version. 1 skill, 2 commands, 2 agents, 1 hook travel with it, and installing the plugin installs all of them — 365 tokens a session between them. Each is measured on its own page, and each can be installed alone.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 48 lines scan A 7d9669529c06
claude is a plugin published in the GitHub repository viticci/shortcuts-playground-plugin (1,069 stars, last pushed 2mo ago), licensed MIT. Its token cost is not measured: this kind of file is read by the harness, not the model. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other plugins, from other repositories
swift-focusengine-pro
Expert focus management guidance for tvOS, iOS/iPadOS, watchOS, visionOS, and macOS. Covers SwiftUI, UIKit, AppKit, and RealityKit focus APIs, 30 numbered anti-patterns, and debugging techniques.
swift-tothemax
Swift and Apple development to the max — skills covering the Swift language (6.x), SwiftUI, UX/HIG, App Store review, Apple legal/privacy compliance, and release operations.
ios-skills-collection marketplace
Plugin marketplace listing 1 plugin: ios-skills.
apple-platform-build-tools
Reference documentation for xcodebuild and swift build, plus an autonomous build agent that absorbs verbose logs and preserves your context window.
apple-platform-build-tools
Reference documentation for xcodebuild and swift build, plus an autonomous build agent that absorbs verbose logs and preserves your context window.
swift-focusengine-pro
Expert focus management guidance for all Apple platforms. Covers @FocusState, UIFocusEnvironment, UIFocusGuide, focusSection, focusGroupIdentifier, HoverEffect, Digital Crown routing, and 30 numbered anti-patterns that break focus navigation.