Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/apurvbazari/claude-plugins/test-plugins-locallynpx skills add ApurvBazari/claude-plugins --skill test-plugins-locallygit clone --depth 1 https://github.com/ApurvBazari/claude-pluginsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/apurvbazari/claude-plugins/test-plugins-locally)<a href="https://agentmods.dev/skills/apurvbazari/claude-plugins/test-plugins-locally"><img src="https://agentmods.dev/badge/skills/apurvbazari/claude-plugins/test-plugins-locally.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00054 | $0.02780 |
| Opus 5 | $0.00027 | $0.01390 |
| Sonnet 5 | $0.00011 | $0.00556 |
| Haiku 4.5 | $0.00005 | $0.00278 |
Grade C, and why
test-plugins-locally scanned grade C with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Recursive force deletehighDestructive command
rm -rf with a variable or a broad path is one typo away from removing the wrong tree.
# 2. Wipe the testbed (ask before rm -rf if anything is in it) How it starts
The opening of the file, as written. The whole thing — 234 lines — stays where its author put it; the contents beside it link to each section on GitHub.
/test-plugins-locally — Local Plugin Testbed
Spin up (or reset) a sibling sandbox project, point Claude Code at this repo's plugins via the local marketplace, and run a smoke recipe for the plugin under test.
What this skill does
The five plugins in this repo (onboard, notify, handoff, walkthrough, lens) ship through the apurvbazari-plugins local marketplace which points at this directory. Plugins are copied into ~/.claude/plugins/cache/apurvbazari-plugins/<plugin>/<version>/ on install, so source edits don't reach the running session until the cache is refreshed.
Gotcha: claude plugin update is version-gated — it compares the plugin.json version field and is a no-op when versions match (which they almost always do during in-branch dev, since you rarely bump version per edit). The Reset step in this skill therefore mirrors source → cache via rsync directly. claude plugin update is still useful when you've actually bumped the version, but it cannot be relied on for live-edit dogfooding.
~/Desktop/projects/
├── claude-plugins/ ← THIS repo (plugin source)
└── claude-plugins-testbed/ ← sibling sandbox (created by this skill)
└── <plugin>-test/ ← one fresh subdir per smoke recipe
Guard
Run only from inside the claude-plugins repo root (the directory containing .claude-plugin/marketplace.json). If you can't see that file, stop and tell the user where they actually are — running this skill from anywhere else would silently set up the wrong testbed.
Step 1: Ask what to do
Use AskUserQuestion (single-select) with these options:
- Setup — first-time wiring: register marketplace if missing, install all 5 plugins, create the sibling testbed dir
- Reset (Recommended) — mirror source → plugin cache via
rsync(bypasses the version-gatedclaude plugin update), nuke the testbed contents, recreate empty subdirs - Run plugin recipe — pick a plugin and walk its smoke recipe in a fresh sandbox subdir
- Status — read-only: report marketplace + plugin + testbed state, then stop
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 234 lines · 54 tokens per session scan C fa3f0cbe9d2d
test-plugins-locally is a skill published in the GitHub repository ApurvBazari/claude-plugins (0 stars, last pushed 29d ago), licensed MIT. It adds 54 tokens to every session and 2,780 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it C with 1 finding (recursive force delete). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
cross-platform
Cross-platform development patterns for macOS, Windows, and Linux.
shell-scripting
Shell scripting best practices for cross-platform CLI tools.
c-notify
Send native macOS notification center alerts from the command line using terminal-notifier.
notifications
Send notifications through the unified notification router.
telegram-setup
Connect a Telegram bot to the Vellum Assistant gateway with automated webhook registration and credential storage.
chat-complex-documents
Chat with and search your complex documents — ask questions, extract tables and fields, and get answers grounded in the source. Connects the hosted Unstructured Transform MCP server to parse, structure, and enrich PDFs, Word/Excel/PowerPoint, images, scanned files, emails, and 60+ other formats into clean, AI-ready…