Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/apurvbazari/claude-plugins/validatenpx skills add ApurvBazari/claude-plugins --skill validategit clone --depth 1 https://github.com/ApurvBazari/claude-pluginsWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00016 | $0.00811 |
| Opus 5 | $0.00008 | $0.00405 |
| Sonnet 5 | $0.00003 | $0.00162 |
| Haiku 4.5 | $0.00002 | $0.00081 |
Grade A, and why
validate scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 102 lines — stays where its author put it; the contents beside it link to each section on GitHub.
/validate — Plugin Validation
Run all quality checks across every plugin in the marketplace. Reports PASS/WARN/FAIL per category.
Step 1: Identify Plugins
Read .claude-plugin/marketplace.json to get the list of registered plugins. For each plugin, extract the source path.
Step 2: Structure Check
For each plugin directory, verify:
.claude-plugin/plugin.jsonexistsREADME.mdexists- At least one of
skills/,commands/,agents/exists
Report missing items as FAIL.
Step 3: Manifest Validation
For each plugin.json, verify:
- Valid JSON syntax
- Required fields present:
name,version,description,author,license,keywords namematches the plugin directory name
Report missing/invalid fields as FAIL.
Step 4: Version Sync
Compare each plugin's plugin.json version with its marketplace.json entry:
- Versions must match exactly
- Both must be valid semver
Report mismatches as FAIL.
Step 5: Reference Integrity
For each skills/*/SKILL.md, check if the skill directory has a references/ subdirectory. If it does, verify every .md file in it exists and is non-empty.
For each agents/*.md, check for any script references (paths to .sh files). Verify those scripts exist.
Report broken references as FAIL.
Step 6: ShellCheck
Run shellcheck on all .sh files across all plugins and .claude/hooks/.
If shellcheck is not installed:
- Report as WARN: "ShellCheck not installed — skipping script validation. Install with: brew install shellcheck"
- Do NOT report as FAIL
If installed, report any ShellCheck errors as WARN (not FAIL — scripts may have intentional suppressions).
Step 7: SKILL.md Section Check
For each SKILL.md, verify:
- H1 title exists (line begins with
#followed by descriptive text) - H1 does NOT use the
/<plugin>:<skill>slash form — per.claude/rules/skills-authoring.md, the slash is derived from frontmattername, not the H1 - Has a
## Key Rulessection (or similar closing constraints section)
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 102 lines · 16 tokens per session scan A bf706b8448b1
validate is a skill published in the GitHub repository ApurvBazari/claude-plugins (0 stars, last pushed 26d ago), licensed MIT. It adds 16 tokens to every session and 811 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
cross-platform
Cross-platform development patterns for macOS, Windows, and Linux.
shell-scripting
Shell scripting best practices for cross-platform CLI tools.
c-notify
Send native macOS notification center alerts from the command line using terminal-notifier.
change-keybinding
Customize Warp keyboard shortcuts (keybindings, keymappings) by editing the user's keybindings.yaml file. Use when the user asks to remap a key combination, rebind an action, change a shortcut, or remove a default keybinding (e.g. "change ctrl+space to ctrl+s", "rebind the command palette to cmd+p", "remove the…
agent-add-mcp
Use this skill when helping users add MCP servers to their Warp configuration.
autoprompt
Explicit-only useful-first orchestration. Invoke /autoprompt to turn a mission into one executable roadmap, build dependency-safe lanes, and verify the result with independent reviewers. Never infer invocation from ordinary requests. Never resume from leftover artifacts without an explicit resume instruction.