Borrowing it
Nothing to install: this file belongs to stefanhoelzl/codehydra. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/stefanhoelzl/codehydra/main/.claude/skills/config-key/SKILL.mdgit clone --depth 1 https://github.com/stefanhoelzl/codehydraWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/stefanhoelzl/codehydra/config-key)<a href="https://agentmods.dev/skills/stefanhoelzl/codehydra/config-key"><img src="https://agentmods.dev/badge/skills/stefanhoelzl/codehydra/config-key/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/stefanhoelzl/codehydra/config-key"><img src="https://agentmods.dev/badge/skills/stefanhoelzl/codehydra/config-key.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00076 | $0.01074 |
| Opus 5.5 | $0.00030 | $0.00430 |
| Sonnet 5.5 | $0.00015 | $0.00215 |
| Haiku 4.5 | $0.00008 | $0.00107 |
Grade A, and why
config-key scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 54 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Config / state key
Reference: docs/CONFIGURATION.md. Code: src/boundaries/platform/config.ts, state-service.ts, persisted-store.ts, store-definition.ts (types, builders, semantics in JSDoc).
1. Pick the store
- Config (
config.json, env, CLI; user-authored) —deps.configService.register(...)/deps.config.register(...). - State (
state.json; the app writes it at runtime, no env/CLI, nocomputedDefault) —deps.stateService.register(...). Loaded inapp:start→init(state-module.ts): read it instartor later, never at construction.
2. Register in the owning module's factory
const fooConfig = deps.configService.register("area.foo-bar", {
default: 30,
description: "What it does (shown in --help, settings, ch config list)",
applies: "live", // or omit = "restart"; settings-UI hint only
...storeNumber({ min: 1 }),
});
- Key: dot-separated, kebab-case. Keep the returned typed accessor; never read by string key. Read
.get()where the value is used (not cached) ifapplies: "live". - Owned by no single module → register in
src/main.tsbesideagentand thread the accessor in. - Builder (
store-definition.ts):storeBoolean(),storeNumber({min,max,integer}),storeEnum([...], {nullable: true}?),storeEnumList([...]),storeString({nullable: true}?),storeFolder()(absolute path),storeCustom({parse, validate, validValues?, settingsControl?})(JSON/structured values).parsetakes the raw env/CLI string,validatethe JSON value; returnundefinedfor invalid — the app then refuses to start with a message naming the key. computedDefault: (ctx) => … | undefinedfor build-dependent defaults (Config only;ctx.isDevelopment,ctx.isPackaged).
3. Exposure and secrets
- The builder attaches a
settingsControl; that alone puts a Config key in the settings dialog andch config(isUserSetting). Override it (e.g.{ kind: "string" },guarded-text,textwithhelpPanel) or, forstoreCustom, pass none to keep the key hidden. CLI-only actions go inNON_SETTING_KEYS. redact: true(or(value, token) => projection, must not throw) for secrets — masked in the settings field,ch config, bug reports, telemetry.omit: truefor values edited in the clear that must stay out of diagnostics (plugins.config).
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 54 lines · 76 tokens per session scan A 5e5def4fa174
config-key is a skill published in the GitHub repository stefanhoelzl/codehydra (20 stars, last pushed today), licensed MIT. It adds 76 tokens to every session and 1,074 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-26.
Other skills, from other repositories
peer-review
Structured manuscript/grant review with checklist-based evaluation. Use when writing formal peer reviews with specific criteria methodology assessment, statistical validity, reporting standards compliance (CONSORT/STROBE), and constructive feedback. Best for actual review writing, manuscript revision. For evaluating…
scientific-critical-thinking
Evaluate scientific claims and evidence quality. Use for assessing experimental design validity, identifying biases and confounders, applying evidence grading frameworks (GRADE, Cochrane Risk of Bias), or teaching critical analysis. Best for understanding evidence quality, identifying flaws. For formal peer review…
scientific-schematics
Create publication-quality scientific diagrams using Nano Banana 2 AI with smart iterative refinement. Uses Gemini 3.1 Pro Preview for quality review. Only regenerates if quality is below threshold for your document type. Specialized in neural network architectures, system diagrams, flowcharts, biological pathways…
hypothesis-generation
Structured hypothesis formulation from observations. Use when you have experimental observations or data and need to formulate testable hypotheses with predictions, propose mechanisms, and design experiments to test them. Follows scientific method framework. For open-ended ideation use scientific-brainstorming; for…
paper-lookup
Search 10 academic literature APIs for papers, preprints, citations, and open-access full text, and return results with reproducible provenance. Covers PubMed, PMC (full text), bioRxiv, medRxiv, arXiv, OpenAlex, Crossref, Semantic Scholar, CORE, Unpaywall. Use when searching for papers, citations, DOI/PMID/arXiv…
scholar-evaluation
Systematically evaluate scholarly work using the ScholarEval framework, providing structured assessment across research quality dimensions including problem formulation, methodology, analysis, and writing with quantitative scoring and actionable feedback.