toolbox-contract

toolbox-contract is a skill for Claude Code, Codex from xiaolai/mac-it-guy-pro. It costs 86 tokens per session (1,560 once invoked), scanned A, original, MIT.

A contract for building small, reusable automation tools for recurring chores, including rules for their files, documentation, registry entry, and testing.

In plain words
What is it for?
Use it when designing, listing, or building toolbox automations that solve a real recurring problem and can be run again later.
Why use it?
It turns repeated manual work into an owned tool with clear acceptance requirements instead of leaving behind a one-off script.

Skill for Claude CodeCodex

Part of the mac-it-guy-pro plugin — 8 skills, 12 commands, 4 agents, 2 hooks shipped together

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add skills/xiaolai/mac-it-guy-pro/toolbox-contract
Any agent
npx skills add xiaolai/mac-it-guy-pro --skill toolbox-contract
Clone the repo
git clone --depth 1 https://github.com/xiaolai/mac-it-guy-pro

Made for: Claude Code, Codex.

Or install mac-it-guy-pro, the plugin that ships this one along with the rest of its 8 skills, 12 commands, 4 agents, 2 hooks.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for toolbox-contract

README.md
[![agentmods](https://agentmods.dev/badge/skills/xiaolai/mac-it-guy-pro/toolbox-contract.svg)](https://agentmods.dev/skills/xiaolai/mac-it-guy-pro/toolbox-contract)
Your own site
<a href="https://agentmods.dev/skills/xiaolai/mac-it-guy-pro/toolbox-contract"><img src="https://agentmods.dev/badge/skills/xiaolai/mac-it-guy-pro/toolbox-contract.svg" alt="Measured on agentmods" height="20"></a>
Per session 86 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 1,560 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00086 $0.01560
Opus 5 $0.00043 $0.00780
Sonnet 5 $0.00017 $0.00312
Haiku 4.5 $0.00009 $0.00156

Measured 4d ago against content hash 97847b252976, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

toolbox-contract scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

skills/toolbox-contract/SKILL.md · 120 lines

How it starts

The opening of the file, as written. The whole thing — 120 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Toolbox Contract

Every automation the IT guy builds is left behind as a named tool the user owns. Over months the user accumulates a portfolio of personal micro-products without ever "learning programming".

Two ways a tool gets built

The user asks (/mac-it-guy-pro:automate) — they describe a chore and it becomes a tool.

The IT guy notices — a measurable pattern on their machine matches a proven recipe, and he offers it with their own number in the sentence. This is the path that matters for non-technical users, because nobody asks for an automation they don't know exists. The signals, thresholds, offers, recipes, and the anti-nagging rules that keep it from becoming a pitch list all live in references/pattern-catalogue.md. Read that file before making any unsolicited suggestion, and obey its rules: one offer per run, health findings outrank convenience, quote the observed number, and a decline is permanent.

Both paths produce the same thing, and both must pass the test below.

Acceptance test — all three, or don't build it

  1. Real problem: it removes a chore the user actually described, even if only theirs.
  2. Repeat use: the chore recurs. A one-off task is just done directly, not turned into a tool.
  3. Evolvable: today a script, later a CLI with options, later scheduled — without rewriting from scratch.

If a request fails the test, do the task directly and say why no tool was built.

Directory layout

~/ITGuy/toolbox/<tool-name>/
├── run.sh              # or run.py — the tool itself
├── README.md           # plain language, template below
└── <Tool Name>.command # double-clickable Finder wrapper
  • <tool-name> is kebab-case, verb-first: rename-photos-by-date, file-desktop-screenshots.
  • run.sh starts with #!/bin/bash and set -euo pipefail; run.py uses only the Python standard library. No dependencies without naming the dependency to the user and getting a yes.

Non-negotiable tool behaviors

  1. Dry-run is the default. Running the tool with no arguments prints what it would do and changes nothing. The real run requires --go.
  2. Trash, never rm — same rule as the safety contract. Tools delete via Finder Trash (recipe in macos-recipes).
  3. Never overwrite — collisions get (2) suffixes.
  4. Print a summary line at the end: how many files touched, how much space affected, where.
  5. Exit non-zero on any error, with a message a non-technical user understands.

Read the full file on GitHub · 120 lines

Files

What ships with it

1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 4d ago First seen · 120 lines · 86 tokens per session scan A 97847b252976

Subscribe to this mod's changes

toolbox-contract is a skill published in the GitHub repository xiaolai/mac-it-guy-pro (5 stars, last pushed 1mo ago), licensed MIT. It adds 86 tokens to every session and 1,560 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Related

Other skills, from other repositories

app-it

Turn a local project or a hosted web app (including a published Claude Artifact URL) into a macOS Dock-launchable .app. Use when the user wants a clickable Dock app, local app package, icon, App It install, hosted-URL or Artifact wrapper, or repeatable desktop launcher. Defaults to native Swift WebKit, shipped…

Christian-Katzmann/app-it · 91 tokens

app-it-static

Turn a finished or buildable web app into a macOS Dock-launchable .app that serves built output instead of a dev server. Use when the user asks for app-it-static, a finished site/app launcher, a lightweight Dock app, or a dist/build/out bundle clickable from the Dock. Builds once, serves a snapshot via…

Christian-Katzmann/app-it · 89 tokens

app-it-windows

Create Windows beta desktop launchers for local web projects: WPF + WebView2 .exe, Start Menu shortcut, .ico, warm server, quit cleanup. Use when the user asks for app-it-windows, a Windows app, .exe launcher, Start Menu shortcut, Windows package, or desktop icon. CI-guarded but untested on Windows hardware; never…

Christian-Katzmann/app-it · 89 tokens

music

Apple Music in your terminal. Play tracks, route to AirPlay speakers and AirPods, search 100 million songs, build playlists, play radio stations, discover new music, favorite tracks, seek within a song, browse your listening history, browse your library by artist, album, or track. This is the plugin's only entry…

anthonymaley/MusicTUI · 408 tokens

now

Show what's currently playing on this Mac (any app — Spotify, Apple Music, browsers). Use when the user asks what song/track/music is playing, who the artist is, or wants playback status.

Bangs00/claude-media-control · 43 tokens

output

Show or switch the Mac's audio output device (built-in speakers, AirPods, external displays, DACs). Use when the user asks where sound is playing, which output device is active, or wants audio routed to a different device.

Bangs00/claude-media-control · 50 tokens