Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/athola/claude-night-marketnpx agentmods add skills/athola/claude-night-market/night-market-operationsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/athola/claude-night-market/night-market-operations)<a href="https://agentmods.dev/skills/athola/claude-night-market/night-market-operations"><img src="https://agentmods.dev/badge/skills/athola/claude-night-market/night-market-operations/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/athola/claude-night-market/night-market-operations"><img src="https://agentmods.dev/badge/skills/athola/claude-night-market/night-market-operations.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00043 | $0.03704 |
| Opus 5 | $0.00022 | $0.01852 |
| Sonnet 5 | $0.00009 | $0.00741 |
| Haiku 4.5 | $0.00004 | $0.00370 |
Grade A, and why
night-market-operations scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 13d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 297 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Night Market Operations
This skill is the runbook for operating the claude-night-market repo: what each make target actually executes, where artifacts land, and the exact sequence that ships a release. Every command below was verified against the Makefile, scripts/, and .github/workflows/ on 2026-07-02 (repo v1.9.15).
Terms used once and reused throughout:
- Plugin: a directory under
plugins/with a.claude-plugin/plugin.jsonmanifest. Most have their own Makefile, pyproject.toml, and tests/. - skrills: a Rust CLI for skill validation and token analysis,
vendored at
plugins/abstract/bin/skrills. Every skrills target has a Python fallback, so a missing binary never blocks you. - ClawHub export: a cross-framework skill package format written to
clawhub/byscripts/clawhub_export.py.
All commands run from the repo root unless a cd is shown. uv is
required for everything Python. For environment setup, see
night-market-build-and-env.
Command anatomy
| Command | What it actually executes | When to use | Expected output shape |
|---|---|---|---|
make test |
./scripts/run-plugin-tests.sh --all: per plugin, runs make test --quiet if the plugin Makefile has a test: target, else uv run python -m pytest tests/ --tb=short --quiet if pyproject mentions pytest. Skips plugins without tests/. |
Full sweep before a PR or release. | Per-plugin pass/fail/skip lines. Failures re-run verbose. |
make lint |
uv run ruff format plugins/, then uv run ruff check --fix plugins/, then ruff format again, then uv run bandit --quiet -c pyproject.toml -r plugins/. All use root pyproject.toml config. |
Before every commit. Mutates files (auto-fix). | Four staged sections ending "Lint Complete". |
make typecheck |
./scripts/run-plugin-typecheck.sh --all: per-plugin uv run mypy under each plugin's own strict config, plus a separate uv run mypy hooks/ pass when hooks/*.py exists. |
After type-touching changes and before release. | Per-plugin pass/fail. Hooks checked as a sub-step. |
make validate-all |
python3 plugins/abstract/scripts/validate_plugin.py <plugin> for every plugin. Failures print "(validation failed)" but do NOT stop the loop or fail the target. |
Structure audit after manifest edits. | One validation block per plugin. Read output, not exit code. |
make plugin-check |
For each plugin whose Makefile has a plugin-check: target: timeout 180 make -C plugins/<p> plugin-check. Failures and timeouts print a note, exit code stays 0. |
Dogfood/demo sweep before release. | Per-plugin sections. Watch for "(plugin-check failed or timed out)". |
make docs-sync-check |
bash scripts/capabilities-sync-check.sh |
PR touches plugin manifests or skills (mirrors capabilities-sync.yml CI). | Drift list or clean pass. Fix drift with /sanctum:sync-capabilities --fix. |
make supply-chain-scan |
python3 scripts/supply_chain_scan.py |
After dependency or lockfile changes. | Scan report between banner lines. |
make validate-skills |
skrills validate --skill-dir plugins --target claude (plugin bin, then PATH). Falls back to uv run python scripts/check_plugin_hooks.py. |
Skill frontmatter/structure check. | skrills report, or the Python fallback notice plus its output. |
make analyze-skills |
skrills analyze --skill-dir plugins. Falls back to uv run python scripts/generate_dependency_map.py. |
Skill token-budget and dependency analysis. | Token/dependency stats. |
make status |
make -C <plugin> status for every plugin. |
Quick overview. | Per-plugin status or "(status unavailable)". |
make clean |
make -C <plugin> clean for every plugin, errors ignored. |
Reset build artifacts. | "Done." |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 13d ago First seen · 297 lines · 43 tokens per session scan A 6e13abf93452
night-market-operations is a skill published in the GitHub repository athola/claude-night-market (337 stars, last pushed 2d ago), licensed MIT. It adds 43 tokens to every session and 3,704 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
github-cli
Safety-first GitHub CLI skill wrapping gh (v2.86+). Use when performing GitHub operations — PRs, issues, releases, repos, Actions, API calls. Enforces risk classification with mandatory confirmation for destructive/forbidden operations.
project-change-log
Maintain a CHANGELOG.md following the Keep a Changelog standard. Use after commits, on /commit, when the user asks to update the changelog, or when releasing a version — maps conventional-commit types to Added/Changed/Fixed/Security categories. Archives old releases into per-major files (changelog/CHANGELOG-1.x.md) so…
project-change-log
Automatically maintain a CHANGELOG.md file following the Keep a Changelog standard.
release-announcement
Write a release announcement — changelog, blog post, in-app note, or social post — that leads with user impact, names the audience, and includes upgrade/migration steps without filler.
multi-agent-release-manager
Cleans up the workspace, formats code, runs presubmit checks, and uploads CLs to Gerrit.
nvca-chart-release
Release NVCA Operator chart changes from the native monorepo source to the vendored Helm chart. Use when updating the vendored NVCA Operator chart, changing NVCA image refs, publishing helm-nvca-operator, or validating the chart against a self-managed control plane.