Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/ggombee/code-forge/setup-channelsnpx skills add ggombee/code-forge --skill setup-channelsgit clone --depth 1 https://github.com/ggombee/code-forgeWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00050 | $0.02066 |
| Opus 5 | $0.00025 | $0.01033 |
| Sonnet 5 | $0.00010 | $0.00413 |
| Haiku 4.5 | $0.00005 | $0.00207 |
Grade D, and why
setup-channels scanned grade D with 3 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks for rootmediumPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
chmod 600 ~/.claude/channels/telegram.env Reads agent configuration directoriesmediumAgent snooping
.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.
cat > ~/.claude/channels/telegram.env <<EOF Recursive force deletehighDestructive command
rm -rf with a variable or a broad path is one typo away from removing the wrong tree.
- `allowedCommands`에 위험 명령(`--no-verify`, `rm -rf`) 금지 How it starts
The opening of the file, as written. The whole thing — 256 lines — stays where its author put it; the contents beside it link to each section on GitHub.
/setup-channels
Claude Channels를 통해 텔레그램/디스코드에서 Claude Code 세션에 원격 접근합니다.
폰에서 메시지만으로 /start, /test 같은 명령을 실행할 수 있고,
--auto 플래그와 결합하면 블로킹 없이 자동 완료됩니다.
[즉시 실행] 아래 흐름을 바로 시작하세요.
사용법
/setup-channels → AskUserQuestion으로 플랫폼 선택
/setup-channels telegram → 텔레그램 직행
/setup-channels discord → 디스코드 직행
/setup-channels --status → 현재 연결 상태 확인
/setup-channels --uninstall → 연결 제거
Step 1: 플랫폼 선택
$ARGUMENTS에 telegram/discord가 포함되면 Step 2로. 아니면 AskUserQuestion으로 질문:
AskUserQuestion({
questions: [{
question: "어떤 채널을 연결할까요?",
header: "채널 플랫폼",
options: [
{ label: "Telegram", description: "BotFather로 봇 생성 → 다이렉트 메시지로 명령 실행" },
{ label: "Discord", description: "Discord Developer Portal로 봇 생성 → 서버/DM으로 명령 실행" },
{ label: "둘 다", description: "순차적으로 둘 다 셋업" }
],
multiSelect: false
}]
})
Step 2: 전제 조건 확인
# Claude Code 버전 (Channels는 v2.1.80+ 필요)
claude --version
# Channels 플러그인 설치 여부
claude plugin list | grep -i channel
미설치면 마켓플레이스에서 설치:
claude plugin install claude-channels # 이름은 실제 배포명에 맞춰 확인
Step 3-A: Telegram 셋업
3A-1. 봇 토큰 발급 안내
사용자에게 다음을 안내:
1. 텔레그램에서 @BotFather 찾기
2. /newbot 명령 입력
3. 봇 이름 지정 (예: "ggombee-forge-bot")
4. 봇 유저네임 지정 (예: "ggombee_forge_bot" — _bot으로 끝나야 함)
5. 받은 API 토큰(형식: 123456789:ABC-DEF...) 복사
AskUserQuestion으로 토큰 입력 요청:
AskUserQuestion({
questions: [{
question: "BotFather에서 받은 토큰을 붙여넣어주세요",
header: "Telegram Bot Token",
options: [
{ label: "직접 입력", description: "토큰을 다음 입력에 붙여넣기 (123456789:ABC...)" },
{ label: "취소", description: "셋업 중단" }
],
multiSelect: false
}]
})
3A-2. 토큰 저장
# ~/.claude/channels/telegram.env 에 저장 (권한 600)
mkdir -p ~/.claude/channels
cat > ~/.claude/channels/telegram.env <<EOF
TELEGRAM_BOT_TOKEN=$TOKEN
TELEGRAM_AUTHORIZED_USER= # 채팅에서 /whoami 후 채워넣기
EOF
chmod 600 ~/.claude/channels/telegram.env
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 256 lines · 50 tokens per session scan D 8648999a7eb9
setup-channels is a skill published in the GitHub repository ggombee/code-forge (13 stars, last pushed 2mo ago), licensed MIT. It adds 50 tokens to every session and 2,066 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it D with 3 findings (asks for root, reads agent configuration directories, recursive force delete). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
systematic-debugging
Use when encountering any bug, test failure, or unexpected behavior, before proposing fixes.
next-cache-components-adoption
Turn on Cache Components in a Next.js app and resolve the blocking routes it surfaces. Use when the user wants to enable, adopt, or migrate to Cache Components, flip the cacheComponents flag, work through a flood of blocking-prerender / instant validation errors, run the cache-components-instant-false codemod, or…
babysit-pr
Babysit a GitHub pull request after creation by continuously polling review comments, CI checks/workflow runs, and mergeability state until the PR is merged/closed or user help is required. Diagnose failures, retry likely flaky failures up to 3 times, auto-fix/push branch-related issues when appropriate, and keep…
imagegen
Generate or edit raster images when the task benefits from AI-created bitmap visuals such as photos, illustrations, textures, sprites, mockups, or transparent-background cutouts. Use when Codex should create a brand-new image, transform an existing image, or derive visual variants from references, and the output…
cpu-profile-analysis
Analyze V8/Chrome CPU profiles (.cpuprofile) and DevTools trace files (Trace-.json). Use when: profiling performance, investigating slow functions, comparing code paths, finding bottlenecks, analyzing timeToRequest, understanding call trees from sampling profiler data, analyzing layout/paint/rendering, investigating…
next-cache-components-optimizer
Drive a Next.js route to instant navigation by setting up an agentic loop, under Cache Components / PPR, on initial load (hard navigation) and client-side navigation (soft navigation). Encode the goal as a failing @next/playwright instant() e2e and work it to green, one verified route at a time; the shipped test then…