Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/laurigates/claude-plugins/docs-refreshnpx skills add laurigates/claude-plugins --skill docs-refreshgit clone --depth 1 https://github.com/laurigates/claude-pluginsWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00039 | $0.01383 |
| Opus 5 | $0.00019 | $0.00691 |
| Sonnet 5 | $0.00008 | $0.00277 |
| Haiku 4.5 | $0.00004 | $0.00138 |
Grade C, and why
docs-refresh scanned grade C with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Downloads and executes remote codehighSupply chain
curl | sh runs whatever the server returns today, which is not necessarily what it returned when this was reviewed.
Download-review-run, not `curl … | sh` — the piped form is blocked by this Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
curl -fsSL https://d2lang.com/install.sh -o /tmp/d2-install.sh How it starts
The opening of the file, as written. The whole thing — 107 lines — stays where its author put it; the contents beside it link to each section on GitHub.
/docs-refresh
Refresh this repo's top-level catalog docs so the stated plugin/skill/agent
counts and the plugin set match what is actually on disk. The detector is
scripts/check-docs-index.sh; this skill is the fixer that consumes its
report.
When to Use This Skill
| Use this skill when... | Use something else when... |
|---|---|
| Per-plugin counts in README / PLUGIN-MAP / the d2 diagram drifted | A plugin needs adding/removing — follow CLAUDE.md § Plugin Lifecycle first, then run this |
check-docs-index.sh reports doc_count_drift / diagram_count_drift / diagram_svg_stale / readme_row_dangling |
You need a generic project's docs synced — that's documentation-plugin:docs-sync (wrong layout for this repo) |
The PR gate Check docs-index drift failed in CI |
Editing rule-index or marketplace set — the audit reports those, but fix them at their source |
Context
- Audit: !
bash scripts/check-docs-index.sh - README last touched: !
git log --max-count=1 --format='%h %ci' -- README.md
Execution
Execute this refresh:
Step 1: Read the drift
Run bash scripts/check-docs-index.sh (shown in Context). Each ISSUES: line
names the exact file, line, and the disk-vs-stated count. STATUS=OK with
ISSUE_COUNT=0 means nothing to do — stop and report clean.
Step 2: Apply count fixes
For every doc_count_drift / diagram_count_drift issue, Edit the stated count
to the disk count:
README.md— the| **<plugin>** | N | ... |category-table rows. Preserve any+ M agentssuffix.docs/PLUGIN-MAP.md— the| <plugin> | N | ... |tier-table rows.docs/diagrams/plugin-relationships.d2— thelabel: "<name>\nN skills"node labels. The.svgis generated and never hand-edited; re-render it in Step 4.
Step 2b: Apply name-level fixes
Two ERROR-severity issue types are name drift, not count drift — no /docs-refresh
arithmetic repairs them:
| Issue type | What it means | Fix |
|---|---|---|
diagram_svg_stale / diagram_svg_node_missing |
The committed .svg renders a per-plugin label the .d2 no longer states |
Re-render (Step 4). Never hand-edit the .svg to agree — Check 6 compares label text only and cannot tell a hand-patch from a render |
readme_row_dangling |
A plugin README row advertises /<ns>:<name> with no matching skill directory |
Delete the row if the skill never existed, or correct it to the real invocation path. Resolution is exact, so a row that is a shorthand for a longer directory is a real finding — fix the row, not the check |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 107 lines · 39 tokens per session scan C d20883a02c2e
docs-refresh is a skill published in the GitHub repository laurigates/claude-plugins (54 stars, last pushed 3d ago), licensed MIT. It adds 39 tokens to every session and 1,383 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it C with 2 findings (downloads and executes remote code, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
a0-review-plugin
Full audit of Agent Zero plugins in usr/plugins/. Reviews manifest validity, directory structure, code patterns (Store Gating, notifications, imports), security, and duplicate detection against the community index. Use when asked to review, audit, validate, or check an existing plugin before using or contributing it.
dev-environment-bootstrapping
Use this skill when the user asks to bootstrap, set up, create, or initialize a Shopware development environment from scratch — phrases like "set up a Shopware dev environment", "clone and install Shopware", "initialize a Shopware plugin project", "bootstrap Shopware and a new plugin called X", "get a fresh Shopware…
phpunit-integration-to-unit-migrating
Use this skill ONLY when the user explicitly requests an audit, migration, or evaluation of whether a Shopware integration test belongs in the unit suite — trigger phrases like "audit integration tests", "migrate integration tests to unit", "is this an integration test or a unit test", "evaluate integration tests for…
commit-message-writing
Use this skill when the user explicitly asks to generate, write, draft, or create a commit message, squash commit, commit title, or merge commit message for the Shopware core repository (shopware/shopware). Supports two modes — full commit messages (title + body) for branch commits, and squash merge titles…
hermes-diagnostic-review
Use when running a read-only diagnostic review of recent Hermes sessions to find recurring mistakes, failed tool calls, and repeated fixes, then propose suggestion-only improvements and reusable skills. Human-gated; never auto-applies.
a0-manage-plugin
Manage Agent Zero plugins lifecycle: browse the Plugin Hub, scan for security, install from Git/ZIP/Plugin Hub, update, uninstall, enable, disable, debug, and troubleshoot. Use when asked to install, update, uninstall, remove, scan, find, search, enable, disable, debug, or troubleshoot a plugin.