Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add agents/lugassawan/swe-workbench/comment-scangit clone --depth 1 https://github.com/lugassawan/swe-workbenchWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00000 | $0.00826 |
| Opus 5 | $0.00000 | $0.00413 |
| Sonnet 5 | $0.00000 | $0.00165 |
| Haiku 4.5 | $0.00000 | $0.00083 |
Grade A, and why
comment-scan scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 57 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Comment-scan invocation
Advisory scan for unnecessary or over-cap comments, backing swe-workbench:principle-clean-code's
Comment discipline caps with a deterministic, checkable artifact instead of prose recall alone.
Advisory-with-accounting, not a hard gate — the scan never fails your verify step; it produces
findings that verdict accounting (below) requires you to account for before calling verify done.
Running the scan
No git access lives inside the script — resolve the diff yourself and pipe it in:
command -v swe-workbench-comment-scan >/dev/null 2>&1 || {
echo "swe-workbench runtime commands not on PATH — reinstall or update the swe-workbench plugin." >&2
exit 1
}
DEFAULT_BRANCH="${DEFAULT_BRANCH:-main}"
MERGE_BASE=$(git merge-base HEAD "origin/$DEFAULT_BRANCH" 2>/dev/null || true)
git diff -M "${MERGE_BASE:-origin/$DEFAULT_BRANCH}" | swe-workbench-comment-scan
The preflight check is load-bearing, not boilerplate. This scan runs against an arbitrary target
repo — if swe-workbench-comment-scan isn't on PATH for any reason (plugin not installed, or an
install predating bin/), the invocation would otherwise fail ambiguously (or, worse, get silently
treated as "not applicable" rather than "misconfigured") instead of erroring loudly with a fix
("reinstall or update the swe-workbench plugin"). Same pattern as bin/README.md's canonical
preflight — don't drop the check when copying the snippet.
-M detects renames so a moved function's untouched doc comment isn't misread as newly added.
Diffing from the merge-base (not origin/main directly) covers committed + staged + unstaged work
in one pass without picking up main's own post-branch-point changes as if they were yours. If
MERGE_BASE comes back empty (unrelated-history repo), the fallback diffs straight against the
branch tip — same defensive posture as swe-workbench:workflow-branch-sync's redundancy-check capture.
Verdict accounting
The script's footer reports a must-triage count, e.g. COMMENT-SCAN: 3 must-triage (OVER_CAP=2 RESTATES=1) INFO=1. Your Phase 3 / verify evidence must carry exactly one line per must-triage
finding, referencing its detector:file:line id:
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 57 lines · 0 tokens per session scan A 1662762de14a
comment-scan is an agent published in the GitHub repository lugassawan/swe-workbench (2 stars, last pushed 2d ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 826 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other agents, from other repositories
architect-review
Master software architect specializing in modern architecture patterns, clean architecture, microservices, event-driven systems, and DDD. Reviews system designs and code changes for architectural integrity, scalability, and maintainability. Use PROACTIVELY for architectural decisions.
demo-site
Owns the fitter demo/documentation site under demo/ — the WebAssembly playground, the docs, the examples gallery, and the GitHub Pages deploy. Use for any work on demo/index.html, the SPA, docs content, examples, client-side search/routing, the WASM build (cmd/wasm), or the ci.yaml pages job. Trigger phrases: "demo…
consistency-checker
事实一致性与伏笔状态检查专家（只读）。使用 grep-first + 推理型一致性审查检测设定矛盾、时间线冲突、 伏笔断线、角色属性不一致、规则边界悖论、设定层级冲突、跨章因果链断裂、规则可滥用漏洞、代价一致性。输出 S1-S4 分级冲突报告。 被 story-review、story-long-write（Phase 5）、story-short-write（Phase 4）调用。 不做任何创作判断。.
polyglot-architect
Cross-language API design and binding parity.
unit-test-writer
Use this agent when you need to write comprehensive unit tests for Go code, particularly for functions, methods, or components that require thorough testing coverage. Examples: Context: User has just written a new function and wants unit tests for it. user: 'I just wrote this function to validate email addresses, can…
hierarchies
Parent-child relationships, graph building, and cycle detection.