Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/ghostwright/phantom/show-my-toolsnpx skills add ghostwright/phantom --skill show-my-toolsgit clone --depth 1 https://github.com/ghostwright/phantomWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00041 | $0.01395 |
| Opus 5 | $0.00020 | $0.00698 |
| Sonnet 5 | $0.00008 | $0.00279 |
| Haiku 4.5 | $0.00004 | $0.00139 |
Grade C, and why
show-my-tools scanned grade C with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Reads agent configuration directoriesmediumAgent snooping
.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.
Use Glob to find every `.md` file directly under `/home/phantom/.claude/` (depth up to 3), excluding the `skills/` subtree and the `plugins/` and `agents/` subtrees. Do not read their content; just list the paths and siz Enumerates other installed skillsmediumAgent snooping
Other skills' SKILL.md files reveal prompts, capabilities and secrets that should be invisible to peers.
Use Glob to find every `SKILL.md` file under `/home/phantom/.claude/skills/`. For each hit, Read the file and extract the YAML frontmatter's `name` and `description`. How it starts
The opening of the file, as written. The whole thing — 108 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Show my tools
Goal
Give the user a clear, accurate view of what is currently loaded: skills, memory files, and dashboard URLs. Honest about what is on disk, not a marketing list.
Steps
1. List skills
Use Glob to find every SKILL.md file under /home/phantom/.claude/skills/. For each hit, Read the file and extract the YAML frontmatter's name and description.
Success criteria: you have a list of (name, description) pairs for every SKILL.md on disk.
2. List memory files
Use Glob to find every .md file directly under /home/phantom/.claude/ (depth up to 3), excluding the skills/ subtree and the plugins/ and agents/ subtrees. Do not read their content; just list the paths and sizes.
Success criteria: you have a list of memory file paths with sizes.
2.5 List plugins
Use Read to open /home/phantom/.claude/settings.json. Parse it as JSON. If there is no enabledPlugins field, skip this section. Otherwise, for each key: value in enabledPlugins where the value is truthy (true, an object, or a non-empty array), record the plugin-id@marketplace-id and a short fallback description.
Success criteria: you have a list of currently active plugin keys, or you know the list is empty.
2.6 List hooks
Use Read to open /home/phantom/.claude/settings.json. Parse it as JSON. If there is no hooks field, record the count as 0. Otherwise, for each event name in hooks, count the total number of hook definitions across all matcher groups for that event. Report the per-event counts and the grand total.
Success criteria: you have a number like "4 hooks across PreToolUse (2), PostToolUse (1), UserPromptSubmit (1)", or you know the list is empty.
2.7 List subagents
Use Glob to find every *.md file directly under /home/phantom/.claude/agents/. For each, Read the file and extract the YAML frontmatter's name and description.
Success criteria: you have a list of (name, description) pairs, or you know the list is empty.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 108 lines · 41 tokens per session scan C 0ea164122d1e
show-my-tools is a skill published in the GitHub repository ghostwright/phantom (1,464 stars, last pushed 2mo ago), licensed Apache-2.0. It adds 41 tokens to every session and 1,395 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it C with 2 findings (reads agent configuration directories, enumerates other installed skills). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
writing-skills
Use when a task reveals a recurring, multi-step capability worth saving for future sessions — writing a new Norma skill, or improving an existing self-authored one, via skillwrite.
tool-prompt-optimization
Optimize the description prompts an AI agent reads to learn its built-in tools (the .md files under prompts/tools/). Two halves: (1) measure how much of a prompt is already inferable from the tool's JSON parameter schema + name, to prune redundancy with evidence; (2) house authoring rules for what belongs in a tool…
semantic-compression
Re-encode verbose prose into a dense telegraphic register — punctuation as connectives, label frames, verbless assertions — without losing normativity or precision. Use when compressing system prompts, tool/function descriptions, skill bodies, or agent instructions; reducing token count or context bloat; making…
hive.worker-delegation
Concrete patterns for breaking colony work into parallel worker jobs via runplaybook — when fan-out helps, how to model the goal as a tracker table, write the worker skill, author the playbook, pilot, and let convergence retry/resume the gap.
a2a-gateway
Agent-to-Agent (A2A) protocol gateway reference. JSON-RPC 2.0 peer-to-peer agent communication. (/a2a-gateway, a2a, agent protocol).
compare-harnesses
Diff two scaffolded harnesses (ADR-031). Reports manifest meta drift + host list + per-file fingerprint changes (added/removed/changed). Exits 0 IDENTICAL, 1 DRIFT, 2 missing manifest. Use --bundle for the ADR-031 schema-1 JSON envelope.