Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/fengyiqicoder/lights/skillnpx skills add fengyiqicoder/Lights --skill skillgit clone --depth 1 https://github.com/fengyiqicoder/LightsWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00093 | $0.00949 |
| Opus 5 | $0.00046 | $0.00475 |
| Sonnet 5 | $0.00019 | $0.00190 |
| Haiku 4.5 | $0.00009 | $0.00095 |
Grade B, and why
lights-hooks scanned grade B with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Reads agent configuration directoriesmediumAgent snooping
.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.
cp ~/.claude/settings.json ~/.claude/settings.json.bak-lights-$TS Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
correctly, Claude Code fires curl requests on lifecycle events and the How it starts
The opening of the file, as written. The whole thing — 117 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Install Lights Hooks for Claude Code
Lights listens on http://127.0.0.1:9876 for state signals. When configured
correctly, Claude Code fires curl requests on lifecycle events and the
floating traffic light reflects current activity.
Step 1 — Verify Lights is running
Run:
curl -s --max-time 1 http://127.0.0.1:9876/status
Expected output: idle, executing, permission, or off.
If the curl fails or hangs:
- Tell the user: "Lights app isn't running. Launch /Applications/Lights.app
(or
open Lights.appfrom the source repo) and then re-invoke this skill." - Stop. Do not proceed with config changes.
Step 2 — Back up settings.json
TS=$(date +%Y%m%d-%H%M%S)
cp ~/.claude/settings.json ~/.claude/settings.json.bak-lights-$TS
Step 3 — Merge the hooks
Read ~/.claude/settings.json as JSON. Ensure the top-level hooks key
exists (create as {} if missing). For each of the five events below,
add a new hook entry — preserve any existing hooks the user has.
Idempotency rule
Before adding each hook, scan all existing commands in the target event
array. If any command already contains 9876/<endpoint> for that
endpoint, skip — do not duplicate.
Hooks to add
All commands share these properties:
type: "command"timeout: 2000- Stream output to
/dev/null, suffix|| trueso a missing Lights never blocks Claude Code
| Event | Matcher | Endpoint |
|---|---|---|
UserPromptSubmit |
(none) | /executing |
Notification |
(none) | /permission |
Stop |
(none) | /idle |
PreToolUse |
AskUserQuestion|ExitPlanMode |
/permission |
PostToolUse |
AskUserQuestion|ExitPlanMode |
/executing |
Command template:
curl -s --max-time 1 http://127.0.0.1:9876/<endpoint> >/dev/null 2>&1 || true
Merge structure
Each event in hooks is an array of entries. Each entry has:
- optional
matcher(regex) hooks: array of{type, command, timeout}objects
When adding to an event:
- If an entry with the same
matcheralready exists → append the new hook to that entry'shooksarray. - Otherwise → create a new entry with the matcher + the single hook.
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 117 lines · 93 tokens per session scan B 97bffa6ab98b
lights-hooks is a skill published in the GitHub repository fengyiqicoder/Lights (5 stars, last pushed 3mo ago), licensed MIT. It adds 93 tokens to every session and 949 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it B with 2 findings (reads agent configuration directories, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
burrow-system-tools
Diagnose and fix the user's Mac with Burrow's local MCP tools (burrowdoctor, burrowsnapshot, burrowtopprocesses, burrowprocessusage, burrowports, burrowanalyze, burrowdiskforecast, burrowdupes, burrowanomalies, burrowagentaudit, burrowclean, …). Use whenever the Mac is slow, hot, loud, low on disk, draining battery…
swiftui-debugging
Use when debugging SwiftUI issues in this macOS app — views not updating, layout problems, unnecessary re-renders, state ownership bugs, Preview crashes, or NSHostingView/NSPanel quirks. Covers both general SwiftUI debugging and macOS-specific patterns.
release
Use when cutting or preparing a cctop release - "cut a release", "release vX.Y.Z", "prepare a release", "bump the version and tag", "ship a new version". Drives proportionate release checks, version bump, CI, tag push, release monitoring, and verification. An explicit release request authorizes the complete release…
video-assets
Use when publishing, replacing, auditing, or linking cctop promo/demo video assets through GitHub Releases, especially the non-latest media-assets release. Trigger for requests like "upload the launch video", "add another video asset", "replace the README demo video", "where should this video live", "update…
e2e-session-test
Use when smoke-testing cctop end to end — verifying a real coding-agent session is tracked and shows in the panel. Trigger on "smoke test sessions", "verify session tracking", "test the hook pipeline", "check cctop picks up a claude/codex/opencode/pi session", or "run the e2e test", even without the word "skill".…
cctop-setup
Use when cctop-hook command fails or is not found. Guides user to install the cctop menubar app.