Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/apurvbazari/claude-plugins/capabilitynpx skills add ApurvBazari/claude-plugins --skill capabilitygit clone --depth 1 https://github.com/ApurvBazari/claude-pluginsWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00079 | $0.03213 |
| Opus 5 | $0.00039 | $0.01606 |
| Sonnet 5 | $0.00016 | $0.00643 |
| Haiku 4.5 | $0.00008 | $0.00321 |
Grade A, and why
capability scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 213 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Capability — What This lens Advertises to a Programmatic Caller
You are invoked by an orchestrator (not a human), ahead of any call to lens:engine. You answer
one question: what does this installation of lens support? You read one file, compare one list, and
return one object. You dispatch no agent, read no diff, judge nothing, and write nothing at all.
The shape of both returns is declared in ../engine/references/engine-api.md
§ lens:capability. The advertised set — the tokens, the input keys, the resolution rules —
lives here, because it is the answer rather than the shape.
Your input (supplied in context by the caller)
require— an optional array of capability tokens the caller needs.requireabsent ⇒ a pure report: you return the advertised set and can never return a capability error, because nothing was asked for that could be unsatisfied. Present and empty is the same pure report, for the same reason. A manifest that cannot be read still fails the call — that is an install-integrity failure rather than a capability miss, and it carries its own code (Step 1).requirepresent must be an array of strings. A bare string, an object, or an array holding a non-string is a caller shape bug, not a capability miss: returnE_INVALID_INPUT(declared in../engine/references/engine-api.md§ Errors) before Step 2 runs. Never iterate a bare string — its characters are not tokens, and matching them would answer a question the caller never asked.
Step 1: Read the version from the manifest
Read .version from "${CLAUDE_PLUGIN_ROOT}/.claude-plugin/plugin.json" — the double-quoted,
plugin-root form — and report the filter's output verbatim:
jq -e -r 'if (.version|type) == "string" and (.version|test("\\S")) then (.version|sub("^\\s+";"")|sub("\\s+$";"")) else null end' "${CLAUDE_PLUGIN_ROOT}/.claude-plugin/plugin.json"
Keep the double quotes. Unquoted, an unset or space-bearing ${CLAUDE_PLUGIN_ROOT} word-splits and
the read dies as a command-not-found rather than as the file failure it actually is.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 213 lines · 79 tokens per session scan A fb7ce3bfb9c0
capability is a skill published in the GitHub repository ApurvBazari/claude-plugins (0 stars, last pushed 26d ago), licensed MIT. It adds 79 tokens to every session and 3,213 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
cross-platform
Cross-platform development patterns for macOS, Windows, and Linux.
shell-scripting
Shell scripting best practices for cross-platform CLI tools.
c-notify
Send native macOS notification center alerts from the command line using terminal-notifier.
change-keybinding
Customize Warp keyboard shortcuts (keybindings, keymappings) by editing the user's keybindings.yaml file. Use when the user asks to remap a key combination, rebind an action, change a shortcut, or remove a default keybinding (e.g. "change ctrl+space to ctrl+s", "rebind the command palette to cmd+p", "remove the…
agent-add-mcp
Use this skill when helping users add MCP servers to their Warp configuration.
autoprompt
Explicit-only useful-first orchestration. Invoke /autoprompt to turn a mission into one executable roadmap, build dependency-safe lanes, and verify the result with independent reviewers. Never infer invocation from ordinary requests. Never resume from leftover artifacts without an explicit resume instruction.