Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add 0xDarkMatter/claude-mods --skill portless-opsgit clone --depth 1 https://github.com/0xDarkMatter/claude-modsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/0xdarkmatter/claude-mods/portless-ops)<a href="https://agentmods.dev/skills/0xdarkmatter/claude-mods/portless-ops"><img src="https://agentmods.dev/badge/skills/0xdarkmatter/claude-mods/portless-ops/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/0xdarkmatter/claude-mods/portless-ops"><img src="https://agentmods.dev/badge/skills/0xdarkmatter/claude-mods/portless-ops.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 2 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Tool Misuse · line 119 Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).Fix: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults.
- high Tool Misuse · line 159 Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).Fix: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00073 | $0.02719 |
| Opus 5.5 | $0.00029 | $0.01088 |
| Sonnet 5.5 | $0.00015 | $0.00544 |
| Haiku 4.5 | $0.00007 | $0.00272 |
Grade A, and why
portless-ops scanned grade A with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
### curl vs browser cert handling Runs shell commandslowCapability
Expected in a hook, worth knowing in a rule or an instructions file.
Without it: `Error: openssl failed: spawnSync openssl ENOENT` How it starts
The opening of the file, as written. The whole thing — 232 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Portless Operations
Portless (Vercel Labs) is a local-dev HTTPS proxy that replaces port numbers with named URLs. Replacement for Caddy/nginx in the local-dev role; not for production.
Upstream: vercel-labs/portless (Apache-2.0). The portless repo ships canonical skills in its source tree (not in the npm package). Verbatim copies kept in references/:
references/upstream-portless.md— full CLI reference, integration patterns (zero-config, monorepo, turborepo, worktrees, Tailscale), HTTPS/LAN setup, troubleshootingreferences/upstream-oauth.md— OAuth provider compatibility (Google, Apple, Microsoft, Facebook, GitHub), TLD selection for OAuth, callback URI configuration
This SKILL.md adds operational patterns we've validated in production (Windows specifics, the static-alias-with-supervisor pattern, TLD-reset procedure, supply-chain hygiene). For canonical CLI usage, prefer the upstream reference files.
Mental Model
| Layer | Portless owns | Portless does NOT own |
|---|---|---|
| Routing | hostname → port mapping, HTTPS termination, HTTP/2, CA trust | process supervision (use Process Compose or PM2) |
| Naming | <name>.<tld> shape — one TLD per proxy |
per-service distinct TLDs (not supported) |
| Process spawning | when invoked as portless myapp <cmd> |
crash recovery, restart policy, health checks |
Key shape constraint: portless always renders <alias-name>.<tld>. You can't mix two TLDs in one proxy because TLD is per-instance — a dotted alias like portless alias api.<app> 8108 gets the TLD appended → api.<app>.<tld>.
Install
# Pin a specific version (zero runtime deps, low supply-chain surface)
npm install -g [email protected]
# Verify
portless --version
Record the pinned version in your repo. Upgrades are explicit PRs.
CLI Quick Reference
# example values — substitute your own (TLD, app name, ports)
# Proxy lifecycle
portless proxy start --tld lab --port 443 # HTTPS proxy on 443, *.lab routes
portless proxy start --tld test --port 1355 # Non-privileged port for testing
portless proxy stop
portless trust # Add CA to system trust store
# Aliases (for services portless didn't spawn — PM2, Process Compose, Docker, etc.)
portless alias axiom 8108 # https://axiom.lab → :8108
portless alias axiom 8108 --force # Overwrite existing
portless alias --remove axiom # Note: appends TLD! be careful
# Spawn-mode (portless manages the process)
portless myapp next dev # https://myapp.lab, auto port 4000-4999
portless run pnpm dev # Auto-infer name from package.json
# Discovery (agent-friendly)
portless list # Active routes
portless get axiom # Returns: https://axiom.lab
# Boot persistence
portless service install # OS-native startup task
portless service status
portless service uninstall
What ships with it
13 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- assets/package.json-portless-key.json 797 B
- assets/portless.json.monorepo.json 680 B
- assets/portless.json.simple.json 386 B
- assets/portless.json.with-custom-tld.json 493 B
- references/integration-patterns.md 5.3 KB
- references/tld-selection.md 4.2 KB
- references/upstream-oauth.md 7.7 KB
- references/upstream-portless.md 22 KB
- references/windows-specifics.md 5.1 KB
- scripts/install-portless.ps1 5.4 KB runs code
- scripts/reset-state.ps1 2.3 KB runs code
- scripts/sync-aliases-from-yaml.ps1 1.5 KB runs code
- tests/run.sh 6.8 KB runs code
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago Changed · +1 lines 81ff54fd9cd3
- 22d ago Changed 3d3b0d7d2e7b
- 1mo ago First seen · 231 lines · 73 tokens per session scan A c57e9600cf17
portless-ops is a skill published in the GitHub repository 0xDarkMatter/claude-mods (71 stars, last pushed 8d ago), licensed MIT. It adds 73 tokens to every session and 2,719 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 2 findings (makes network calls, runs shell commands). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
example-feature-generator
Generate boilerplate for new features following project conventions. Use when user says "create feature", "add feature", or "new feature scaffolding".
Vizra ADK Memory System
Implement persistent memory, session context, and vector memory (RAG) for AI agents.
authentication-patterns
OAuth 2.0, JWT, SSO, MFA, NextAuth/Clerk/Supabase Auth implementation patterns.
agent-flutter-developer
Specialist subagent: Flutter/Dart cross-platform development, Riverpod state management, and platform channels specialist. Use when building Flutter apps, implementing state management, or working with native platform features. Trigger phrases: Flutter, Dart, Riverpod, Bloc, widget, MaterialApp, GoRouter, platform…
content-repurposer
Adapt content across platforms with tone/format shifting — blog to social, long to short, text to visual outline. Use when repurposing content for different channels, audiences, or formats.
electron-desktop
Desktop application development with Electron for Windows, macOS, and Linux. Use when building cross-platform desktop apps, implementing native OS features, or packaging web apps for desktop.