Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/laurigates/claude-plugins/configure-web-sessionnpx skills add laurigates/claude-plugins --skill configure-web-sessiongit clone --depth 1 https://github.com/laurigates/claude-pluginsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/laurigates/claude-plugins/configure-web-session)<a href="https://agentmods.dev/skills/laurigates/claude-plugins/configure-web-session"><img src="https://agentmods.dev/badge/skills/laurigates/claude-plugins/configure-web-session.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00039 | $0.03245 |
| Opus 5 | $0.00019 | $0.01622 |
| Sonnet 5 | $0.00008 | $0.00649 |
| Haiku 4.5 | $0.00004 | $0.00325 |
Grade D, and why
configure-web-session scanned grade D with 3 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks for rootmediumPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
3. **Install to `~/.local/bin`** — writable without sudo regardless of whether the session runs as root. Ensure this directory is on the PATH that *agent subshells* inherit: add it to a `path-bootstrap.sh` SessionStart h Reads agent configuration directoriesmediumAgent snooping
.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.
- Settings hooks: !`find . -maxdepth 3 -name 'settings.json' -path '*/.claude/*'` Recursive force deletehighDestructive command
rm -rf with a variable or a broad path is one typo away from removing the wrong tree.
rm -rf "$tmp_dir" How it starts
The opening of the file, as written. The whole thing — 246 lines — stays where its author put it; the contents beside it link to each section on GitHub.
/configure:web-session
Check and configure a SessionStart hook that installs missing tools when
Claude Code runs on the web.
When to Use This Skill
| Use this skill when... | Use another approach when... |
|---|---|
| Pre-commit hooks fail in remote sessions (tool not found) | Project has no infrastructure tooling (plain npm/pip is enough) |
just recipes fail because just, helm, terraform, or similar are absent |
Tools are already available in the base image (check with check-tools) |
| Setting up a new repo for unattended Claude Code on the web tasks | Only need to set env vars — use environment variables in the web UI instead |
Auditing whether scripts/install_pkgs.sh is current and idempotent |
Debugging a specific hook failure — fix the hook itself first |
| Re-auditing already-onboarded repos for spec drift after the spec changed | The repo was never onboarded — run the full setup instead |
| Onboarding a repo to Claude Code on the web for the first time | Project uses only standard language runtimes (python, node, go, rust) |
Context
- Install script: !
find . -name 'install_pkgs.sh' -path '*/scripts/*' - Settings hooks: !
find . -maxdepth 3 -name 'settings.json' -path '*/.claude/*' - Pre-commit config: !
find . -maxdepth 1 -name '.pre-commit-config.yaml' - Justfile: !
find . -maxdepth 1 \( -name 'justfile' -o -name 'Justfile' \) - Has helm charts: !
find . -maxdepth 3 -name 'Chart.yaml' -print -quit - Has terraform: !
find . -maxdepth 3 \( -name '*.tf' -o -type d -name 'terraform' \) -print -quit
Parameters
Parse from $ARGUMENTS:
--check-only: Report current state without creating or modifying files--fix: Apply all changes automatically without prompting--tools <list>: Comma-separated list of tool names to install (overrides auto-detection)- Supported:
helm,terraform,tflint,actionlint,helm-docs,gitleaks,just,pre-commit
- Supported:
Execution
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- today First seen · 246 lines · 39 tokens per session scan D ec9ce8ef8f84
configure-web-session is a skill published in the GitHub repository laurigates/claude-plugins (57 stars, last pushed yesterday), licensed MIT. It adds 39 tokens to every session and 3,245 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it D with 3 findings (asks for root, reads agent configuration directories, recursive force delete). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
healthcheck
Host security hardening and risk-tolerance configuration for OpenClaw deployments. Use when a user asks for security audits, firewall/SSH/update hardening, risk posture, exposure review, OpenClaw cron scheduling for periodic checks, or version status checks on a machine running OpenClaw (laptop, workstation, Pi, VPS).
cli-usage
Complete reference for the systemprompt CLI - 8 domains, 64+ subcommands for managing AI infrastructure, services, agents, cloud deployments, and analytics.
aiq-deploy
Use when asked to install, deploy, run, validate, troubleshoot, or stop NVIDIA AI-Q Blueprint infrastructure.
aspire-dev
Orchestrates Aspire distributed applications using the Aspire CLI and MCP tools. USE FOR: aspire start/stop, aspire describe, aspire doctor, view logs/traces, add integrations, debug resources, AppHost management. Also trigger for DistributedApplication.CreateBuilder, AddProject, AddContainer, or Aspire resource…
cloud-architecture
Master cloud architecture with AWS, Azure, GCP, cloud-native patterns, migration strategies, and cost optimization.
scalability-patterns
Master scalability patterns with load balancing, caching, database scaling, microservices, and horizontal scaling strategies.