Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/kevinzai/commander/ccc-infranpx skills add KevinZai/commander --skill ccc-infragit clone --depth 1 https://github.com/KevinZai/commanderWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/kevinzai/commander/ccc-infra)<a href="https://agentmods.dev/skills/kevinzai/commander/ccc-infra"><img src="https://agentmods.dev/badge/skills/kevinzai/commander/ccc-infra.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00044 | $0.01260 |
| Opus 5 | $0.00022 | $0.00630 |
| Sonnet 5 | $0.00009 | $0.00252 |
| Haiku 4.5 | $0.00004 | $0.00126 |
Grade B, and why
ccc-infra scanned grade B with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Reads agent configuration directoriesmediumAgent snooping
.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.
test -f ~/.claude/commander/services.json && cat ~/.claude/commander/services.json || echo "no services.json — using Claude/Codex defaults" Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
For each entry in `services.json` (if present), probe its `url` (2-second timeout `curl`) or check its `port` is listening (`lsof -iTCP:<port> -sTCP:LISTEN` or equivalent). Never probe a port or process not listed in the How it starts
The opening of the file, as written. The whole thing — 110 lines — stays where its author put it; the contents beside it link to each section on GitHub.
$ccc-infra — Dev services status
Scope: this plugin is Claude Code + Codex CLI only. This skill never probes Kevin's (or anyone's) private infrastructure — it reads an OPTIONAL
~/.claude/commander/services.jsonthe user maintains for their own project, plus a small set of Claude/Codex-relevant local checks. If a user wants their own private stack probed, they add it toservices.jsonthemselves; this skill ships with zero hardcoded ports or process names for any specific person's setup.
Probe the services this project actually declares, plus Claude/Codex tooling health, and recommend next actions. Menu sourced from references/infrastructure.json.
Config format (optional)
~/.claude/commander/services.json — created by the user, never assumed:
{
"services": [
{ "name": "API", "url": "http://localhost:3000/health" },
{ "name": "Worker", "port": 8080 }
]
}
If the file doesn't exist, skip straight to the Claude/Codex checks below — do not invent service names or ports.
Quick Mode (default)
test -f ~/.claude/commander/services.json && cat ~/.claude/commander/services.json || echo "no services.json — using Claude/Codex defaults"
claude mcp list 2>/dev/null || echo "claude mcp: not available"
command -v codex >/dev/null 2>&1 && codex --version 2>/dev/null || echo "codex: not installed"
For each entry in services.json (if present), probe its url (2-second timeout curl) or check its port is listening (lsof -iTCP:<port> -sTCP:LISTEN or equivalent). Never probe a port or process not listed in the user's own config.
Show a compact status table, then offer 3 actions via AskUserQuestion:
- "View full status (Power Mode)"
- "Help me set up services.json"
- "Back to main menu"
Power Mode
Full status pass. Activate by passing --power or full as argument.
Step 1 — Probe declared + Claude/Codex services
# User-declared project services (from services.json), each with a short timeout
# curl -s --max-time 2 "$URL" && echo "$NAME:ok" || echo "$NAME:down"
# Claude/Codex tooling (always safe to check — no private infra assumed)
claude mcp list 2>/dev/null
command -v codex >/dev/null 2>&1 && codex --version 2>/dev/null || echo "codex: not installed"
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 110 lines · 44 tokens per session scan B 04ec81eeda00
ccc-infra is a skill published in the GitHub repository KevinZai/commander (6 stars, last pushed yesterday), licensed MIT. It adds 44 tokens to every session and 1,260 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it B with 2 findings (reads agent configuration directories, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
claude-code-session-broker
Use when running Arcgentic V2 in Claude Code and fixed Planner, Developer, and Auditor role sessions must be coordinated through a broker.
arcgentic
Use when the user says Arcgentic, asks to use Arcgentic, or wants an idea taken through a complete plan → development → self-audit → external audit workflow in Codex.
verify-gates
Runs the mechanical quality gates that the arcgentic state machine requires for state transitions. Invoked indirectly by transition.sh OR directly by orchestrator agent before declaring a state transition. Use when about to call transition.sh OR when manually verifying that a round artifact meets the gate criteria.…
cross-session-handoff
Read, write, snapshot, and lock .arcgentic/state.yaml across planner, dev, audit, and optional test sessions.
agency-roster
Use when a round references agency-agents catalogs, role-family routing, multi-agent identity prompts, or English/Chinese specialist role catalogs.
hook-template
Generate hook script from template. Use when adding a new hook, wiring a PreToolUse/PostToolUse/Stop/Notification hook, or scaffolding hook config for settings.json.