Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add MSApps-Mobile/claude-plugins --skill mac-agent-hygienegit clone --depth 1 https://github.com/MSApps-Mobile/claude-pluginsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/msapps-mobile/claude-plugins/mac-agent-hygiene)<a href="https://agentmods.dev/skills/msapps-mobile/claude-plugins/mac-agent-hygiene"><img src="https://agentmods.dev/badge/skills/msapps-mobile/claude-plugins/mac-agent-hygiene/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/msapps-mobile/claude-plugins/mac-agent-hygiene"><img src="https://agentmods.dev/badge/skills/msapps-mobile/claude-plugins/mac-agent-hygiene.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00120 | $0.01890 |
| Opus 5.5 | $0.00048 | $0.00756 |
| Sonnet 5.5 | $0.00024 | $0.00378 |
| Haiku 4.5 | $0.00012 | $0.00189 |
Grade B, and why
mac-agent-hygiene scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Reads agent configuration directoriesmediumAgent snooping
.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.
`cleanupPeriodDays` in `~/.claude/settings.json` (default 30). `hygiene_status` reports the current How it starts
The opening of the file, as written. The whole thing — 107 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Mac Agent Hygiene
A Mac that runs Claude Code agents all day fills its disk in places no cleanup app looks: linked git worktrees that nobody removed, leftover plugin-install clones, browser-profile caches, Xcode build output. On one 926 GB machine these were 200+ GB while Downloads and Documents together held 2 GB. This skill, the bundled MCP server and the daily LaunchAgent exist so that never happens again on any Mac that installs the plugin.
The routine
Run the four MCP tools in this order. Never skip the plan.
hygiene_status— read the snapshot: disk free, DerivedData size, leftover plugin clones, Playwright profiles (how many, how many locked / in use), worktrees total and stale, whether Xcode is building, whether the LaunchAgent is loaded, and the last log lines.hygiene_plan— dry run. Every candidate comes back withremoveorkeep, its size, and a reason. Read thekeepreasons as carefully as theremoveones:dirty-uncommitted-work,unpushed-commits,a-process-is-inside,profile-in-use,xcode-buildingare the routine working. The plan returns aplan_idvalid for 30 minutes.hygiene_applywith thatplan_idandconfirm: true— each item is re-checked at apply time by the same function that planned it; anything that changed since the plan is refused, not removed. Report removed / refused / MB freed from the result.hygiene_scheduleaction: "install"once per Mac — installs the LaunchAgentcom.msapps.mac-agent-hygiene(default 04:30 daily); it copieshygiene.shto~/.local/share/mac-agent-hygiene/so the job survives plugin updates — re-run install after an update.action: "status"later. The scheduled run is exactlyplan+applywith no human in the loop, which is why the eligibility rules below are conservative by construction.
Without the MCP server (plain shell): bash scripts/hygiene.sh status | plan | run and
bash scripts/install-launchd.sh install | status | uninstall.
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 107 lines · 120 tokens per session scan B 996f833f4e4c
mac-agent-hygiene is a skill published in the GitHub repository MSApps-Mobile/claude-plugins (9 stars, last pushed yesterday), licensed MIT. It adds 120 tokens to every session and 1,890 once invoked, about $0.0005 per session on Opus 5.5. A static security scan graded it B with 1 finding (reads agent configuration directories). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-08.
Other skills, from other repositories
ship
Commit, push, create PR(s), and auto-finalize — full automation pipeline. Handles uncommitted changes and recently created PRs.
post-merge-cleanup
Clean up an already-merged local branch after proving containment. Confirm each discard and preserve unique work.
ca-standup
Daily repo hygiene — review the day's repo state, then perform the cleanups under per-action confirmation. Fast-forward only, never destructive without a yes.
situate-what
Use when the user asks what is going on and needs a five-line summary of the session, branch, pull request, and ticket.
conventional-commit
Rules for writing Conventional Commits messages in this project. MUST be invoked every time a commit is created.
python-release
Handle Python SDK release, build, bump, packaging metadata, PyPI client pin, uv.lock, nox/build workflow, and publish verification changes. Use for Python release process work or dependency pin bumps; do not use for ordinary Python feature implementation.