Borrowing it
Nothing to install: this file belongs to kangraemin/claude-inspector. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/kangraemin/claude-inspector/main/.claude/skills/deploy/SKILL.mdgit clone --depth 1 https://github.com/kangraemin/claude-inspectorWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/kangraemin/claude-inspector/deploy)<a href="https://agentmods.dev/skills/kangraemin/claude-inspector/deploy"><img src="https://agentmods.dev/badge/skills/kangraemin/claude-inspector/deploy.svg" alt="Measured on agentmods" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 2 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Privilege Escalation · line 37 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- high Privilege Escalation · line 123 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00076 | $0.01150 |
| Opus 5 | $0.00038 | $0.00575 |
| Sonnet 5 | $0.00015 | $0.00230 |
| Haiku 4.5 | $0.00008 | $0.00115 |
Grade A, and why
deploy scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 126 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Claude Inspector 배포
전제조건
.env파일에APPLE_ID,APPLE_APP_SPECIFIC_PASSWORD,APPLE_TEAM_ID설정ghCLI 로그인 상태 (gh auth status)- 미커밋 변경사항 없음
Step 1: 버전 확인
node -e "console.log(require('./package.json').version)"
사용자가 버전을 지정했으면 package.json의 version 필드를 해당 버전으로 수정 후 커밋+푸시:
git add package.json
git commit -m "chore: 버전 X.X.X로 설정"
git push
Step 2: 빌드 (코드사이닝 + 공증 포함)
⚠️ npm run dist:mac은 predist lifecycle hook을 트리거하지 않는다.
predist를 먼저 수동 실행해서 public/build-info.json에 올바른 버전이 박히도록 해야 한다.
source .env && npm run predist && npm run dist:mac
predist:public/build-info.json에 현재 package.json 버전 + git hash 기록dist:mac: arm64 + x64 DMG 빌드 + 코드사이닝afterSign훅(scripts/notarize.js): Apple 공증 자동 처리
완료까지 5~10분 소요. 중간에 Apple 서버 응답 대기 포함.
빌드 완료 후 파일 및 버전 확인:
ls release/Claude-Inspector-{VERSION}-*.dmg
cat public/build-info.json # version이 배포 버전과 일치하는지 반드시 확인
기대 결과: Claude-Inspector-X.X.X-arm64.dmg, Claude-Inspector-X.X.X-x64.dmg 2개, build-info.json의 version이 X.X.X
Step 3: SHA256 계산
shasum -a 256 "release/Claude-Inspector-{VERSION}-arm64.dmg"
shasum -a 256 "release/Claude-Inspector-{VERSION}-x64.dmg"
두 값을 메모해둔다.
Step 4: GitHub Release 생성 + DMG 업로드
gh release create v{VERSION} \
"release/Claude-Inspector-{VERSION}-arm64.dmg" \
"release/Claude-Inspector-{VERSION}-x64.dmg" \
--title "v{VERSION}" \
--notes "## 변경사항\n- 업데이트 내용"
--notes는 실제 변경사항으로 채운다. git log로 이전 태그 이후 커밋 확인:
git log $(git describe --tags --abbrev=0 2>/dev/null || echo "")..HEAD --oneline 2>/dev/null || git log --oneline -10
Step 5: Homebrew cask 업데이트
프로젝트 내 cask 파일과 실제 tap 디렉토리 둘 다 수정한다.
5-1. 프로젝트 내 cask 수정
homebrew-tap/Casks/claude-inspector.rb 에서:
version "X.X.X"→ 새 버전on_arm블록의sha256→ arm64 SHA256on_intel블록의sha256→ x64 SHA256
5-2. 실제 tap 디렉토리에 복사
HOMEBREW_TAP="$(brew --repository)/Library/Taps/kangraemin/homebrew-tap"
cp homebrew-tap/Casks/claude-inspector.rb "$HOMEBREW_TAP/Casks/claude-inspector.rb"
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 126 lines · 76 tokens per session scan A 60ba1126bf53
deploy is a skill published in the GitHub repository kangraemin/claude-inspector (131 stars, last pushed 7d ago), licensed MIT. It adds 76 tokens to every session and 1,150 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
debug-systematic
Systematic 4-phase debugging methodology for complex, intermittent, or mysterious issues. Use when investigating bugs, race conditions, or unexplained failures.
troubleshoot-worktree
Troubleshoot git worktree, branch, and refname issues.
agent-merge-conflict-arbiter
Neutral arbiter for merge conflicts between two agents.
git-advanced-workflows
Master advanced Git workflows including rebasing, cherry-picking, bisect, worktrees, and reflog to maintain clean history and recover from any situation. Use when managing complex Git histories, collaborating on feature branches, or troubleshooting repository issues.
thinking-five-whys-plus
When a fault is localized and the proximate cause is known but the systemic root is not, chain evidence-linked whys with a counterfactual stop and a countermeasure.
thinking-scientific-method
When a symptom has several plausible causes, rank falsifiable hypotheses and run the cheapest discriminating observation first; prefer least-assumptive survivors only after evidence fit.