Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add commands/aaronsb/claude-code-config/ways-testsgit clone --depth 1 https://github.com/aaronsb/claude-code-configWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00011 | $0.01963 |
| Opus 5 | $0.00005 | $0.00981 |
| Sonnet 5 | $0.00002 | $0.00393 |
| Haiku 4.5 | $0.00001 | $0.00196 |
Grade A, and why
ways-tests scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 227 lines — stays where its author put it; the contents beside it link to each section on GitHub.
ways-tests: Way Matching & Vocabulary Tool
Test how well a way matches sample prompts, or analyze its vocabulary for gaps.
Usage
The user invokes /ways-tests with one of these patterns:
Score mode: test a way against prompts
/ways-tests score <path/to/{name}.md> "sample prompt here"
/ways-tests score security "how do i hash passwords with bcrypt"
Score all ways: rank all ways against a prompt
/ways-tests score-all "sample prompt here"
Suggest mode: analyze vocabulary gaps
/ways-tests suggest <path/to/{name}.md>
/ways-tests suggest security
/ways-tests suggest --all
Suggest + apply: update vocabulary in-place
/ways-tests suggest <path/to/{name}.md> --apply
/ways-tests suggest --all --apply
Lint mode: validate way frontmatter
/ways-tests lint <path/to/{name}.md>
/ways-tests lint --all
Implementation
Resolving way paths
When the user gives a short name like "security" instead of a full path:
- Check
$CLAUDE_PROJECT_DIR/.claude/ways/first (project-local) - Then check
~/.claude/hooks/ways/recursively for*/security/security.md - If multiple matches, list them and ask the user to pick
Score mode
Use the ways match subcommand:
# Score with BM25
ways match \
--description "$description" \
--vocabulary "$vocabulary" \
--query "$prompt" \
--threshold "${threshold:-2.0}"
# Exit code: 0 = match, 1 = no match
# Stderr: "match: score=X.XXXX threshold=Y.YYYY"
Display the score, threshold, and match/no-match result. If the way has no vocabulary, note that semantic matching is unavailable — only pattern matching applies.
Score-all mode
For each way file found (project-local + global), extract description+vocabulary and run way-match pair. Display results as a ranked table:
Score Threshold Match Way
------ --------- ----- ---
4.7570 2.0 YES softwaredev/security
2.3573 2.0 YES softwaredev/api
1.6812 2.0 no softwaredev/debugging
0.0000 2.0 no softwaredev/design
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 227 lines · 11 tokens per session scan A 489023bc763b
ways-tests is a command published in the GitHub repository aaronsb/claude-code-config (18 stars, last pushed 4mo ago), licensed MIT. It adds 11 tokens to every session and 1,963 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other commands, from other repositories
riskreview
The user invoked the /riskreview facade command from the risk-review-pipeline pack.
nyann:diff-profile
Compare two nyann profiles side-by-side and show what changes between them: hooks, branching, CI, documentation, extras, governance. Useful before switching profiles to understand the impact.
nyann:hotfix
Create the branch topology for a patch release against a previously tagged version. Ensures release/ . exists from the source tag, then creates hotfix/ off it. After this, the user commits the fix and runs /nyann:release from the hotfix branch.
nyann:ship
Open a GitHub pull request AND merge it in one step. Default uses GitHub's native auto-merge (returns immediately with outcome:"queued"); --client-side polls for green CI in the foreground then runs gh pr merge. Requires gh installed + authed.
nyann:learn-profile
Inspect a reference repo and save its nyann-relevant setup (stack, hooks, branching, commit convention, extras) as a reusable profile.
sicario.verify
Run deterministic verification.