Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/athola/claude-night-marketnpx agentmods add skills/athola/claude-night-market/night-market-change-controlWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/athola/claude-night-market/night-market-change-control)<a href="https://agentmods.dev/skills/athola/claude-night-market/night-market-change-control"><img src="https://agentmods.dev/badge/skills/athola/claude-night-market/night-market-change-control/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/athola/claude-night-market/night-market-change-control"><img src="https://agentmods.dev/badge/skills/athola/claude-night-market/night-market-change-control.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00043 | $0.03276 |
| Opus 5 | $0.00022 | $0.01638 |
| Sonnet 5 | $0.00009 | $0.00655 |
| Haiku 4.5 | $0.00004 | $0.00328 |
Grade A, and why
night-market-change-control scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 13d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 254 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Night Market Change Control
Every change to this repo passes through a fixed law stack, a classification step, and a gauntlet of automated gates. This skill tells you which class your change is, which gates it must pass, and which rules are non-negotiable because a past incident made them so. Nothing here may be routed around: if a gate fails, fix the cause, never the gate.
Jargon used below: a "gate" is any automated check that can block a
commit, PR, or release. An "ADR" is an Architecture Decision Record in
docs/adr/. The "Iron Law" is constitution rule 3: no implementation
without a failing test first.
The law stack
When two documents conflict, the higher one wins.
| Rank | Source | Contents |
|---|---|---|
| 1 | CONSTITUTION.md |
10 immutable rules, override and amendment process |
| 2 | .claude/rules/ |
8 project rules (markdown style, read budgets, slop gates, invariants) |
| 3 | docs/adr/ |
17 numbered decision records (0001 to 0017) |
| 4 | Guides in docs/ |
quality-gates, testing-guide, plugin-development-guide |
A skill, hook, or agent instruction that says "skip rule N" without an explicit user grant or a merged amendment is itself a defect (CONSTITUTION.md, Override mechanism section).
The ten constitution rules
One line each. Where a rule was written in blood, the incident column names the blood.
| # | Rule | Motivating incident |
|---|---|---|
| 1 | Disclose AI involvement in every PR; never strip real or add fake AI attribution | Enforced by hook plugins/imbue/hooks/vow_no_ai_attribution.py |
| 2 | AI commits over 200 changed lines need a spec, ADR, or plan doc first (lockfiles, fixtures, snapshots excluded) | Size = scrutiny principle; see the unbloat incident under non-negotiables |
| 3 | Iron Law TDD: failing test before implementation for plugin Python. Skills and prose need structural tests (test_skill_<name>.py) |
Design principle, no single incident |
| 4 | One identity leak ("As a large language model") in any committed artifact is an automatic revert | Pattern catalog in scribe slop-detector |
| 5 | Quality claims ("fast", "production-ready") need in-repo evidence or deletion | Design principle |
| 6 | No bypassing gates: no --no-verify, no SKIP=hook, no unauthorized force push, no bare suppression comments without a stated reason |
Neutered-mypy incident (CHANGELOG 1.9.12); bulk-ignore revert 06b9b1db |
| 7 | New dependencies need justification; 18 months unmaintained is presumed abandoned; verify AI-suggested package names against the registry | Slopsquatting defense; hook guard_package_hallucination.py (imbue) |
| 8 | Docs cost reader-time (audience x frequency x per-read time); writing effort must match | Design principle |
| 9 | Prefer deletion over rewriting; AI slop is overwhelmingly additive | Design principle |
| 10 | Errors are not optional: propagate by default, no bare except, safe-to-discard needs an inline "why" comment | Silent-failure sweep 666171c3; ecosystem bare-except campaign |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 13d ago First seen · 254 lines · 43 tokens per session scan A c737d1f702d5
night-market-change-control is a skill published in the GitHub repository athola/claude-night-market (337 stars, last pushed 2d ago), licensed MIT. It adds 43 tokens to every session and 3,276 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
github-automation
GitHub workflow automation, PR management, issue tracking, and code review coordination. Integrates with GitHub Actions and repository management. Use when: PR creation, code review, issue management, release automation, workflow setup. Skip when: local-only changes, non-GitHub repositories.
github
GitHub via gh CLI: PRs, issues, reviews, repos, auth.
parallel-pr-review
Use when asked to "review the open PRs", review a batch or stack of pull requests, or run a recurring PR-review pass on a repo — especially with many PRs, stacked branches, conflicts, or security-sensitive changes. Covers grouping, fan-out to review subagents, verdict synthesis, and posting.
release
Cut a brooks-lint release: set the version in package.json, propagate it across all four plugin manifests and every version-bearing text file (README badges, docs site metadata), write the CHANGELOG entry, validate, then commit, push, tag, and publish the GitHub release. Triggers when the maintainer asks to "release"…
han-release
Cut a Han release: update CHANGELOG.md with the changes since the last release, bump and tag every plugin that changed as {plugin-name}--v{version} so a version-constrained dependency can resolve, and publish a GitHub release crediting every merged pull request and closed issue to the people behind it. Use when…
ship
Use when code is ready to ship — creates PRs, merges, deploys, and verifies. Handles the full PR-to-production pipeline. Triggers on /ship.