Getting it into your agent
There is no command for this one: it runs only inside a plugin, and the catalogue could not identify which plugin ships it. The source is linked below.
Wrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/athola/claude-night-market/night-market-diagnostics-toolkit)<a href="https://agentmods.dev/skills/athola/claude-night-market/night-market-diagnostics-toolkit"><img src="https://agentmods.dev/badge/skills/athola/claude-night-market/night-market-diagnostics-toolkit/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/athola/claude-night-market/night-market-diagnostics-toolkit"><img src="https://agentmods.dev/badge/skills/athola/claude-night-market/night-market-diagnostics-toolkit.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00040 | $0.03218 |
| Opus 5 | $0.00020 | $0.01609 |
| Sonnet 5 | $0.00008 | $0.00644 |
| Haiku 4.5 | $0.00004 | $0.00322 |
Grade A, and why
night-market-diagnostics-toolkit scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 203 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Night Market Diagnostics Toolkit
Measure instead of eyeballing. Every claim about the health of this repo ("the skill graph is clean", "descriptions fit the budget", "no compromised dependencies") has a script that produces a number or a PASS/FAIL. This skill catalogs those scripts, their exact invocations, and how to read their output.
Conventions for everything below:
- Run all commands from the repo root
(
/home/alext/claude-night-market). - Plain
python3is enough for every script in the table except mutation testing, which needsuv. - All checks here are read-only. None of them mutate the repo.
The ratchet-baseline concept
Several checks are ratchets. A ratchet check counts a category of existing debt (for example, SKILL.md files missing an Exit Criteria section), compares the live count against a frozen number in a baseline JSON file, and:
- passes while the live count is at or below the baseline (pre-existing debt is tolerated),
- fails the moment a NEW violation pushes the count above the baseline (debt may not grow),
- nudges you to lower the baseline number when the live count drops (locking in the win so the debt cannot silently return).
The goal is a baseline that only shrinks, eventually to zero. The
two ratchet baselines live at scripts/skill_graph_baseline.json
(keys max_dangling_bugs, max_uncalled_libraries) and
scripts/skill_exit_criteria_baseline.json
(key max_missing_exit_criteria). When a ratchet prints a
"dropped to N (baseline M). Lower ... to lock the win." line, edit
the baseline JSON down to N in the same PR.
Tool table
Jargon used in the table: "dangling Skill() ref" means a
Skill(plugin:name) reference in a skill/command/agent file whose
target skill does not exist. "Uncalled library" means a
library-role skill no other skill invokes (the risk targeted by
.claude/rules/shared-utility-consumer-rule.md).
| Tool | Invocation | What it measures | How to interpret | When to run |
|---|---|---|---|---|
| Plugin structure validator | python3 plugins/abstract/scripts/validate_plugin.py plugins/<name> |
plugin.json validity, kebab-case naming, directory layout | Exit 0 with "Plugin validation passed". Any FAIL line names the broken file | Before committing plugin changes. make validate-all loops it over every plugin |
| Skill-graph drift ratchet | python3 scripts/check_skill_graph_drift.py |
Dangling Skill() refs and uncalled libraries vs skill_graph_baseline.json |
Exit 0 at/below baseline. Nonzero exit lists the new dangling refs. "Lower ... to lock the win" means shrink the baseline | After adding, renaming, or deleting skills or Skill() refs |
| Exit-criteria drift ratchet | python3 scripts/check_skill_exit_criteria_drift.py |
SKILL.md files under plugins/ missing an ## Exit Criteria heading vs skill_exit_criteria_baseline.json |
Same ratchet semantics as above | After adding or editing any SKILL.md |
| Pinned-version checker | python3 scripts/check_pinned_versions.py |
GitHub-sourced tool pins vs the latest upstream release (needs network) | "N pin(s) current" is healthy. A "holding X at ..." line documents an intentional hold with its reason (for example bandit 1.8.6 for the Python 3.9 hook floor) | In pre-commit, and whenever a CI tool-setup step breaks |
| Capabilities sync | bash scripts/capabilities-sync-check.sh |
plugin.json registrations vs the generated capabilities reference in book/src/ | "PASSED: All capabilities are in sync" plus counts. On drift, run /sanctum:sync-capabilities --fix |
After changing any skill, command, or agent registration |
| Supply-chain scan | python3 scripts/supply_chain_scan.py |
Lockfiles vs the known-compromised-versions blocklist, plus known malicious artifacts | Two [OK] lines is clean. Any hit must be resolved before release |
When adding dependencies, during incidents, before releases |
| Token stats | python3 plugins/abstract/scripts/context_optimizer.py stats plugins/ --format json |
Bytes and estimated tokens per SKILL.md, bucketed small/medium/large | Skills over ~5,000 estimated tokens breach the quality-gates file limit and are split candidates | When a skill feels bloated, before modularizing |
| Description budget | python3 plugins/abstract/scripts/validate_budget.py |
Sum of all skill/command description characters vs the 90,000-char ecosystem ceiling (ADR-0004, 160 chars per description) | Prints used/ceiling and headroom. Exit 0 means within budget | After editing any frontmatter description |
| skrills validate | skrills validate --skill-dir plugins --target claude |
Skill frontmatter validity per target framework (Claude, Codex, Copilot) | "Validated N skills: ..." then an Errors (n): list with file:line. Fix every listed error |
Skill audits. make validate-skills falls back to uv run python scripts/check_plugin_hooks.py when skrills is absent |
| skrills analyze | skrills analyze --skill-dir plugins |
Skill token usage and dependency structure | Large-token outliers are split candidates | Budget planning. make analyze-skills falls back to scripts/generate_dependency_map.py |
| Mutation testing | cd plugins/<name> && uv run mutmut run --paths-to-mutate=scripts/,src/ --tests-dir=tests/ |
Whether the test suite kills injected code mutations (surviving mutants = untested behavior) | Exit 0 = no survivors. Exit 2 = survivors found (CI treats this as pass-with-report). Any other exit = crash, investigate | Weekly CI (Sunday) or manually before hardening a test suite |
| Markdown link checker | python3 scripts/check-markdown-links.py [file.md ...] |
Broken relative links and anchors. No args = scan the whole repo | Exit 1 prints each broken link as file: link |
After moving or renaming docs or skills |
| Lint-suppression guard | python3 scripts/check_noqa.py <files...> |
Inline lint/type suppressions that lack a stated reason | "BLOCKED" plus a hit list. Fix the issue, or append a reason after the suppression marker | Pre-commit runs it on changed files |
| Docstring quality | python3 scripts/check_docstring_quality.py <files.py...> |
Docstrings that merely restate the function name | Each hit says "delete it or add information". Do exactly that | Pre-commit runs it on changed Python files |
| JSON-utils drift | bash scripts/shared/check-json-utils-drift.sh |
Vendored JSON helper copies in plugin hooks vs the canonical scripts/shared/json_utils.sh |
"OK: all vendored JSON utilities match canonical." Anything else names the drifted copy | After editing json_utils.sh or any inlined copy |
| Export stats | python3 scripts/clawhub_export.py --stats |
Skill counts per plugin and top-20 membership for cross-framework export | Totals line plus a per-plugin table | Before cross-framework publishing |
| Framework detect | python3 scripts/framework_detect.py [--json] |
Which agent-framework capabilities the current directory exposes (skills, agents, hooks, commands, mcp, a2a) | [+]/[-] capability checklist |
When debugging cross-framework export targets |
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago First seen · 203 lines · 40 tokens per session scan A 0b621a8db4ab
night-market-diagnostics-toolkit is a skill published in the GitHub repository athola/claude-night-market (337 stars, last pushed yesterday), licensed MIT. It adds 40 tokens to every session and 3,218 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
health-check
Runs plugin health checks (venv packages, skill registration, and album slug collisions). Use when the user asks to check plugin health, verify setup, or troubleshoot missing skills.
compress
Vault alignment engine. Detects and fixes 5 types of structural misalignments: broken backlinks, concept fragmentation, entity miscategorization, duplicated entities, and misnamed entities. Delegates all writes to /bedrock:preserve. Supports interactive mode (user confirmation) and cron mode (autonomous mechanical…
healthcheck
Read-only vault health diagnostic. Generates a report without modifying any files. Checks: graphify-out integrity, setup verification, orphan entities, dangling content, old content (>15 days). Safe to run at any frequency. Use when: "bedrock healthcheck", "bedrock-healthcheck", "vault health", "check vault", "vault…
fact-checker
Anti-hallucination discipline for any code that names an external symbol you aren't certain exists — a library function, method, config key, package version, CLI flag, env var, or endpoint. Before you call it, cite it, or import it, confirm it's real: grep the codebase, read the installed package's actual signature…
stop-digging
Anti-thrashing circuit-breaker. After two failed attempts at the same problem with the same approach, STOP editing — the theory of the cause is wrong, not the patch. Re-examine assumptions, add instrumentation, and trace from the source before touching code again, instead of re-trying variations of the fix that…
toy
Build a world the human drives until how a thing behaves is intuitive. Use when the user needs to hold how something behaves and reading has not made it intuitive.