Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/florianbruniaux/claude-code-plugins/validate-changesnpx skills add FlorianBruniaux/claude-code-plugins --skill validate-changesgit clone --depth 1 https://github.com/FlorianBruniaux/claude-code-pluginsWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00016 | $0.00677 |
| Opus 5 | $0.00008 | $0.00338 |
| Sonnet 5 | $0.00003 | $0.00135 |
| Haiku 4.5 | $0.00002 | $0.00068 |
Grade A, and why
validate-changes scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 117 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Validate Changes Before Commit
Evaluate staged git changes using the output-evaluator agent to catch issues before committing.
Process
Step 1: Check for Staged Changes
Run git diff --cached --stat to see what's staged. If nothing is staged, inform the user and exit.
Step 2: Get the Full Diff
Run git diff --cached to get the complete diff of all staged changes.
Step 3: Invoke the Evaluator
Use the Task tool to launch the output-evaluator agent with the diff:
Evaluate these staged changes for correctness, completeness, and safety.
Return a JSON verdict with scores and issues.
Changes:
[paste the git diff here]
Step 4: Parse and Act on Verdict
Based on the evaluation result:
If APPROVE:
- Tell the user the changes passed evaluation
- Show the summary and scores
- Ask if they want to proceed with commit
If NEEDS_REVIEW:
- Show all issues found (grouped by severity)
- Show the suggestion from the evaluator
- Ask the user how to proceed:
- Fix issues and re-evaluate
- Commit anyway (acknowledge risks)
- Abort
If REJECT:
- Clearly state the changes were rejected
- Show critical issues that caused rejection
- Do NOT offer to commit anyway
- Suggest specific fixes
Step 5: Commit (if approved)
If user confirms, create the commit using the standard commit flow.
Usage Examples
/validate-changes
Output:
Evaluating 3 staged files...
VERDICT: NEEDS_REVIEW
Scores:
Correctness: 8/10
Completeness: 6/10
Safety: 9/10
Issues Found:
[MEDIUM] src/api/handler.ts:45
Missing error handling for network failures
[LOW] src/utils/format.ts:12
Consider adding input validation
Suggestion: Add try-catch around the fetch call in handler.ts
How would you like to proceed?
1. Fix issues and re-evaluate
2. Commit anyway (1 medium issue)
3. Abort
Cost Awareness
This command invokes an LLM evaluation, which uses API tokens:
- Typical cost: $0.01-0.05 per evaluation (using Haiku)
- Larger diffs: May cost more due to increased token usage
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 117 lines · 16 tokens per session scan A d029e88c2e68
validate-changes is a skill published in the GitHub repository FlorianBruniaux/claude-code-plugins (40 stars, last pushed 3mo ago), licensed MIT. It adds 16 tokens to every session and 677 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
ship
Final pre-merge step — sync docs, then prepare a clean commit/PR summary. Use after verify passes. Does NOT commit or push unless you explicitly ask; it prepares everything and stops.
committing
Creates quality git commits with conventional commit format. Use when asked to commit changes or create a commit message.
git-workflow
Git conventions and workflow guidelines using Conventional Commits, branching strategies, and best practices for version control.
commit-archaeologist
Reconstructs why code exists from local git history, including the introducing commit, later changes, current authors, repeated companion files, and likely intent. Use when the user asks "why does this code exist", "who wrote this function and why", or to "explain the history of this function" before a rewrite…
pr-draft-summary
Create the required PR-ready summary block, branch suggestion, title, and draft description for openai-agents-python. Use before the final response whenever the current task changed runtime code, tests, examples, build/test configuration, or docs with behavior impact, regardless of perceived change size and including…
commit-history
List recent git commits linked to agent sessions, optionally filtered by branch or repo. Use when the user asks "show agent commits", "what has the agent shipped", "list linked commits", or wants commits with their session context.