What is cartog-install?

A setup command for installing or updating the Cartog command-line program to the version required by the add-on.

Checking the installed Cartog version, installing the required version, upgrading it, and retrying setup when the program is unavailable.

It fixes missing or incompatible Cartog installations that can prevent the related service from starting.

cartog-install — Skill for Claude Code by jrollin

Install

Getting it into your agent

This one installs as part of its plugin. Adding the marketplace and installing the plugin brings it with everything else the plugin ships.

Claude Code

/plugin marketplace add jrollin/cartog

Claude Code

/plugin install cartog

Made for: Claude Code.

Or install cartog, the plugin that ships this one along with the rest of its 2 skills, 2 agents.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/jrollin/cartog/cartog-install/github.svg)](https://agentmods.dev/skills/jrollin/cartog/cartog-install)

Your own site

<a href="https://agentmods.dev/skills/jrollin/cartog/cartog-install"><img src="https://agentmods.dev/badge/skills/jrollin/cartog/cartog-install/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/skills/jrollin/cartog/cartog-install"><img src="https://agentmods.dev/badge/skills/jrollin/cartog/cartog-install.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 70 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 1,397 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00070	$0.01397
Opus 5	$0.00035	$0.00698
Sonnet 5	$0.00014	$0.00279
Haiku 4.5	$0.00007	$0.00140

Measured 9d ago against content hash 139a5b7f0315, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-09, from the pricing page.

Security

Grade A, and why

cartog-install scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

skills/cartog-install/SKILL.md · 122 lines

How it starts

The opening of the file, as written. The whole thing — 122 lines — stays where its author put it; the contents beside it link to each section on GitHub.

/cartog-install — Install or upgrade the cartog binary

The plugin pins a specific cartog binary version. This skill installs that version, or upgrades an existing install to match.

PLUGIN_VERSION=0.33.0

scripts/release.sh bumps the PLUGIN_VERSION= line above at release time; the rest of this file references that value as $PLUGIN_VERSION and the agent must substitute it from the line above before running any command. The literal string $PLUGIN_VERSION is NOT a shell variable in your Bash environment — it is a token you replace.

What to do

Probe the current state, then run the matching path. Surface every step's output to the user — they typed this verb because they want to see what happens.

1. Probe `cartog --version`

Run cartog --version via Bash. Capture exit code and version string.

2. If the binary is missing or returns a non-zero exit

Run the bundled installer, substituting $PLUGIN_VERSION with the version from the PLUGIN_VERSION= line at the top of this file:

bash "${CLAUDE_PLUGIN_ROOT}/skills/cartog/scripts/install.sh" $PLUGIN_VERSION

After install:

Run hash -r so the shell forgets cached lookups.
Run cartog --version to confirm the install matches $PLUGIN_VERSION.
If cartog --version still fails, check whether the install directory (printed by install.sh) is on the user's PATH. If not, tell the user the exact export PATH="<dir>:$PATH" line to add to their shell rc.

Tell the user to restart Claude Code so the MCP server picks up the new binary. The cartog MCP server can't reconnect mid-session.

3. If the binary is present and `< 0.14.0`

Pre-0.14.0 binaries don't have cartog self update. Use the same bundled installer with the pinned version (substitute $PLUGIN_VERSION from the top):

bash "${CLAUDE_PLUGIN_ROOT}/skills/cartog/scripts/install.sh" $PLUGIN_VERSION

Then verify and tell the user to restart Claude Code (same as step 2).

4. If the binary is present, `>= 0.14.0`, and lacks `--apply-pending`

Read the full file on GitHub · 122 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

9d ago First seen · 122 lines · 70 tokens per session scan A 139a5b7f0315

Subscribe to this mod's changes

cartog-install is a skill published in the GitHub repository jrollin/cartog (17 stars, last pushed today), licensed MIT. It adds 70 tokens to every session and 1,397 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Rust claude lsp-server rlm skills token

actionbook-web-test

Run browser-based web tests against websites using Actionbook CLI. Activate when the user wants to test a website workflow, run smoke tests, verify a user flow, check if a web application works, run regression tests, or validate browser-based interactions. Supports test definition, execution, assertion, reporting, and…

actionbook/actionbook · 71 tokens

active-research

Deep research and analysis tool. Generates comprehensive HTML reports on any topic, domain, paper, or technology. Enhanced with advanced browser automation — SPA handling, network idle wait, batch operations, stealth browsing, and intelligent page analysis. Use when user asks to research, analyze, investigate…

actionbook/actionbook · 72 tokens

deep-research

Deep research and analysis tool. Generates comprehensive HTML reports on any topic, domain, paper, or technology. Use when user asks to research, analyze, investigate, deep-dive, or generate a report on any subject. Supports academic papers (arXiv), technologies, trends, comparisons, and general topics.

actionbook/actionbook · 66 tokens

actionbook-scraper

Generate and verify web scraper scripts using Actionbook's verified selectors. Auto-validates generated scripts and fixes errors.

actionbook/actionbook · 28 tokens

article-exporter

Export any web article to a local Obsidian-ready Markdown directory. Fetches page content via actionbook CLI, downloads images locally, rewrites image references to relative paths, and optionally translates the article using AI. Produces a self-contained folder with README.md, images/, and an index.md navigation file.