Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add commands/0xmariowu/agentlint/setupgit clone --depth 1 https://github.com/0xmariowu/AgentLintWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00000 | $0.00522 |
| Opus 5 | $0.00000 | $0.00261 |
| Sonnet 5 | $0.00000 | $0.00104 |
| Haiku 4.5 | $0.00000 | $0.00052 |
Grade A, and why
setup scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 63 lines — stays where its author put it; the contents beside it link to each section on GitHub.
AgentLint Setup
Bootstrap a repository with AI-native CI/CD, hooks, and templates in one command.
When to use
- Starting a new project and want the full AI-native development stack
- Adding CI/CD and hooks to an existing project
- After
agentlint checkshows missing workflows or hooks
What gets installed
Universal CI workflows (all languages): gitleaks · semgrep · trivy · test-required (blocking) · pr-lint · release · author-email · commit-message-scan · hygiene · stale · workflow-sanity · lock
Language-specific workflows (Python / TypeScript / Node): CI matrix · CodeQL · labeler · autofix
Git hooks:
- Pre-commit: author identity (noreply email) + PII scan + secrets detection + staged-file lint
- Pre-push: rebase on main before push
- Commit-msg: conventional commits enforcement
Templates:
CLAUDE.mdwith Local test section, Session Checklist, Harness architectureplan.mdatomic task formattests/compliance_check.sh(SECURITY.md / gitleaks / git email / paths)HANDOFF.md,CHANGELOG.md
Scripts:
scripts/committer— atomic commit wrapper (preventsgit add .)scripts/check-deps.sh— dependency checker
Usage
# Bootstrap a Python project
agentlint setup --lang python ~/Projects/my-repo
# Bootstrap a TypeScript project (public repo)
agentlint setup --lang ts --visibility public ~/Projects/my-repo
# Add only workflows to existing project
agentlint setup --lang python --workflows-only ~/Projects/my-repo
Non-git directories are refused by default. Use --init-git only when
the user explicitly wants setup to initialize the target as a git repo.
The auto-fix workflow that commits and pushes formatting changes is not
installed by default. Use --with-auto-push only after the user opts in.
Steps
- Detect language from args (
--lang ts|python|node) - Run
bash ${CLAUDE_PLUGIN_ROOT}/scripts/setup.sh --lang <lang> [options] <path> - Report what was installed
- Suggest next steps:
pre-commit install, first commit,agentlint check
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 63 lines · 0 tokens per session scan A 49f24ae38e28
setup is a command published in the GitHub repository 0xmariowu/AgentLint (53 stars, last pushed 1mo ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 522 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other commands, from other repositories
ci
CI/CD hygiene and run health: pinned actions, timeouts, concurrency, tests — plus the latest runs via gh.
sm-sail
Command "sm-sail" from ScienceIsNeato/slop-mop, covering /sm-sail — drive a pr to green, autonomously, the loop, when sail parks on review threads, when to stop before "pr ready" — only two reasons and expect convergence, not one pass.
setup
Initialize a new project with SDLC-compliant structure. Creates required files, configures build system, sets up CI/CD, and establishes quality tooling.
sm-buff
You usually don't run buff directly — run sm sail. sm sail drives the whole PR to green and calls buff watch / triage for you, stopping only when it needs you to act (see /sm-sail). Reach for sm buff here only for surgical work: inspecting a specific failure, or resolving a single review thread when sail has parked on…
testarch-ci
Scaffold CI/CD quality pipeline with test execution. Use when the user says ""lets setup CI pipeline"" or ""I want to create quality gates"".
ci-triage
Investigate failing GitHub Actions runs and produce root-cause plus Beads follow-up.