Five Of These Six Mods Are Cosmetic. One Is A Security Feature.
“Claude Mods: 6 ideas to customise your Claude workflow.” Under the title, the sentence that sells it: “Describe a feature in plain English and Claude Code adds it to itself. Buttons, panels, warnings.”
Mods are real, and the card has them right. A mod is a plugin made of JavaScript or TypeScript event handlers that run inside Claude Code. Per Anthropic’s documentation, one can draw “a pane beside the transcript or a band above the prompt, with tabs, buttons, and text fields”, redraw parts Claude Code already draws such as a tool call’s row or the spinner, and “hold a tool call while you ask the user a question”. Five of the card’s six ideas sit comfortably inside that.
The sixth is a different kind of thing, and it is the one worth slowing down on.
The source card — “Claude Mods: 6 ideas”, BANI Academy. Session-log mining, a cache keeper, recording mode, a goal meter, a collision guard, and chores turned into buttons.
Two of the six already exist
Before building anything: Anthropic publishes sample mods in the claude-code-playground repository, and two of them are the card’s ideas, already written.
token-weather— in Anthropic’s words, it “draws a forecast of your context window above the prompt”. That is idea 2, the Cache Keeper.blast-radius— it “holds a risky shell command, such asrm -rfor a force push, and shows what it would change, with buttons to proceed or cancel”. That is the exact shape of idea 5, the Collision Guard: intercept, explain, offer buttons.
There is a third, replay-theater, which adds a /replay command that steps through the file edits Claude made in the last turn. None of them is supported — the repository shares them as they are — but reading one is the fastest way to learn the shape before you ask Claude to write yours. The card says “here is where to start”; the honest answer is “start by reading two mods that already do this”.
Diagram: the six ideas against what a mod can actually do
| # | The idea | What it needs from the mods API | Draws anything? | Status |
|---|---|---|---|---|
| 1 | Mine your own session logs | Nothing. This is Claude reading files and suggesting ideas | No | Not a mod at all — a conversation |
| 2 | Cache Keeper: context, limits, one-click handoff | A band above the prompt with buttons | Yes | Already published as token-weather |
| 3 | Recording Mode: mask secrets on screen | Redrawing what Claude Code itself draws | Yes — and that is the problem | See below |
| 4 | Goal Meter: /goal with a live list and timer |
A custom command, a pane, and somewhere to store state | Yes | Supported in principle |
| 5 | Collision Guard: warn, then proceed / worktree / cancel | Holding a tool call to ask the user a question | Yes | Same shape as blast-radius |
| 6 | Chores into buttons: handoff in one click | A band above the prompt running your own function | Yes | Supported, and the most boring useful one |
Five are cosmetic. One is a security feature.
Idea 3 reads: “Turn on Recording Mode. Sensitive details stay hidden on screen while Claude works with the real values.” The mock-up shows screen: API_KEY sk-•••••• against claude: API_KEY sk-live-8f2a, with two labels: emails masked and safe to film.
A pane that miscounts your tokens is an annoyance. A mask that you believe is on when it is off is a different category of mistake, because the failure is silent and the cost is a leaked credential in a video that is already published. So it needs checking against the documentation rather than taken on trust — and the documentation names three holes.
| The hole | What Anthropic’s docs say | What it means for “safe to film” |
|---|---|---|
| The permission prompt is out of reach | “A mod can restyle much of Claude Code’s interface, but not the permission prompt. It can’t change what a prompt shows you.” | That is the screen where a secret most often appears — approving a shell command that contains a key. The one dialog a mask cannot cover is the one that shows you the command in full |
| Drawing does not happen everywhere | In the VS Code extension’s chat panel, claude -p, the Agent SDK and cloud sessions, the docs’ own table says hooks run but what the mod draws does not appear |
Your hooks fire, your mask does not render, and nothing tells you. The mod is “on” and the screen is bare |
| The mod itself is the risk | “A mod is code that runs with your permissions… Mods aren’t sandboxed.” It can “read your secrets: environment variables and settings files, including an API key you keep in either” | You are handing your secrets to a piece of unsandboxed code in order to hide your secrets. That is fine if you wrote it. It is a very large trust decision if you did not |
There is a fourth line in the same documentation worth reading next to all this: a mod can “act without asking you: approve a tool call before you’re asked”, and one that approves tool calls “can approve one that an ask rule would prompt for, or that one of your own PreToolUse hooks blocked”.
So the sentence under the card’s title, read literally, is accurate and larger than it sounds. “Claude Code adds it to itself” means Claude Code installs, into its own process, unsandboxed code that runs as you, can read your environment variables, and can approve actions you would otherwise have been asked about. For a context-window chart that is a fine trade. It is worth knowing it is the trade.
The command the card does not have
There is one, and it is the single most useful thing in this whole area. Before you install a mod, in your shell:
claude plugin validate ./some-modPer the docs, this lists “which events it handles and what it asks Claude Code to do, such as read a file or make a network request, without running it”. The hooks: and calls: lines in the output are what to read. A mod that claims to mask your screen and also makes network requests is a mod you want to know about before it loads, not after.
What a mod can reach, and how to turn it off
| From Anthropic’s documentation | |
|---|---|
| Act as you | “Read and write files anywhere your user account can, start programs, and make network requests” |
| Read your secrets | “Environment variables and settings files, including an API key you keep in either” |
| See your session | “Every prompt you send and every tool call Claude makes” |
| Change your session | “Rewrite a prompt or a tool call, submit a prompt as if you had typed it, or send a message to another of your sessions” |
| Act without asking | “Approve a tool call before you’re asked” |
| Spend your usage | “Call a model on your plan or API key” |
| Turn off one | Disable or uninstall its plugin from the Installed tab in /plugin |
| Turn off all, one session | Start with --safe-mode, which also disables your other customisations |
| Turn off all, every session | "disableAllHooks": true in ~/.claude/settings.json. Built-in mods keep running |
If you build one this week, build number six
The card’s least glamorous idea is its best: “A handoff used to take four manual steps. Now it is one button above the prompt.” Before: run-skill, copy, clear, paste. After: one click.
That one is worth building because it fails loudly. If the button does nothing, you notice in a second and you have lost nothing. It needs no secrets, it touches no credentials, and it is the kind of thing idea 1 — reading your own session logs to find what you repeat — is genuinely good at finding. The card’s own mock-up gets this exactly right: “You hand off sessions 12x a week. Start there.”
Idea 3 is the one to build last, after you have written a mod or two and can read the code. And when you do build it, test it in the place you will actually film: start a session, trigger a permission prompt on a command containing a dummy key, and look at the screen. If the key is visible in the dialog, you have found hole number one yourself, in ninety seconds, before anything is recorded.
Two practical notes from the docs. Mods draw only in the terminal and the Desktop app, which is worth holding alongside how much of Claude’s value sits in settings you never installed anything for. Mods need Claude Code v2.1.287 or later in the terminal, and the Desktop app from v2.1.286; check with claude --version or /status. And some of Claude Code’s own features are already mods — /diff is one — so if you want to see a serious example, its source is public.
Four honest caveats
- We did not build any of the six. This is a reading of the card against Anthropic’s documentation, not a test. The three holes in idea 3 are documented limits, not observed failures — which is why the ninety-second check above is worth doing yourself.
- Idea 3 is not impossible. A mod genuinely can redraw a tool call’s row, so masking much of what appears is within the API. The argument is narrower: a mask with three documented gaps is not the same as a guarantee, and “safe to film” is written as a guarantee.
- Mods are new and moving. Version numbers, the elements table and the list of built-in mods all change. Everything here was read in October 2026, and the card’s own fine print — “Features and names change often. Check the official Claude and Claude Code docs” — is the correct instruction.
- The card is more careful than most. It labels its mock-up numbers as examples, it tells you to check the docs, and it ends with “Never share real API keys.” Our disagreement is with one label on one tile, not with the card.
The one-line version
Mods are real, two of the six ideas are already written and published, and the sentence that sells them is bigger than it looks: a mod is unsandboxed code that runs as you, reads your environment, and can approve tool calls you would have been asked about. Fine for a pane that charts your context. A much larger decision for the one tile whose entire job is to keep a secret.
The same question — what exactly am I installing, and what can it reach — is the one worth asking about everything else in your .claude/ folder, where skills, plugins, MCP servers and hooks all arrive by different routes and load at different moments.
Before your first install. Clone the mod, run claude plugin validate ./its-directory, and read the hooks: and calls: lines. Thirty seconds, no code executed, and it tells you what the README would rather not.
