Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add athola/claude-night-market --skill night-market-config-cataloggit clone --depth 1 https://github.com/athola/claude-night-marketWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/athola/claude-night-market/night-market-config-catalog)<a href="https://agentmods.dev/skills/athola/claude-night-market/night-market-config-catalog"><img src="https://agentmods.dev/badge/skills/athola/claude-night-market/night-market-config-catalog/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/athola/claude-night-market/night-market-config-catalog"><img src="https://agentmods.dev/badge/skills/athola/claude-night-market/night-market-config-catalog.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 2 findings, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium MCP Rug Pull · line 36 uvx/uv tool run commands without ==version create a rug-pull risk.Fix: Pin the version: uvx package-name==1.2.3
- medium Excessive Agency · line 164 Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.Fix: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00036 | $0.04209 |
| Opus 5 | $0.00018 | $0.02105 |
| Sonnet 5 | $0.00007 | $0.00842 |
| Haiku 4.5 | $0.00004 | $0.00421 |
Grade A, and why
night-market-config-catalog scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 13d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 276 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Night Market Config Catalog
Every configuration axis in this repo: where it lives, what the options and defaults are, whether it is production policy or an experimental opt-in, and what guards it. Flags drift, so every axis ends with a one-line re-verification command. Run it before trusting a value stated here.
Terms used once, defined once:
- Axis: one independently tunable configuration surface (a file, a key, or an environment variable).
- Guard: the mechanism that notices when the axis breaks or drifts (a test, a pre-commit hook, a CI job, or a script).
- Shadow mode: a hook that evaluates and warns but does not block. The blocking posture is opt-in.
Axis table
| Surface | File | Key options and defaults | Status | Guarded by |
|---|---|---|---|---|
| Quality gate thresholds | .claude/quality_gates.json |
enforce_blocking true, max_critical_issues 3, max_warnings_per_dimension 5; per-dimension keys below |
Production policy | Documented in docs/quality-gates.md; consumed as policy prose by sanctum PR workflows (see caveat below) |
| Context governance | .claude/context_governance.json |
enforce_strict_limits false, require_progressive_disclosure true, require_modular_structure true, require_optimization_level "standard", block_on_critical_violations false, max_violations_per_file 5 |
Production, advisory | docs/quality-gates.md |
| Repo Claude settings | .claude/settings.json |
Contains only a description key. NO hooks registered at repo level; all active hooks ship from plugins |
Production invariant | Convention; see night-market-architecture-contract |
| Behavioral rules | .claude/rules/*.md (8 files) |
bounded-discovery, markdown-formatting, plan-before-large-dispatch, prefer-invariants-over-fallbacks, prefer-rg-over-grep, shared-utility-consumer-rule, skill-exit-criteria, slop-scan-for-docs | Production | slop CI, pre-commit, review practice |
| Python toolchain | root pyproject.toml |
See "Root pyproject tool tables" below | Production | Pre-commit hooks, typecheck.yml, security.yml |
| Per-plugin coverage | plugins/*/pyproject.toml [tool.nightmarket] |
coverage_threshold = 90 in 19 plugins, 85 in gauntlet (20 files total) |
Production | Read by scripts/run-plugin-tests.sh |
| Pre-commit pins | .pre-commit-config.yaml |
Remote pins: pre-commit-hooks v6.0.0, bandit 1.8.6 (last release supporting the 3.9 system interpreter). Ruff runs from a local repo via the uv-managed binary so hook and make format share one version |
Production | scripts/check_pinned_versions.py, python39-compat.yml |
| Plugin manifest trio | plugins/<p>/.claude-plugin/plugin.json, .claude-plugin/metadata.json, openpackage.yml |
All three carry version in lockstep with the marketplace (1.9.15 at compile time) |
Production | plugins/sanctum/scripts/update_versions.py, plugins/abstract/scripts/validate_plugin.py |
| Marketplace version | .claude-plugin/marketplace.json top-level version |
Single ecosystem version, source of truth for the fan-out | Production | update_versions.py <version> bumper |
| MCP servers | .mcp.json |
One stdio server: markitdown via uvx markitdown-mcp |
Production | Manual |
| LSP config | .cclsp.json |
pylsp for py/pyi; typescript-language-server for js/ts and markdown |
Production | Manual |
| Feature-review scoring | .feature-review.yaml |
version: 1; weight tables for value and cost; thresholds high_priority 2.8, medium_priority 1.8, confidence_warning 0.6 |
Production | Consumed by imbue:feature-review |
| Egregore runtime config | .egregore/config.json (runtime file, created in the target repo, not committed here) |
Nested dataclasses in plugins/egregore/scripts/config.py: overseer, alerts, pipeline, budget, discussions. pipeline.completion_integrity = False |
Experimental opt-in flag inside production config | Unit tests in plugins/egregore/tests/test_config.py (default, roundtrip, and raw-JSON opt-in paths) |
| Conjure delegation | ~/.claude/hooks/delegation/config.json (runtime file, per machine, not committed here) |
Top-level enabled defaults to on when absent; only an explicit false opts out. services overrides per-provider ServiceConfig fields |
Production, default-on | plugins/conjure/tests/scripts/test_delegation_executor.py::TestDelegationIsOnUnlessRefused |
| Herald Stop-hook judge | plugins/herald/hooks/hooks.json + env vars |
Stop hook double_shot_latte.py registered with timeout: 10; internal LLM_TIMEOUT_SECONDS = 8 |
Hook production, LLM path experimental | Guard test asserts LLM timeout stays under the registered hook budget |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 13d ago First seen · 276 lines · 36 tokens per session scan A 9929f6e5776b
night-market-config-catalog is a skill published in the GitHub repository athola/claude-night-market (337 stars, last pushed 2d ago), licensed MIT. It adds 36 tokens to every session and 4,209 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
algorithmic-art
Creating algorithmic art using p5.js with seeded randomness and interactive parameter exploration. Use this when users request creating art using code, generative art, algorithmic art, flow fields, or particle systems. Create original algorithmic art rather than copying existing artists' work to avoid copyright…
slack-gif-creator
Toolkit for creating animated GIFs optimized for Slack, with validators for size constraints and composable animation primitives. This skill applies when users request animated GIFs or emoji animations for Slack from descriptions like "make me a GIF for Slack of X doing Y".
canvas-design
Create beautiful visual art in .png and .pdf documents using design philosophy. You should use this skill when the user asks to create a poster, piece of art, design, or other static piece. Create original visual designs, never copying existing artists' work to avoid copyright violations.
xlsx
Comprehensive spreadsheet creation, editing, and analysis with support for formulas, formatting, data analysis, and visualization. When Claude needs to work with spreadsheets (.xlsx, .xlsm, .csv, .tsv, etc) for: (1) Creating new spreadsheets with formulas and formatting, (2) Reading or analyzing data, (3) Modify…
mcp-builder
Guide for creating high-quality MCP (Model Context Protocol) servers that enable LLMs to interact with external services through well-designed tools. Use when building MCP servers to integrate external APIs or services, whether in Python (FastMCP) or Node/TypeScript (MCP SDK).
skill-creator
Guide for creating effective skills. This skill should be used when users want to create a new skill (or update an existing skill) that extends Claude's capabilities with specialized knowledge, workflows, or tool integrations.