Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add agents/zhhjluka/hm-arch/claude-codegit clone --depth 1 https://github.com/zhhjluka/hm-archWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00000 | $0.00738 |
| Opus 5 | $0.00000 | $0.00369 |
| Sonnet 5 | $0.00000 | $0.00148 |
| Haiku 4.5 | $0.00000 | $0.00074 |
Grade C, and why
claude-code scanned grade C with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Recursive force deletehighDestructive command
rm -rf with a variable or a broad path is one typo away from removing the wrong tree.
rm -rf .claude How it starts
The opening of the file, as written. The whole thing — 115 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Claude Code setup (HM-Arch)
Install HM-Arch, wire Claude Code lifecycle hooks, smoke-test, and uninstall. All steps are offline and do not require API keys.
Install HM-Arch
From a GitHub Release wheel (current v2.0.4):
python3.12 -m venv .venv && source .venv/bin/activate
python -m pip install --upgrade pip
python -m pip install /path/to/hm_arch-2.0.4-py3-none-any.whl
From PyPI:
pip install hm-arch
# or:
pipx install hm-arch
From npm:
npm install -g @hm-arch/installer
hm-arch-install install claude-code
Confirm the CLI:
hm-arch --help
# or, after npm install:
hm-arch-install --help
Connect Claude Code (project scope)
Run from your project root (where you want .claude/):
cd /path/to/your/project
hm-arch install claude-code
This creates or updates .claude/settings.json with three HM-Arch hooks:
| Role | Event | Command |
|---|---|---|
| recall | UserPromptSubmit |
hm-arch claude-code recall |
| record | Stop |
hm-arch claude-code record |
| consolidate | TeammateIdle |
hm-arch claude-code consolidate |
If hm-arch is not on PATH, the installer falls back to
python -m hm_arch.integrations.cli claude-code ….
Global installation
hm-arch install claude-code --global
hm-arch status claude-code --global
hm-arch uninstall claude-code --global
Smoke test
cd /path/to/your/project
hm-arch status claude-code
hm-arch doctor claude-code
Expected when installed:
statusreportsinstalledwith rolesrecall,record,consolidatedoctorexits 0 when hooks are present and valid
Optional lifecycle check:
mkdir -p /tmp/hm-arch-claude-smoke && cd /tmp/hm-arch-claude-smoke
rm -rf .claude
hm-arch install claude-code && hm-arch status claude-code && hm-arch doctor claude-code
hm-arch uninstall claude-code
Uninstall
cd /path/to/your/project
hm-arch uninstall claude-code
Only HM-Arch-owned hooks are removed from .claude/settings.json; your own hooks
are preserved.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 115 lines · 0 tokens per session scan C 2cf94812302f
claude-code is an agent published in the GitHub repository zhhjluka/hm-arch (18 stars, last pushed 2mo ago), licensed Apache-2.0. It costs nothing until one of its globs matches a file; then it loads 738 tokens. A static security scan graded it C with 1 finding (recursive force delete). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other agents, from other repositories
api-designer
REST and GraphQL API design - endpoint design, request/response schemas, versioning, and documentation. Use for designing new APIs or evolving existing ones.
slide-design
You are the deck's art director. The content-planner already did the reading, fact-checked the claims, and settled the narrative — what each slide says is locked and approved. Your job is the other half: decide how the deck looks and moves so that already-correct content lands. You think like an experienced…
external-system-integration-expert
你负责把当前项目与外部 API、API 网关及业务系统安全地连接起来：识别集成边界、整理接口与环境差异、验证请求和响应、定位认证或数据契约问题。.
Audit
Deep security + performance audit of a specific diff. Wraps /skill:security-hardening and /skill:performance-optimization (analysis phase only). Use when a change touches auth, untrusted input, secrets, webhooks, PII, or a latency/throughput budget — a focused, read-only risk pass that returns findings the parent…
python-pro
Write idiomatic Python code with advanced features like decorators, generators, and async/await. Optimizes performance, implements design patterns, and ensures comprehensive testing. Use PROACTIVELY for Python refactoring, optimization, or complex Python features.
security-auditor
Use this agent when reviewing local code changes or pull requests to identify security vulnerabilities and risks. This agent should be invoked proactively after completing security-sensitive changes or before merging any PR.