headlenss-g2-plugin

headlenss-g2-plugin is a skill for Claude Code from takashicompany/headlenss. It costs 191 tokens per session (5,281 once invoked), scanned A, original, MIT.

A setup guide for showing a development plug-in for Even Realities G2 smart glasses inside the headlenss app's session list. A declaration file links the plug-in to a project session so it can be opened from the glasses.

In plain words
What is it for?
Use it to connect a work-in-progress G2 plug-in to headlenss, configure its access details, and open it from the glasses while developing.
Why use it?
It removes the need to scan a QR code each time you want to check a plug-in during development and helps avoid disrupting other running services.

Skill for Claude Code

Written for Claude Code: shipped in a Claude Code plugin.

Part of the headlenss plugin — 3 skills shipped together

Good fit Use it to connect a work-in-progress G2 plug-in to headlenss, configure its access details, and open it from the glasses while developing.

Compare 6 skills from other repositories ↓
Install with agentmods
npx agentmods add skills/takashicompany/headlenss/headlenss-g2-plugin
Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent
npx skills add takashicompany/headlenss --skill headlenss-g2-plugin
Clone the repo
git clone --depth 1 https://github.com/takashicompany/headlenss

Made for: Claude Code.

Or install headlenss, the plugin that ships this one along with the rest of its 3 skills.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for headlenss-g2-plugin

README.md
[![agentmods](https://agentmods.dev/badge/skills/takashicompany/headlenss/headlenss-g2-plugin/github.svg)](https://agentmods.dev/skills/takashicompany/headlenss/headlenss-g2-plugin)
Your own site
<a href="https://agentmods.dev/skills/takashicompany/headlenss/headlenss-g2-plugin"><img src="https://agentmods.dev/badge/skills/takashicompany/headlenss/headlenss-g2-plugin/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for headlenss-g2-plugin

Your own site · 80×15
<a href="https://agentmods.dev/skills/takashicompany/headlenss/headlenss-g2-plugin"><img src="https://agentmods.dev/badge/skills/takashicompany/headlenss/headlenss-g2-plugin.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 191 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 5,281 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 1 finding. A grade says what 26 rules found in the file — not that it is safe. Third-party audits
  • NVIDIA SkillSpector warn 7 Sept 2026
SkillSpector: 3 findings, up to high

These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →

  • high Supply Chain · line 61
    Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
    Fix: Avoid downloading and executing remote scripts. Use trusted packages from PyPI/npm. If remote fetch is required, verify checksums and use HTTPS.
  • high Privilege Escalation · line 91
    Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
    Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
  • high Supply Chain · line 306
    Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
    Fix: Avoid downloading and executing remote scripts. Use trusted packages from PyPI/npm. If remote fetch is required, verify checksums and use HTTPS.
How audits are shown
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00191 $0.05281
Opus 5 $0.00096 $0.02641
Sonnet 5 $0.00038 $0.01056
Haiku 4.5 $0.00019 $0.00528

Measured 12d ago against content hash 81962a9d7486, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-11, from the pricing page.

Security

Grade A, and why

headlenss-g2-plugin scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

curl -s -o /dev/null -w "%{http_code}\n" http://127.0.0.1:3000/api/health
plugin/skills/headlenss-g2-plugin/SKILL.md · 398 lines

How it starts

The opening of the file, as written. The whole thing — 398 lines — stays where its author put it; the contents beside it link to each section on GitHub.

開発中の G2 プラグインを headlenss から開けるようにする

headlenss (app 2.5.0 以降) は、tmux セッションのフォルダに置かれた宣言ファイルを読み、 そのセッションの下に G2 プラグインをぶら下げて表示する。グラスの一覧からタップすると WebView ごとそのプラグインへ遷移する。

  myproject [Claude]       さっきの続きだけど…
▶   └ MyPlugin                       ← ここでタップすると開く

QR の再スキャンなしに開発中プラグインを開けるのが目的。

このスキルは環境非依存。 例に出てくるホスト名・ポート・パスはすべて置き換える前提で 書いてある。まず「0. 環境を調べる」で自分の環境の値を確定させること。

絶対に守ること

  1. ポート番号から「自分のサーバ」と判断しない。 中身を取得して自分のものか確かめる (手順 3)。複数プロジェクトが同じポートを直書きしている事故が実際に起きている

  2. 他プラグインの環境を壊さない。 ポートが埋まっていたら自分が別のポートへ移る。 相手の dev server を落とす・設定を書き換える・共有ファイルの他人の行をいじる、はしない

  3. 自分のプラグインの画面が出るのを見るまで「できた」と言わない (手順 4-(3))

  4. プロセスを kill しない。 共有プロキシを kill / pkill / killall / PID 指定の シグナルで止めない。psss で得た親 PID・祖先 PID は診断情報であって停止対象では ない。子プロセスを止めたいからといって、親や祖先を kill しない

    以下は絶対に停止対象に含めない:

    • /usr/lib/systemd/systemd --user (ユーザーマネージャ本体)
    • cgroup が user@<uid>.service/init.scope のプロセス
    • tmux サーバー
    • headlenss.service
    • 自分が起動していない共有サービス全般

    正常手順 (後述の systemctl --user restart) が失敗したら、代替の kill 手段を 発明せず、作業を止めてユーザーに確認する。

    実際に起きた事故: 「設定を変えたらプロキシを再起動する」という手順に従い、稼働中 プロキシの PID を ps の祖先チェーンで遡って node → sh → npm → systemd --user と まとめて kill した。末端が PID 1133 = systemd ユーザーマネージャ本体だったため、 ユーザーセッション全体 (headlenss、tmux 全 27 セッション) が落ちた。


0. 環境を調べる (最初に必ずやる)

以下を確定させてから先へ進む。推測しない。

headlenss サーバのアドレス

グラス側アプリの設定に入っている URL。サーバ側からは systemd / プロセスで確認できる。

systemctl --user status headlenss 2>/dev/null | head -3   # 常駐しているか
curl -s -o /dev/null -w "%{http_code}\n" http://127.0.0.1:3000/api/health

外から見えるアドレスは公開方法による。tailscale なら:

tailscale serve status
tailscale status --json | python3 -c "import json,sys; d=json.load(sys.stdin); print(d['Self']['DNSName'].rstrip('.'), d['Self']['TailscaleIPs'][0])"

リポジトリの場所

# headlenss (サーバ + G2 アプリ)
#   [email protected]:takashicompany/headlenss.git
# Plugin Loader (シム注入プロキシ。戻る動作に使う)
#   [email protected]:takashicompany-org/plugin-loader.git

Read the full file on GitHub · 398 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 12d ago First seen · 398 lines · 191 tokens per session scan A 81962a9d7486

Subscribe to this mod's changes

headlenss-g2-plugin is a skill published in the GitHub repository takashicompany/headlenss (5 stars, last pushed 3d ago), licensed MIT. It adds 191 tokens to every session and 5,281 once invoked, about $0.0010 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Related

Other skills, from other repositories

gke-compute-classes

Configures, optimizes, and troubleshoots GKE ComputeClasses. Use when configuring Spot VMs with on-demand fallback, targeting specific accelerators (GPUs/TPUs) or machine families, restricting ComputeClass access, or debugging pending pods related to node pool auto-creation. Do not use for cluster-level Node Auto…

google/skills · 83 tokens

jetson-diagnostic

Read-only Jetson health snapshot for identity, memory, GPU, thermal, power, storage, services, and top processes.

NVIDIA/skills · 30 tokens

doca-socket-relay

Use this skill when the operator is driving the DOCA Socket Relay to bridge a socket-oriented host application onto a BlueField DPU peer without rewriting it — picking the deployment shape (in-process, sidecar, or BlueField service container), configuring the host-side socket and the DPU-side forwarding endpoint…

NVIDIA/skills · 236 tokens

offensive-z-wave

Z-Wave attack methodology — sniffing with Z-Force / EZ-Wave / RTL-SDR + ZniffMobile, S0 (legacy) network-key derivation flaw and key reuse, S2 (modern) ECDH commissioning analysis, replay/injection on unauthenticated nodes, default-key brute-force on test deployments, and home-automation hub pivots. Use when targeting…

SnailSploit/Claude-Red · 113 tokens

hsb-flash

Flash the FPGA on an HSB board connected to an NVIDIA devkit. Supports HSB Lattice boards (FPGA versions 2407, 2412, 2507, 2510) and Leopard Imaging VB1940 "all-in-one" cameras (FPGA versions 2507, 2510). Uses release-specific YAML manifests and board-type-specific program commands. Lattice and VB1940 commands must…

NVIDIA/skills · 94 tokens

jetson-validate-image

Use after jetson-flash-image to run static BSP checks, on-target smoke/regression tests on a flashed DUT, or both. Not for build or flash steps. Triggers: validate bsp, on-target validation.

NVIDIA/skills · 50 tokens