agentmods.dev

tckit: Skill for Claude Code

.claude/skills/tc-config/SKILL.md

tc-config is a skill for Claude Code from georgeturneruk/tckit. It costs 160 tokens per session (1,623 once invoked), scanned A, original, MIT.

Instructions for controlling TcKit's permissions, from read-only project inspection to writing files and acting on a live industrial control target. Permissions are stored in a JSON file and can be limited to specific target NetIds, which identify devices.

In plain words
What is it for?
Setting up TcKit permissions, changing its read/write/execute mode, allowing or blocking target devices, and checking why an action was denied.
Why use it?
It prevents tools from making changes or operating live targets beyond the allowed safety level.

Skill for Claude Code

Written for Claude Code: allowed-tools in frontmatter.

This is georgeturneruk/tckit's own configuration. It tells Claude Code how to work on tckit itself, so it is not a mod to install elsewhere. Copy it as a starting point and replace the rules that are about this project. Everything tckit configures →

not rated 11repo +1 2mo ago A scan 160 tokens original MIT
View source ↗ georgeturneruk/tckit tckit.org
Reuse

Borrowing it

Nothing to install: this file belongs to georgeturneruk/tckit. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file
curl -O https://raw.githubusercontent.com/georgeturneruk/tckit/main/.claude/skills/tc-config/SKILL.md
Clone the repo
git clone --depth 1 https://github.com/georgeturneruk/tckit

Made for: Claude Code.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for tc-config

README.md
[![agentmods](https://agentmods.dev/badge/skills/georgeturneruk/tckit/tc-config/github.svg)](https://agentmods.dev/skills/georgeturneruk/tckit/tc-config)
Your own site
<a href="https://agentmods.dev/skills/georgeturneruk/tckit/tc-config"><img src="https://agentmods.dev/badge/skills/georgeturneruk/tckit/tc-config/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for tc-config

Your own site · 80×15
<a href="https://agentmods.dev/skills/georgeturneruk/tckit/tc-config"><img src="https://agentmods.dev/badge/skills/georgeturneruk/tckit/tc-config.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 160 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 1,623 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00160 $0.01623
Opus 5.5 $0.00064 $0.00649
Sonnet 5.5 $0.00032 $0.00325
Haiku 4.5 $0.00016 $0.00162

Measured 2mo ago against content hash 7580b01703d0, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

tc-config scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2mo ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.claude/skills/tc-config/SKILL.md · 88 lines

How it starts

The opening of the file, as written. The whole thing — 88 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Configuring TcKit

TcKit's configuration surface is the safety stance: one JSON file at ~/.tckit/permissions.json (or $TCKIT_HOME/permissions.json). The server hot-reloads it on every tool call, so a change (a SetPermissions call or a hand edit) takes effect on the next call with no reconnect. The old Python CLI (tckit init / tckit config / tckit doctor) and ~/.tckit/config.toml are retired; if the user reaches for one of those, drive the flows below instead.

The two axes

Mode is a tier: read < write < execute.

  • read: inspect only (project reads, doc lookups).
  • write: also author the project on disk (add/update POUs, GVLs, DUTs).
  • execute: also act on a live target. Execute-class tools are exactly the NetId-gated set: Deploy, StartRuntime, RunTests, WriteSymbols, InvokeRpc.

A call above the current mode returns {"error": "Permission denied: ..."} naming the missing mode.

Target NetIds gate execute-class calls by target:

  • blocked_net_ids: NetIds that can never be acted on from this machine. Block always wins over the allowlist.
  • allowed_net_ids: if non-empty, execute-class calls are permitted only against these NetIds. Empty means any non-blocked target.

The two tools

  • GetPermissions(): show the current stance (mode plus both NetId lists). Callable in any mode.
  • SetPermissions(mode, allowedNetIds, blockNetIds): change the stance and persist it (creates the file on first use). Callable in any mode. Argument semantics:
    • mode: read | write | execute; empty leaves it unchanged.
    • allowedNetIds: comma-separated list that replaces the allowlist; empty leaves it unchanged; the literal none clears it (any non-blocked target allowed).
    • blockNetIds: comma-separated list appended to blocked_net_ids. This tool can never remove a blocked NetId; unblocking happens only by editing the file.

Failure stances (how the gate reads an odd file)

  • Missing file: permissive (execute, no NetId restrictions). The stance is opt-in.
  • Unparseable file: keep the last good settings rather than bricking the server or silently widening.
  • Valid file with an unrecognised mode value: fall to read (a present-but-typo'd mode signals an intent to restrict).
  • Valid file with the mode key absent: execute (unrestricted).

Read the full file on GitHub · 88 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2mo ago First seen · 88 lines · 160 tokens per session scan A 7580b01703d0

Subscribe to this mod's changes

tc-config is a skill published in the GitHub repository georgeturneruk/tckit (11 stars, last pushed 2mo ago), licensed MIT. It adds 160 tokens to every session and 1,623 once invoked, about $0.0006 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Hardware and IoTSecurity
Related

tc-config compared with skills from other repositories

tc-config next to 6 skills from other repositories
ModTypeStarsLast pushLicenceScanTokensWorks with
tc-configgeorgeturneruk/tckitSkill112mo agoMITA160Claude Code
gke-compute-classesgoogle/skillsSkill23ktodayApache-2.0A83Claude Code, Codex
jetson-diagnosticNVIDIA/skillsSkill3.9ktodayApache-2.0A30Claude Code, Codex
holoscan-install-wheelNVIDIA/skillsSkill3.9ktodayApache-2.0A34Claude Code, Codex
offensive-z-waveSnailSploit/Claude-RedSkill10k26d agoMITA113Claude Code, Codex
doca-socket-relayNVIDIA/skillsSkill3.9ktodayApache-2.0A236Claude Code, Codex
hsb-flashNVIDIA/skillsSkill3.9ktodayApache-2.0B94Claude Code