Getting it into your agent
This one installs as part of its plugin. Adding the marketplace and installing the plugin brings it with everything else the plugin ships.
/plugin marketplace add gtapps/claude-code-hermit/plugin install claude-code-hermitWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/gtapps/claude-code-hermit/hermit-doctor)<a href="https://agentmods.dev/skills/gtapps/claude-code-hermit/hermit-doctor"><img src="https://agentmods.dev/badge/skills/gtapps/claude-code-hermit/hermit-doctor.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00092 | $0.01807 |
| Opus 5 | $0.00046 | $0.00903 |
| Sonnet 5 | $0.00018 | $0.00361 |
| Haiku 4.5 | $0.00009 | $0.00181 |
Grade B, and why
hermit-doctor scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Reads agent configuration directoriesmediumAgent snooping
.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.
`autoMode.environment` entry naming it, added to `~/.claude/settings.json` from the terminal. How it starts
The opening of the file, as written. The whole thing — 129 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Hermit Doctor
Runs read-only health checks against the current hermit install (channel-liveness
is the only one that performs outbound API calls — see Notes) and surfaces the summary. Safe
to run at any time. Produces no side effects beyond writing
.claude-code-hermit/state/doctor-report.json and .claude-code-hermit/state/doctor-alerts.json,
and appending a summary block to SHELL.md.
Notification route
A finding gets one notification per unresolved episode: the check script records it, you send it
once, and it stays silent until it resolves. A send that never reached the operator is re-offered
on the next run rather than counted as delivered.
Every run sends the same two-leg notice and channel-send.ts resolves each leg against this
install's own config: the maintainer leg reaches the configured maintainer_channel_id, else the
primary chat on a technical profile (the client leg is dropped there, since both landed in one
chat), else SHELL.md Findings on a non-technical one. A configured maintainer destination that
is unreachable fails closed to Findings and never spills into the primary chat.
--maintainer is accepted and ignored (routine strings may still pass it): audience is decided by
the row's own tier and the operator's config, not by the flag.
Steps
-
Run the check script:
bun ${CLAUDE_PLUGIN_ROOT}/scripts/doctor-check.ts .claude-code-hermitThe script writes
.claude-code-hermit/state/doctor-report.jsonand prints the same JSON to stdout. It exits 0 unconditionally — on any internal failure the failing check reportsstatus: "fail"in its own entry rather than crashing the report. -
Parse the JSON. For each check in the report (one entry per id), emit one line using this format:
✓ <id> — <detail>whenstatus: ok⚠ <id> — <detail>whenstatus: warn✗ <id> — <detail>whenstatus: fail
-
Append a summary section to
.claude-code-hermit/sessions/SHELL.mdunder a new## Doctor Report (<ts>)heading. Use the same per-check lines from step 2. Place it above the## Monitoringsection so it sits with session-level context, not with monitoring chatter.
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago Changed scan A → B 1bfdba6340b6
- 4d ago Changed · -31 lines · -61 tokens per session 04d7eadc4f50
- 5d ago Changed · +1 lines · +3 tokens per session ada27bfbcd3f
- 8d ago First seen · 159 lines · 150 tokens per session scan A 4c28ece8ec92
hermit-doctor is a skill published in the GitHub repository gtapps/claude-code-hermit (74 stars, last pushed today), licensed MIT. It adds 92 tokens to every session and 1,807 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it B with 1 finding (reads agent configuration directories). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
issue-debugging
Systematic methodology for issue debugging including root cause analysis, impact mapping, tiered validation plans, and confidence assessment. Use when analyzing bugs, fixing issues, or validating fixes.
fix-bug
Run the Fix Validation pipeline to investigate, fix, and validate a bug. Ensures deterministic pipeline execution with IssueAnalyzer, FixWriter, TestWriter (conditional), TestAudit (conditional), and FixValidator stages.
ccc-systematic-debugging
Root-cause debugging via the Iron Law: no fix without confirmed root cause. Reproduce → hypothesize → verify → fix. Use when investigating bugs, test failures, or…
debug
Analyze errors and apply fixes. Use when you have an error message, traceback, or failing log to diagnose.
show-me-proof
A skill for collecting concrete proof that a coding task was completed, such as changed files, test commands, logs, and remaining risks.
perf-code-paths
Use when mapping code paths, entrypoints, and likely hot files before profiling.