Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/orwa-mahmoud/nightshift/setupnpx skills add orwa-mahmoud/nightshift --skill setupgit clone --depth 1 https://github.com/orwa-mahmoud/nightshiftWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/orwa-mahmoud/nightshift/setup)<a href="https://agentmods.dev/skills/orwa-mahmoud/nightshift/setup"><img src="https://agentmods.dev/badge/skills/orwa-mahmoud/nightshift/setup.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00027 | $0.04674 |
| Opus 5 | $0.00014 | $0.02337 |
| Sonnet 5 | $0.00005 | $0.00935 |
| Haiku 4.5 | $0.00003 | $0.00467 |
Grade B, and why
setup scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Reads agent configuration directoriesmediumAgent snooping
.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.
`$TASK_ROOT/.claude/settings.local.json` (create the file if absent; never clobber keys How it starts
The opening of the file, as written. The whole thing — 283 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Set up Nightshift in this project. Do the scaffolding first, then the gates conversation, then print a summary.
State map: punch-list.md → owner-approved work active in this shift;
drafting-table.md → known work staged for a later shift; parking-lot.md → unresolved owner
decisions plus the default chosen so work continues; work-orders.md → timed catalog work composed
only through Hunt. Ordinary plans belong in the drafting table, never in Hunt or the parking lot.
Resolve the host-opened project folder to an absolute $TASK_ROOT: use ${CLAUDE_PROJECT_DIR} on
Claude Code; on Codex honor Nightshift's ${CODEX_PROJECT_DIR} recovery override when present,
otherwise capture pwd -P before any other shell call. If $TASK_ROOT/.nightshift-link exists,
validate the one absolute workspace path inside it and call that $NIGHTSHIFT_WORKSPACE; otherwise
set NIGHTSHIFT_WORKSPACE="$TASK_ROOT".
Bind the Nightshift directory once: NS="$NIGHTSHIFT_WORKSPACE/.nightshift". On native Windows,
$NS = Join-Path $NIGHTSHIFT_WORKSPACE '.nightshift'. After this bind, Nightshift files are
$NS/<name> for every read, write, and shell command. Catalog and owner-facing prose may use the
short names (punch-list.md, parking-lot.md, STOP). Never re-resolve. Helpers that take
--project or -Project still receive "$NIGHTSHIFT_WORKSPACE".
Never search
surrounding folders or guess. On Claude Code, .claude/ settings stay at $TASK_ROOT. The shell's
working directory persists between Bash calls, so never rely on a bare relative path.
Resolve the installed plugin root to an absolute $NIGHTSHIFT_PLUGIN_ROOT: use
${CLAUDE_PLUGIN_ROOT} on Claude Code; on Codex use $PLUGIN_ROOT when available, otherwise derive
it from the absolute path attached to this skill (skills/setup/SKILL.md). Substitute that
absolute path in every command below; never search for the plugin.
On native Windows, use the PowerShell tool and native paths throughout: the host variables are
$env:CLAUDE_PROJECT_DIR, $env:CODEX_PROJECT_DIR, and $env:PLUGIN_ROOT, with
[Environment]::CurrentDirectory as the Codex cwd fallback. Do not route setup through WSL or Git
Bash. Once the workspace and work target are resolved, the bundled mechanical scaffold is:
& "$NIGHTSHIFT_PLUGIN_ROOT\runtime\windows\setup.ps1" `
-Project "$NIGHTSHIFT_WORKSPACE" -WorkTarget "$WORK_TARGET" -Mode "$WORK_MODE"
It copies only absent files, writes state version 1 for a new site, persists the work target and
work mode (-Mode repository or -Mode artifact), and
keeps $NS/ private. It refuses a notes folder under default repository mode: pass -Mode artifact for a notes folder that is not a Git repository. The skill still owns every owner choice below; the script asks
nothing and never invents gates, permissions, profiles, migration approval, or a receipts choice.
If the user explicitly identifies a different existing workspace containing .nightshift/, show
both absolute paths and ask for confirmation. On yes, run
"$NIGHTSHIFT_PLUGIN_ROOT/runtime/link-workspace.sh" --host-root "$TASK_ROOT" --workspace "$PROPOSED_WORKSPACE".
On native Windows, run
& "$NIGHTSHIFT_PLUGIN_ROOT\runtime\windows\link-workspace.ps1" -HostRoot "$TASK_ROOT" -Workspace "$PROPOSED_WORKSPACE"
instead.
The pointer is local-only and state remains in the authoritative workspace; never copy it.
0. Reject disposable ChatGPT scratch workspaces
Before creating or changing any file, resolve the project root to an absolute path. If it is under
/workspace/scratch/, this is a disposable ChatGPT scratch workspace that cannot affect the user's
repository. Stop immediately: create no $NS/ directory, rules, settings, receipts repo,
or other files. Tell the user directly:
Nightshift needs a persistent software project workspace. This ChatGPT conversation is using a temporary workspace, so files created here will not affect your repository.
Open your project in Codex (a Git repository or a persistent local folder), or start Codex connected to its GitHub repository. Then mention Nightshift and say: “Set up Nightshift in this project.”
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday Changed 6b815d9269d3
- 5d ago First seen · 283 lines · 27 tokens per session scan B 1c227a9633ed
setup is a skill published in the GitHub repository orwa-mahmoud/nightshift (51 stars, last pushed today), licensed MIT. It adds 27 tokens to every session and 4,674 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it B with 1 finding (reads agent configuration directories). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
agent-loop
Detect requests for iterative autonomous agent loops and route to the appropriate loop executor.
cross-task-learner
Enable agent loops to learn from similar past tasks and share patterns across loops.
infer-completion-criteria
Infer measurable completion criteria for an agent-loop task from project docs, code, and AIWG standards when the user has not supplied --completion explicitly.
aiwg-language-map
AIWG addons + extensions language map — categories, curated discover phrases, and per-bundle pointers covering everything beyond the framework quickrefs.
aiwg-regenerate-claude
Regenerate CLAUDE.md for Claude Code with hook file architecture.
aiwg-utils-quickref
AUTO-INVOKE for ANY AIWG capability question, framework/addon/extension query, steward routing, MCP profile, or when unsure where to start. ALWAYS consult before filesystem search on .claude/.factory/.codex/.warp/etc. AIWG core utilities quick reference — always-on framing, steward, index, meta operations.