Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add uchicago-dsi/ai-sci-skills --skill claude-code-workergit clone --depth 1 https://github.com/uchicago-dsi/ai-sci-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/uchicago-dsi/ai-sci-skills/claude-code-worker)<a href="https://agentmods.dev/skills/uchicago-dsi/ai-sci-skills/claude-code-worker"><img src="https://agentmods.dev/badge/skills/uchicago-dsi/ai-sci-skills/claude-code-worker.svg" alt="Measured on agentmods" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium Rogue Agent · line 16 Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.Fix: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00103 | $0.01523 |
| Opus 5 | $0.00051 | $0.00762 |
| Sonnet 5 | $0.00021 | $0.00305 |
| Haiku 4.5 | $0.00010 | $0.00152 |
Grade A, and why
claude-code-worker scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 121 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Claude Code Worker
Use Claude as a write-capable external worker while Codex remains the supervising owner. The worker is conversational across invocations, but it does not inherit the Codex thread or native tool state. Give it a compact, self-contained prompt and verify its work yourself.
Before Launch
- Read the repository's applicable
AGENTS.mdand task instructions yourself. - Choose one concrete, bounded task with an inspectable result.
- Create a dedicated clean Git worktree under the repository's configured worktree root. Do not point Claude at a shared checkout or an execution checkout bound to a live job.
- Create the state directory outside the worktree. Use a protected directory when the prompt or result is private. Never put PHI, credentials, patient identifiers, source imaging, or protected clinical text in the prompt or worker-visible paths.
- Write a self-contained prompt that includes:
- the exact outcome and boundaries;
- relevant user constraints and applicable repository rules;
- current evidence and file paths needed for the task;
- verification expected from the worker;
- whether it may commit (default: no);
- an instruction to report changed files, checks, findings, and blockers.
Start And Continue
Run the bundled bridge from the repository that owns the worktree:
python "$CODEX_HOME/skills/claude-code-worker/scripts/run_claude_worker.py" start \
--workdir "$WORKTREE" \
--prompt-file "$PROMPT_FILE" \
--state-dir "$STATE_DIR"
The default is Sonnet at medium effort for bounded coding and review, with
autonomous tool use, unrestricted turn count, and write plus shell tools. Use
compact, file-referenced briefs and send only unfinished scope. Do small edits
locally when delegation and review would cost more than the task. Escalate model
or effort only for an identified difficulty, not by default. Safety
comes from Claude restricted/safe mode and the isolated worktree, not from making the
worker read-only. The bridge does not use --no-session-persistence; it records the
Claude session ID and raw JSON result under the state directory.
What ships with it
3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 121 lines · 103 tokens per session scan A 409ae2257428
claude-code-worker is a skill published in the GitHub repository uchicago-dsi/ai-sci-skills (16 stars, last pushed 2d ago), licensed MIT. It adds 103 tokens to every session and 1,523 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-05.
Other skills, from other repositories
prowler-commit
Creates professional git commits following conventional-commits format. Trigger: When creating commits, after completing code changes, when user asks to commit.
gh-auth-isolation
Safely manage multiple GitHub identities (EMU + personal) in agent workflows.
comet-github
A routing guide for Comet-related GitHub work. It directs requests about pull requests, issues, CI failures, ideas, and fixes to the appropriate review or implementation process.
github-skill
Work with GitHub via the gh CLI — clone repositories, create/list/merge pull requests, create/list issues, and run any other gh command (API calls, workflow runs, releases, repo administration). List operations return parsed JSON.
codex-autoresearch
Run autonomous, measurable experiments in a Git repository: change one hypothesis, verify a numeric metric, keep improvements, and revert failures. Use when the user wants Codex to keep iterating toward a numeric target in the foreground or as a detached background run. Do not use for ordinary one-shot coding…
changelog-composer
Generates structured changelogs and release notes from git history and PRs, classifying breaking changes, features, fixes, performance, docs. Triggers on: "generate changelog", "write release notes", "what changed since", "prepare release", "release notes for", "diff since tag".