Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/melodic-software/claude-code-plugins/pluginsnpx skills add melodic-software/claude-code-plugins --skill pluginsgit clone --depth 1 https://github.com/melodic-software/claude-code-pluginsWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00119 | $0.04589 |
| Opus 5 | $0.00060 | $0.02295 |
| Sonnet 5 | $0.00024 | $0.00918 |
| Haiku 4.5 | $0.00012 | $0.00459 |
Grade B, and why
plugins scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Reads agent configuration directoriesmediumAgent snooping
.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.
anything, `sync` may reorder keys in user-scope `~/.claude/settings.json` (machine-local, already How it starts
The opening of the file, as written. The whole thing — 292 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Variables
Arguments: $ARGUMENTS
Scope
Guarantees that the plugins which actually load, for the machine's user scope, and for any repo you're standing in with its own project/local-scope installs, are the latest published versions of everything the marketplace offers, and surfaces any state where something older or unintended is what really runs.
Distinct from what Claude Code's own background autoUpdate does (see
context/scope-semantics.md): autoUpdate silently refreshes marketplace
data and bumps already-installed plugins post-startup. It never installs a new catalog plugin, never
checks enabledPlugins completeness, never detects or reports scope divergence, and only runs once
per session start on its own schedule, not on demand. This skill covers exactly that gap.
Distinct from claude-config's audit skill's plugin-drift check: that check compares a project's
committed enabledPlugins against a marketplace's upstream marketplace.json (orphan/new/rename
plugin names). This skill compares the local, already-installed state (installed_plugins.json,
per-scope enabledPlugins) against the local marketplace catalog, a different axis (install/scope
completeness, not settings-vs-upstream drift).
Never silently fixes drift it finds. sync mutates only via the documented CLI actions below,
and never writes a committed .claude/settings.json: its Step 5 enables automatically only at
user and local scope, and reports a project-scope gap rather than filling it, because sync
has no autonomous-session abort behind which a confirm would mean anything. After Step 4 installs
anything, sync may reorder keys in user-scope ~/.claude/settings.json (machine-local, already
written by claude plugin install -s user) so the map stays alphabetical; it never reorders a
project-scope map. converge is the one action that can touch committed settings, and only after
an explicit per-plugin confirm. See context/scope-semantics.md for
which CLI calls write that file.
What ships with it
11 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- context/converge.md 9.5 KB
- context/gotchas.md 15 KB
- context/scope-semantics.md 15 KB
- context/sync.md 32 KB
- evals/evals.json 13 KB
- scripts/fixtures/installed_plugins.sample.json 1.1 KB
- scripts/fixtures/known_marketplaces.sample.json 516 B
- scripts/fleet-state.sh 53 KB runs code
- scripts/fleet-state.test.sh 101 KB runs code
- scripts/normalize-enabled-plugins.sh 6.3 KB runs code
- scripts/normalize-enabled-plugins.test.sh 5.8 KB runs code
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 292 lines · 119 tokens per session scan B bb6e5422508c
plugins is a skill published in the GitHub repository melodic-software/claude-code-plugins (12 stars, last pushed yesterday), licensed MIT. It adds 119 tokens to every session and 4,589 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it B with 1 finding (reads agent configuration directories). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
deep-research
Conducts iterative deep research on any topic using web search, progressive exploration, and structured synthesis. Use when asked for comprehensive research, deep investigation, thorough analysis, or multi-source exploration of any topic. Triggers: research, investigate, deep dive, comprehensive analysis, explore…
error-ux
Principles and patterns for writing error messages that help users recover. Use when auditing, writing, or improving error messages in code. Triggers: error messages, user experience, error handling, exception messages, validation errors.
adversarial-patterns
Library of realistic adversarial attack vectors and anti-patterns to avoid. Contains examples of valid attacks and subtle gaming patterns to reject.
documentation-testing
Provides heuristics for identifying incomplete or broken documentation. Use when validating README setup instructions, testing onboarding flows, or auditing documentation quality. Triggers: docs, readme, onboarding, setup validation, documentation audit.
adversarial-analysis
Analyze code to identify explicit contracts, implicit usage patterns, and realistic boundary conditions. Contains concrete formulas for calculating input realism limits. Use before generating adversarial tests.
propagate-then-search
For constraint problems: eliminate impossibilities before guessing, reduce search space through inference, fail fast on contradictions.