Getting it into your agent
This one installs as part of its plugin. Adding the marketplace and installing the plugin brings it with everything else the plugin ships.
/plugin marketplace add jasonm4130/claude-skills/plugin install nightshiftWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/jasonm4130/claude-skills/init)<a href="https://agentmods.dev/skills/jasonm4130/claude-skills/init"><img src="https://agentmods.dev/badge/skills/jasonm4130/claude-skills/init/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/jasonm4130/claude-skills/init"><img src="https://agentmods.dev/badge/skills/jasonm4130/claude-skills/init.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00180 | $0.01215 |
| Opus 5 | $0.00090 | $0.00607 |
| Sonnet 5 | $0.00036 | $0.00243 |
| Haiku 4.5 | $0.00018 | $0.00121 |
Grade A, and why
init scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 82 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Scaffold Nightshift into this repo
The loop is committed in the target repo, not in this plugin: it runs
claude -p --setting-sources project, where installed plugins never load, so
the hooks only bite when they live under the repo's own .claude/. This skill
copies them in, proves the copy, and leaves the switch off. Announce: "Using
nightshift:init to scaffold the overnight landing loop."
Scripts live under this skill's plugin directory: resolve ${CLAUDE_PLUGIN_ROOT}
(or this file's ../../scripts/) and call them with node.
1. Look before writing
git remote get-url originis a GitHub remote,gh auth statussucceeds.- Detect the stack the way
init.mjs --stack autodoes (Cargo.toml, package.json, pyproject.toml, go.mod, else generic) and say which verifier skeleton it gets. - An existing
loop/,scripts/check, or.claude/hooks/means this is not a first init: runnode <plugin>/scripts/init.mjs --checkand stop with its report instead. - Is there a plan to land? If the user names one, pass
--plan <path>; otherwise init scaffoldsdocs/plans/<today>-nightshift-smoke.mdwith one harmless task so the first night has something to do.
2. Scaffold
node <plugin>/scripts/init.mjs --stack <stack> [--plan <path>] [--base <branch>]
Say what it wrote (it prints the list): loop/*, .claude/hooks/*,
scripts/check (never overwritten if present), docs/developing/landing.md
or docs/nightshift.md, the smoke plan, and the merged .claude/settings.json.
Then read loop/config back to the user: MERGE_MODE (protected when the base
branch has required checks, else wait) and EXPECTED_CHECKS (gate only when a
gate CI job exists; otherwise empty, and a human must fill it with the check
names GitHub reports, which preflight lists). --deny-rules also adds
permissions.deny entries; the hooks already deny in every permission mode.
3. Prove it, in this order
scripts/checkfrom the repo root — last line must beCHECK OK. Edit the skeleton until it is (it is deliberately narrower than CI: fast, quiet).loop/land.sh --dry-run— reads the plan from the checkout, so the uncommitted scaffold is enough. ExpectSTOP: frozen(the switch is unset) or, withLANDING_STATE=runalready set,STOP: would run task 1: ….node --test .claude/hooks/*.test.mjs— the copied guard tests pass in situ.- Commit the scaffold on a branch, one commit, and tell the user to open the
PR:
loop/,.claude/hooks/,.claude/settings.json,scripts/check, the docs page, the plan. Stage paths explicitly. The user opens the PR; this skill never pushes to the base branch. node <plugin>/scripts/preflight.mjs— one line per check. Its plan check is expected to FAIL at this point (the plan is on the scaffold branch, not onorigin/<base>) and says "merge the PR that carries it". Everything else should beokorwarn; aFAILonprotectionorchecksis aloop/configedit to make now.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago Changed · +16 tokens per session 151b66363094
- 3d ago First seen · 82 lines · 164 tokens per session scan A fb93df91fa47
init is a skill published in the GitHub repository jasonm4130/claude-skills (5 stars, last pushed 2d ago), licensed MIT. It adds 180 tokens to every session and 1,215 once invoked, about $0.0009 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-05.
Other skills, from other repositories
catchup
Summarize and review what changed while you were away. Use after a weekend, vacation, or flight to check missed PRs, git commits, Linear tickets, and meetings — one prioritized brief, not a firehose.
plan
Plan features spanning multiple domains: billing (Stripe), auth (RBAC), real-time (Presence), webhooks, jobs (Oban). Use when designing interconnected systems or converting review findings into tasks.
work
Execute Elixir/Phoenix plan tasks with progress tracking. Use after /phx:plan to implement features with mix compile and mix test verification after each step, or --continue to resume interrupted work.
phx-deps-update
Bump outdated Hex deps — inventory, snapshot changelogs, update, fix breaks, split reviewable PRs (patches bundled, majors solo). Use to upgrade/bump Elixir dependencies or when versions fall behind. NOT for deps.get failures (phx-investigate).
customer-success-management
Runs the ongoing relationship with accounts after the sale — segmenting coverage against account value, building a health score that predicts rather than describes, running reviews customers find worth attending, forecasting renewals honestly, and finding expansion that follows usage instead of quota. Use this to…
chief-information-officer
The CIO's remit — running the technology the company works on, service quality, IT spend, and the boundary with product engineering. Use this to set IT priorities, decide what IT owns versus engineering, structure IT spend or an IT roadmap, judge whether to build, buy or outsource, or work out why IT is seen as a cost…