Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add commands/ai-sdlc-framework/ai-sdlc/detect-patternsgit clone --depth 1 https://github.com/ai-sdlc-framework/ai-sdlcWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00000 | $0.00326 |
| Opus 5 | $0.00000 | $0.00163 |
| Sonnet 5 | $0.00000 | $0.00065 |
| Haiku 4.5 | $0.00000 | $0.00033 |
Grade A, and why
detect-patterns scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
Detect repetitive workflow patterns from Claude Code session history and propose automations.
Steps
- Read telemetry data from
~/.claude/usage-data/tool-sequences.jsonl - Also read session metadata from
~/.claude/usage-data/session-meta/*.jsonfor historical data - Run pattern detection using the orchestrator's n-gram mining engine:
import { readToolSequenceJSONL, mineFrequentPatterns, classifyPattern } from '@ai-sdlc/orchestrator'; - Classify each pattern as command-sequence, copy-paste-cycle, or periodic-task
- Generate proposals for each detected pattern with draft artifact content
- Present results as a table: | # | Pattern | Type | Confidence | Frequency | Sessions | Proposed Artifact |
- For each proposal, show the draft artifact content and ask if the user wants to approve it
- If approved, write the artifact file using the artifact writer
Arguments
--since YYYY-MM-DD— only analyze events after this date--min-confidence 0.6— minimum confidence threshold (0-1)
Important
- Only create artifacts the user explicitly approves
- Never overwrite existing files
- Show the full draft content before writing
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 34 lines · 0 tokens per session scan A ea3ea1304045
detect-patterns is a command published in the GitHub repository ai-sdlc-framework/ai-sdlc (92 stars, last pushed 9d ago), licensed Apache-2.0. It costs nothing until one of its globs matches a file; then it loads 326 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other commands, from other repositories
spec-intake
Execute the canonical workflow: .agent/workflows/spec-intake.md.
research
Research a technical or product question.
at-dsgvo
You are helping an enterprise architect generate an Austrian Data Protection Assessment — the Austrian-specific GDPR layer applied by the Datenschutzbehörde (DSB) under the Datenschutzgesetz (DSG 2018, BGBl. I Nr. 165/1999 as amended). Run this after /arckit:eu-rgpd to add Austrian obligations that go beyond the EU…
au-soci-cirmp
You are an enterprise architect generating a Security of Critical Infrastructure Act 2018 (SOCI Act) / Critical Infrastructure Risk Management Program (CIRMP) governance and evidence pack for an Australian critical infrastructure asset or potentially regulated entity.
au-aescsf
You are an enterprise architect generating an Australian Energy Sector Cyber Security Framework (AESCSF) maturity assessment for an Australian energy-sector project, asset, market interface, OT environment, DER platform, or regulated energy business capability.
au-disp-attestation
You are an enterprise architect generating a DISP (Defence Industry Security Program) Member self-attestation pack for an Australian organisation supplying products or services to Defence.