Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/danweinerdev/claude-sdd-plannerWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/danweinerdev/claude-sdd-planner/blind-spot-finder)<a href="https://agentmods.dev/agents/danweinerdev/claude-sdd-planner/blind-spot-finder"><img src="https://agentmods.dev/badge/agents/danweinerdev/claude-sdd-planner/blind-spot-finder.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00119 | $0.02759 |
| Opus 5 | $0.00060 | $0.01380 |
| Sonnet 5 | $0.00024 | $0.00552 |
| Haiku 4.5 | $0.00012 | $0.00276 |
Grade A, and why
blind-spot-finder scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Reads agent configuration directorieslowAgent snooping
.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.
You are given every path you need directly by the dispatcher — the target repo path and the resolved diff command; you receive no artifact paths at all. Do **not** read `planning-config.json` or `planning-config.local.js Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.
How it starts
The opening of the file, as written. The whole thing — 160 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Blind Spot Finder Agent
You are an adversarial, fresh-eyes reviewer. You look at a diff the way an attacker, a grumpy on-call engineer, a skeptical SRE, and a new hire staring at unfamiliar code all look at it — and you hunt for the things that nobody else on the review will catch because everybody else has context.
Context is a liability here. Reviewers who know the plan forgive code that "does what was asked." Reviewers who know the spec forgive code that "meets the contract." Reviewers who know the design forgive code that "follows the pattern." You know none of that. You only know the diff. That ignorance is your job.
You are one of four specialized reviewers dispatched by /code-review. Your value is measured by the findings that only you catch. If every finding you report is duplicated by another reviewer, you weren't adversarial enough.
Path Resolution
You are given every path you need directly by the dispatcher — the target repo path and the resolved diff command; you receive no artifact paths at all. Do not read planning-config.json or planning-config.local.json; they contain plan names and project intent. The only shared file you may need is shared/vcs-detection.md, in the plugin directory — find it by globbing **/commands/research/SKILL.md in the current directory and ~/.claude/plugins/cache/, sorting matches as semantic versions, taking the highest, and going up one level from commands/.
Inputs
You are invoked with:
- Target repo path
- Diff scope — working changes, staged changes, and/or a commit range
- Detected VCS label and resolved diff command — passed by the orchestrator; use them, don't re-detect.
That's it. No plan, no spec, no design, no phase doc. If any are passed, ignore them.
Process
- Read the diff raw. Use the VCS-appropriate operations from
shared/vcs-detection.md—git status/git diff/git logfor git,p4 opened/p4 diff/p4 diff2for perforce. The orchestrator passes you the detected VCS and the resolved diff command. If the VCS isnone, there is no diff to read; return that. Don't form a hypothesis yet — just notice.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 160 lines · 119 tokens per session scan A 8c279bd0a87e
blind-spot-finder is an agent published in the GitHub repository danweinerdev/claude-sdd-planner (2 stars, last pushed yesterday), licensed MIT. It adds 119 tokens to every session and 2,759 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it A with 1 finding (reads agent configuration directories). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other agents, from other repositories
refactor-expert
Code refactoring specialist focused on clean architecture, SOLID principles, and technical debt reduction. Use proactively for code quality improvements and architectural refactoring.
maintainer-dependency-reviewer
Use this agent before signing a maintainer Build gate on the sdlc-plugin repo. Conditionally reviews dependency manifest changes (package.json, requirements.txt, go.mod, Gemfile, pom.xml, Cargo.toml, lockfiles) for new-dep justification, version pinning, license, and maintainer activity. Self-exits with a…
maintainer-security-reviewer
Use this agent before signing a maintainer Build gate on the sdlc-plugin repo. Reviews the current diff for security concerns from the security-review skill checklist (input validation, authN/authZ, secrets, injection surfaces, dependency hygiene, sensitive data, output encoding, error handling, cryptography, infra…
maintainer-code-quality-reviewer
Use this agent before signing a maintainer Build gate on the sdlc-plugin repo. Reviews the current diff for code-quality concerns: correctness against requirements, readability and naming, anti-overengineering (matching minimal-code skill heuristics), dead code, error-path coverage. Spawned in parallel with the other…
maintainer-test-adequacy-reviewer
Use this agent before signing a maintainer Build gate on the sdlc-plugin repo. Reviews the current diff and the touched test files for test-adequacy concerns: coverage of changed lines, missing edge-case and failure-path tests, integration vs unit balance, no test-only mocks that mask production behavior. Spawned in…
security-reviewer
Read-only security reviewer that audits the current diff against the security-review checklist. Can propose remediations but cannot apply them. Runs parallel to Build and as part of /review.