Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add agents/modelstudioai/cli/command-packgit clone --depth 1 https://github.com/modelstudioai/cliWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00000 | $0.01209 |
| Opus 5 | $0.00000 | $0.00605 |
| Sonnet 5 | $0.00000 | $0.00242 |
| Haiku 4.5 | $0.00000 | $0.00121 |
Grade A, and why
command-pack scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 60 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Command Pack 维护
触发条件
- 新增或移除 Command Pack 包
- 调整包白名单、允许的命令前缀或协议字段
- 修改
plugin install/link/list/remove - 修改 Command Pack 加载、隔离、兼容性或独立安装目录
分层边界
packages/core/src/types/command-pack.ts：稳定的协议元数据和导出类型，不知道具体产品或白名单。packages/runtime/src/command-packs/：所有 CLI 共用的加载、校验、API 适配、产品隔离安装目录和 manager 实现。packages/runtime/src/create-cli.ts：始终接收静态 command map，按CliOptions.commandPacks统一合并 pack，并把已绑定产品 identity/policy 的 manager 注入ctx.commandPacks。packages/commands/src/commands/plugin/：普通共享管理命令，只依赖ctx.commandPacks，不 import 任何产品 policy。packages/cli/src/command-pack-policy.ts：bl支持的包、命令前缀和凭据授权。kscli当前不传commandPacks，使用 runtime 的默认空 policy。- 当前只有
bl从bailian-cli-commands导入并登记plugin *；使用默认空 policy 的产品不提前暴露管理命令。
不要把产品白名单写进 core/runtime，也不要通过扫描全局 node_modules 自动发现包。通用机制放 runtime，产品差异只由 policy 表达。
安全与兼容性清单
- 包名必须精确命中当前产品 policy 的
supported，命令路径必须位于该包允许的前缀。 - 正式安装只接受包名加 version/tag；本地目录只走
plugin link。 - npm 使用独立安装目录和
--ignore-scripts，不污染 CLI 自身依赖树。 - npm 子进程只继承明确允许的 registry/config/cache/proxy/TLS 配置，不通配透传 pnpm 注入的
npm_config_*。 - 安装目录按
identity.npmPackage隔离，不能让一个产品安装/删除另一个产品的 pack。 - 安装目录只隔离依赖位置，不隔离执行权限；Command Pack 必须视为 CLI 进程内的完全可信代码。
- 入口 realpath 不能逃逸包根目录。
- 加载前检查
type、apiVersion、minCliVersion；报告状态只使用loaded/failed，具体原因写入error。 - Command Pack 不能覆盖内置命令、其他 pack 命令或重声明保留 flag。
- 普通网络请求走
ctx.client；基础 Context 提供identity/settings/flags/client/output/errors，不提供原始凭据。 -
ctx.credentials.apiKey()仅限 policy 显式声明credentialAccess: ["apiKey"]，且命令自身为auth: "apiKey"。 - API Key capability ID 由 host 按实际叶子命令路径生成（例如
agent credential→agent.credential）；Command Pack 不声明额外元数据，Profile allowlist 对 pack 命令同样 fail closed。 -
ctx.credentials.apiKey()必须返回authStage已注入ctx.client的实际凭证，不能重新读取原 Profile 绕过 capability fallback。 - 不向 Command Pack 暴露原始 Console Token、OpenAPI AK/SK、
authStore或configStore。 - 不向 Command Pack 暴露宿主的
commandPacksmanager，避免 pack 安装或删除其他 pack。 - 单包失败必须 fail-open：保留内置命令和其他合法 pack。
- 破坏协议前优先在适配层兼容；确实无法兼容时才提升
apiVersion。
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 60 lines · 0 tokens per session scan A 3d7c03ddcf11
command-pack is an agent published in the GitHub repository modelstudioai/cli (320 stars, last pushed 4d ago), licensed Apache-2.0. It costs nothing until one of its globs matches a file; then it loads 1,209 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other agents, from other repositories
index
Browse built-in Agent Framework capabilities for multimodal input, tools, retrieval, evaluation, security, and autonomous execution.
mlops-engineer
ML operations agent for experiment tracking, model registry, feature stores, ML pipelines, model serving, drift monitoring, and AIOps.
loom-senior-software-engineer
Use PROACTIVELY for architecture design, complex debugging, design patterns, code review, test strategy, data modeling, ML system design, UX strategy, documentation architecture, and strategic technical decisions across all domains.
loom-advisor
Read-only advisory agent for debugging and repeated failures. Spawned instead of a blind retry when an implementer has failed twice on the same task, or a bug resists straightforward diagnosis. Returns a root-cause diagnosis plus one concrete next step.
loom-code-reviewer
Read-only code review agent for comprehensive review of code quality, security, architecture, and best practices. Cannot modify files.
integrity-check
Detect adversarial content in .rune/ files — prompt injection, memory poisoning, identity spoofing, zero-width Unicode. Verdict: CLEAN/SUSPICIOUS/TAINTED.