All Claude Code modsShriD5/claude-mods
rubber-duck
A fast second opinion on every edit: a small model flags removed error handling, deleted tests, secrets and more
rubber-duck reaches L2 (writes or runs) by its classified calls and passed claude plugin validate on Claude Code 2.1.302.
- Events hooked: 5
- API methods referenced: 11
- Access from classified calls: L2, writes or runs: drives Claude, reads files, draws
- Unclassified calls: 2 (
$.state.get,$.state.set), full access unknown - Static scan, not a runtime test
To install it, open the repository and follow the author’s setup instructions. Mods need Claude Code 2.1.287 or later.
Access
L2 Writes or runsother: $.state.get, other: $.state.set, drives Claude, reads files, drawsValidation
Passed on Claude Code 2.1.302View the source on GitHub Back to the list
What the scan recorded
- Observed events
- every tool call, every prompt
- Hooks
session.start, tool.call, prompt.submit, command.run {command=duck}, ui.render {component=Pane, requestId=rubber-duck}- API calls
$.clock.after, $.clock.now, $.command.register, $.fs.stat, $.model.complete, $.state.get, $.state.set, $.ui.log, $.ui.open, $.ui.resolve, $.ui.toast- Validation on 2.1.302
- Passed
- Scanned revision
1203787ff69a
These are the hooks and API calls reported by claude plugin validate. Access levels describe the widest reach of those calls and are not safety ratings. Validation is a static check, not a runtime test, and a passing result does not prove that a mod works or is safe. How the scan works.
More from ShriD5/claude-mods
- chai-meterA taxi meter for the session's cost in the status line, in dollars and cups of chai.
- commit-coachRewrites lazy commit subjects into conventional commits from the staged diff, and strips AI attribution trail…
- main-guardA red band when you are on main or in prod, and no force-push, reset --hard or unconfirmed push to a protecte…
- night-modeLate at night Claude gets more careful and asks before deploys, force pushes and rm -rf
- phone-approveApprove or deny Claude Code's permission prompts from Telegram, with the terminal prompt as the fallback.
- secret-guardStops Claude from writing API keys, tokens, private keys and database passwords into files.
- ship-log/ship turns what you built this session into a build-in-public post for X or LinkedIn
- standup/standup writes yesterday's standup (since Friday on Mondays) from your git commits and copies it
- whoopgateLive WHOOP heart rate in the status line; risky Bash commands are blocked while it is over your limit
Badge for your README
Authors can show the latest scan result in their README. Each badge links to this page.
[](https://mods.aidojo.si/mods/ShriD5--claude-mods--rubber-duck/)
[](https://mods.aidojo.si/mods/ShriD5--claude-mods--rubber-duck/)