Borrowing it
Nothing to install: this file belongs to anthony-spruyt/claude-plugins. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/anthony-spruyt/claude-plugins/main/.claude/skills/replay-logs/SKILL.mdgit clone --depth 1 https://github.com/anthony-spruyt/claude-pluginsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/anthony-spruyt/claude-plugins/replay-logs)<a href="https://agentmods.dev/skills/anthony-spruyt/claude-plugins/replay-logs"><img src="https://agentmods.dev/badge/skills/anthony-spruyt/claude-plugins/replay-logs/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/anthony-spruyt/claude-plugins/replay-logs"><img src="https://agentmods.dev/badge/skills/anthony-spruyt/claude-plugins/replay-logs.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00081 | $0.01722 |
| Opus 5.5 | $0.00032 | $0.00689 |
| Sonnet 5.5 | $0.00016 | $0.00344 |
| Haiku 4.5 | $0.00008 | $0.00172 |
Grade A, and why
replay-logs scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 95 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Replay session logs and fuzz the rules
Real session logs in ~/.claude/projects/**/*.jsonl are the training data. Every tool call in them is replayed through the rules in this repo. The fuzzers then hunt for what real use never tried. Each surprise becomes a test case and, if needed, a rule fix.
1. Run the replay
python3 tests/helpers/replay_transcripts.py --exclude-project claude-plugins
python3 tests/helpers/replay_transcripts.py --project claude-plugins --out /tmp/hookify-replay-dev
The first run is real-world use. The second is this repo's own dev sessions: they are full of deliberate attack strings written while testing rules, so treat their hits as low-signal. Other flags: --project <text> (repeatable), --since YYYY-MM-DD, --rules <dir> (repeatable; loads another repo's .claude/hookify-plus on top of this repo's rules).
Output: a summary table on stdout, then /tmp/hookify-replay/report.md and report.json. The files are readable only by you; a new --out folder is too, an existing one keeps its permissions. Common token shapes and secret-named values are redacted, but redaction is best-effort: treat the report as sensitive, never commit it, and never echo secret values from it.
The report also lists PreToolUse timeouts: calls where a pretooluse.py hook ran past its 10 s limit. If it was hookify-plus, no block rule ran, so it is a likely speed bug; reproduce it with the speed fuzzer or time the rules on that command. The log does not name the plugin, so check the session's cwd and enabled plugins first.
2. Read the columns
- hits - tool calls the rule matches today.
- started - matches today, did not fire when the session ran.
- stopped - fired when the session ran, does not match today.
Drift has innocent causes. Check these before calling something a bug:
- Warn rules with
warn_onceonly fire once per agent, so warn started is mostly expected. Warn drift is left out for calls a block rule stopped, since PostToolUse never ran on them. - The session may have run an older plugin version, or in a project without the plugin enabled.
- stopped on a block rule is either a deliberate false-positive fix or a regression. Find which with
git log -Son the rule file.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago Changed ec83a22cebfa
- 13d ago First seen · 95 lines · 81 tokens per session scan A 3113bb5e75ea
replay-logs is a skill published in the GitHub repository anthony-spruyt/claude-plugins (2 stars, last pushed yesterday), licensed MIT. It adds 81 tokens to every session and 1,722 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-06.
Other skills, from other repositories
research-engineer
An uncompromising Academic Research Engineer. Operates with absolute scientific rigor, objective criticism, and zero flair. Focuses on theoretical correctness, formal verification, and optimal implementation across any required technology.
eval-dataset-design
A guide to creating reliable test sets for AI agents. Each evaluation task includes the request, the simulated user's behaviour, a reset starting state, and a success check that can be independently verified.
tika-eval-compare
Compare extracts from two Tika builds over a corpus to detect regressions in content, encoding, exceptions, and embedded-document handling. Use for "compare before/after extracts", "eval this change against the corpus".
cua-driver
Use Cua Driver for desktop or browser tasks that are awkward or unavailable through Bash/APIs, or when the user explicitly wants GUI interaction: app testing, visual bug reproduction, form filling, calendar entry, screenshots, and demo recording. Also covers Cua setup; not OpenAI Codex Computer Use or web research.
jetson-validate-image
Use after jetson-flash-image to run static BSP checks, on-target smoke/regression tests on a flashed DUT, or both. Not for build or flash steps. Triggers: validate bsp, on-target validation.
atmos-validation
Validate Atmos projects, components, arbitrary JSON Schema inputs, EditorConfig, and GitHub Actions; use affected-file selection and native CI annotations.