Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add odere-pro/claude-calibration --skill calibrate-settingsgit clone --depth 1 https://github.com/odere-pro/claude-calibrationWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/odere-pro/claude-calibration/calibrate-settings)<a href="https://agentmods.dev/skills/odere-pro/claude-calibration/calibrate-settings"><img src="https://agentmods.dev/badge/skills/odere-pro/claude-calibration/calibrate-settings/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/odere-pro/claude-calibration/calibrate-settings"><img src="https://agentmods.dev/badge/skills/odere-pro/claude-calibration/calibrate-settings.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00197 | $0.01186 |
| Opus 5 | $0.00098 | $0.00593 |
| Sonnet 5 | $0.00039 | $0.00237 |
| Haiku 4.5 | $0.00020 | $0.00119 |
Grade C, and why
calibrate-settings scanned grade C with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks for rootmediumPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
`permissions.allow` entries (`Bash(*)`, `Bash(rm *)`, `Bash(sudo *)`), model pins in committed Reads agent configuration directoriesmediumAgent snooping
.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.
Audits and tunes every `settings.json` Claude Code reads — user (`~/.claude/settings.json`), How it starts
The opening of the file, as written. The whole thing — 97 lines — stays where its author put it; the contents beside it link to each section on GitHub.
calibrate-settings — per-feature bundle
You audit and tune settings.json files across every scope Claude Code reads. You receive one of
two kinds of work:
- Direct invocation (
/claude-calibration:calibrate-settings) — audit everything, report findings, propose fixes inline. The user drives the conversation. - Dispatch from the calibrator — one approved plan row at a time, applied surgically.
In both cases the workflow is the same; only the framing differs.
1. Enumerate
bash <BUNDLE>/scripts/enumerate.sh "$PROJECT_DIR"
Yields TSV scope\tpath. Scope is user (~/.claude/settings.json), user-local
(~/.claude/settings.local.json), project (<PROJECT_DIR>/.claude/settings.json),
project-local (<PROJECT_DIR>/.claude/settings.local.json), or plugin-self
(<plugin-root>/.claude/settings.json when the project is itself a plugin).
2. Lint
bash <BUNDLE>/scripts/lint.sh <path …>
Yields TSV path\tsignature\tseverity\tdetail. The signatures this bundle owns
(see reference.md):
settings:invalid-json(HIGH)settings:secret-in-committed(CRITICAL)settings:dangerously-skip-permissions(CRITICAL)settings:permissions-blanket-destructive(HIGH)settings:model-pinned-in-committed(LOW)settings:env-bloated(LOW)settings:permissions-empty(LOW)settings:precedence-surprise(LOW)
3. Fix — kind: edit rows
For each finding, the remediation pattern is in examples/<case>/:
settings:secret-in-committed→ move the secret to.local.json(or an env-var reference); rotate the exposed credential.settings:dangerously-skip-permissions→ remove the reference; if a workflow needed it, surface the underlying tool calls and add narrowpermissions.allowentries instead.settings:permissions-blanket-destructive→ replaceBash(*)/Bash(rm *)/Bash(sudo *)with the smallest set of narrowBash(<tool> *)entries that covers real usage.settings:model-pinned-in-committed→ move themodel:pin to.local.json(per-machine) or drop it (let Claude pick).settings:env-bloated→ move per-machine values to.local.json; keep committedenvminimal.settings:permissions-empty→ seeexamples/permissions-empty/{before,after}.md; copy the baseline allow-list fromtemplates/settings.json.tmpl.settings:invalid-json→ fix the parse error reported in the detail.settings:precedence-surprise→ reconcile: either accept the managed override or surface the conflict to the policy owner.
What ships with it
6 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 10d ago First seen · 97 lines · 197 tokens per session scan C 58d1dc7e93c4
calibrate-settings is a skill published in the GitHub repository odere-pro/claude-calibration (1 stars, last pushed 1mo ago), licensed MIT. It adds 197 tokens to every session and 1,186 once invoked, about $0.0010 per session on Opus 5. A static security scan graded it C with 2 findings (asks for root, reads agent configuration directories). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
verifying-external-behavior
Confirms what a third-party library, remote API, build backend, or scraped document actually does before writing code that depends on it — throwaway probes that run in seconds, permissive clients that forward wrong arguments instead of rejecting them, per-endpoint docs that don't generalize, response shapes that make…
codebase-navigator
Deep structural codebase comprehension, AST dependency graph traversal, symbol caller/callee tracing, and monorepo navigation strategies for massive codebases.
root-cause-analysis
Hyper-scale root cause analysis (RCA), bisection, call-tree backtracking, and automated surgical remediation across massive million-file enterprise repositories.
kaboom-connection-guard
Use when a tool call fails with "extension not connected", the daemon is unreachable, or browser telemetry stops arriving.
debug-triage
Use when user reports a broken page, unexpected behavior, or error and needs fast root-cause identification across multiple signal sources.
debug
Use when user reports a bug, broken feature, console error, failed network request, or unexpected page behavior that needs investigation.