Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add l3a0/claude-plugins --skill kindle-highlightsgit clone --depth 1 https://github.com/l3a0/claude-pluginsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/l3a0/claude-plugins/kindle-highlights)<a href="https://agentmods.dev/skills/l3a0/claude-plugins/kindle-highlights"><img src="https://agentmods.dev/badge/skills/l3a0/claude-plugins/kindle-highlights.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00081 | $0.05150 |
| Opus 5 | $0.00041 | $0.02575 |
| Sonnet 5 | $0.00016 | $0.01030 |
| Haiku 4.5 | $0.00008 | $0.00515 |
Grade B, and why
kindle-highlights scanned grade B with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Sends data to an external URLmediumData exfiltration
A POST to an outside endpoint may be telemetry or may be exfiltration; either way the mod talks to somewhere, and you should know where.
and `fetch('http://127.0.0.1:8931/json?name=…', {method:'POST', body: window.__x})` — the Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
- **Capture without screenshots:** `fetch(blobUrl)` fails (CSP), but `drawImage` of the loaded How it starts
The opening of the file, as written. The whole thing — 288 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Kindle highlights → Markdown
Extract every highlight for a book from read.amazon.com/notebook into one combined,
verbatim, location-cited Markdown file. Most highlights come straight from the page
DOM; the rest are truncated or entirely hidden by Amazon's clipping/export limit ("Some
highlights have been hidden or truncated due to export limits") and must be recovered.
Derived from four real runs: Trade Your Way to Financial Freedom (466 highlights, 41 truncated — recovered one-by-one from screenshots), Trading and Exchanges (1,211 highlights, 283 truncated + 180 fully hidden — recovered in bulk via the Mac app's position database + page OCR), Inside the Black Box (520 highlights, 73 truncated + 181 hidden — recovered via the overlay-geometry variant, median residual 0–1 char), and Quantitative Trading (235 highlights, 57 truncated + 0 hidden — recovered via cluster-jumps + prefix-anchored cuts, 44/57 at residual 0, rest ±2). Trust the gotchas below — each one cost real debugging.
The one prerequisite that unblocks everything
Driving the page needs JavaScript execution in the tab — any browser-control MCP that can
run JS in the user's real, logged-in Chrome works. The verified reference is the
Control Chrome MCP (Anthropic's Claude Desktop extension: Settings → Extensions →
"Control Chrome"; tools appear as Control_Chrome.*), which runs JS via AppleScript and
requires Chrome's "Allow JavaScript from Apple Events" to be ON:
Chrome menu bar → View → Developer → Allow JavaScript from Apple Events → check it → confirm the warning → quit & relaunch Chrome.
- Symptom when OFF:
Control_Chrome.execute_javascriptreturns"Google Chrome is not running". - The Claude-in-Chrome extension's
javascript_tool/computer(click/screenshot) may fail withCannot access a chrome-extension:// URL of different extensionwhen another browser-control extension contends for the debugger. Itsread_page/find/navigatestill work, butread_pagecaps each text node at ~100 chars — useless for full highlight text. Use the Control_Chrome JS scrape instead. - Screen-control of the browser may be read-only tier and the Kindle desktop app screen may be blocked entirely — but neither matters much anymore: captures come from the page's own canvas (below), and the desktop app is used only via its files on disk, which needs no screen access.
- Shared Chrome hazard: if another session is driving the same Chrome, open your own tab — and for the reader (which only renders while visible), your own window (see Step 5).
What ships with it
5 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 288 lines · 81 tokens per session scan B 9be446408403
kindle-highlights is a skill published in the GitHub repository l3a0/claude-plugins (19 stars, last pushed yesterday), licensed MIT. It adds 81 tokens to every session and 5,150 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it B with 2 findings (sends data to an external url, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
learning-and-development
Builds capability — skills gaps, career frameworks, training that transfers to the job, and internal mobility. Use this to design a career ladder, close a capability gap, decide whether to build or hire a skill, structure onboarding into a role, or work out why training keeps failing to change anything.
diagnose
A short question-based assessment of a pilot's current skill level. It produces a profile and saves it in the connected browser or database.
lesson-close
A workflow for finishing the day's lesson file, recording its status and duration, then saving it to the personal-guide GitHub repository.
personal-guide-render
Instructions for understanding the status of a personal guide that the platform builds automatically from stored user data. The platform creates daily lessons and rebuilds the full guide weekly on its servers.
learn
Use when user wants to learn a topic or create a study plan. Triggers on "teach me", "I want to learn", "explain X to me", "study", "help me understand", "where do I start with", "how do I get into", or any request to understand a subject in depth. Covers both technical topics (programming, system design, DevOps) and…
quiz
Use when user wants to be tested or quizzed on any topic. Triggers on "quiz me", "test me", "test my knowledge", "practice questions", "check my understanding", or when asking for a quiz on something they've been learning. Also use when user finishes a learning module and wants to check understanding. Works with or…