Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/betmoar/cc-proxy-plugin/setupnpx skills add betmoar/cc-proxy-plugin --skill setupgit clone --depth 1 https://github.com/betmoar/cc-proxy-pluginWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00117 | $0.03205 |
| Opus 5 | $0.00059 | $0.01603 |
| Sonnet 5 | $0.00023 | $0.00641 |
| Haiku 4.5 | $0.00012 | $0.00320 |
Grade B, and why
setup scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Reads agent configuration directoriesmediumAgent snooping
.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.
description: One-time setup for the cc-proxy plugin. Writes API keys (all optional — GLM_API_KEY, OPENROUTER_API_KEY, DEEPSEEK_API_KEY, DASHSCOPE_API_KEY, LMSTUDIO_BASE_URL, LMSTUDIO_API_KEY) to ~/.env, and configures AN How it starts
The opening of the file, as written. The whole thing — 154 lines — stays where its author put it; the contents beside it link to each section on GitHub.
cc-proxy setup
One-time configuration of ~/.claude/settings.json so the proxy runs automatically on every Claude Code session.
The proxy binary needs no configuration: the SessionStart hook and scripts/start-proxy.js resolve bin/cc-proxy.js from their own plugin tree, which is always the currently-installed version. Do not write PROXY_PATH into settings.json — a version-pinned path there is exactly how users used to get stuck on stale proxies after plugin updates. If a PROXY_PATH already exists in settings.json env, remove it during step 3 (it is a legacy pin; the tree's own bin outranks it anyway).
What to do
Follow these steps exactly. Do not skip any.
1. Locate the plugin tree (for the statusline path only)
Check these locations in order and use the first one that exists:
~/.claude/plugins/cache/betmoar/cc-proxy/*/(marketplace install — the normal case; glob the*version segment and take the newest if there is more than one)~/dev/cc-proxy-plugin/(dev-repo fallback, if the user cloned source)
This concrete path is needed only for the optional statusline command in step 4 (which runs outside plugin context). It is not written as PROXY_PATH.
2. Collect provider API keys (written to ~/.env)
API keys live in ~/.env — the single source of truth the proxy reads at startup. Do not put keys in ~/.claude/settings.json env; it keeps only non-secret plumbing (step 3).
Read ~/.env first (create the file if absent). For each key, reuse a value already present rather than re-asking.
Z.ai / GLM — optional, but the one this plugin is built around. It is the model wired into the /model picker, so without it that picker entry routes nowhere useful. If GLM_API_KEY is missing or empty in ~/.env, ask explicitly:
"Enter your Z.ai API key (https://z.ai → Dashboard → API Keys), or press Enter to skip. It will be stored in ~/.env:"
If the user skips, continue setup — do not stop and do not re-ask. The proxy
starts without it and routes to Claude; a backend with no key is simply not
registered. Say once that glm-5.3[1m] will appear in /model but won't route
until a key is added, then move on.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 154 lines · 117 tokens per session scan B 2deea483e1de
setup is a skill published in the GitHub repository betmoar/cc-proxy-plugin (2 stars, last pushed yesterday), licensed MIT. It adds 117 tokens to every session and 3,205 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it B with 1 finding (reads agent configuration directories). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
ship-release
Drive a Telepresence release from a prepared branch all the way through CI, docs, the Releases workflow, and PR merges. Assumes make prepare-release has already been run locally and the branch with that commit was pushed and a PR opened. Use when the user says "ship the release", or "complete the release". User-only.
changelog-entry
Add a new entry to CHANGELOG.yml under the current unreleased version (or create the version block if needed), then regenerate documentation. Use when the user says things like "add a changelog entry", "log this fix in the changelog", or "/changelog-entry".
browser-auth
Documents how to use Chrome DevTools MCP to navigate authenticated web pages, extract data (tokens, configuration values), take screenshots, and handle login flows. Use when you need to interact with Buildkite, AWS Console, or other authenticated web UIs via the Chrome browser. Triggers when users ask about "browser…
review-spec
Deep adversarial specification review using the 8-lens review constitution. Evaluates design documents, plans, and specs for ambiguity, completeness, feasibility, security, and MockServer-specific concerns. Loaded by review-cheap and review-final agents.
playwright-screen-recording
Record browser test videos with Playwright for PR review and bug fix verification.
push-release
Push to GitHub and optionally bump version to trigger PyPI release.