Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add commands/alifanov/darkflow/self-updategit clone --depth 1 https://github.com/alifanov/darkflowWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00008 | $0.00811 |
| Opus 5 | $0.00004 | $0.00405 |
| Sonnet 5 | $0.00002 | $0.00162 |
| Haiku 4.5 | $0.00001 | $0.00081 |
Grade A, and why
self-update scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
bash <(curl -fsSL https://raw.githubusercontent.com/alifanov/darkflow/main/install.sh) --force --yes How it starts
The opening of the file, as written. The whole thing — 76 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Step 1 — Run the installer
bash <(curl -fsSL https://raw.githubusercontent.com/alifanov/darkflow/main/install.sh) --force --yes
The installer is fully non-interactive: --yes skips all prompts, --force overwrites locally-modified templates. It refreshes the global worker (~/.darkflow/darkflow-run.sh), the user-scope slash commands (~/.claude/commands/darkflow/), this project's .darkflow.d/ files, and the version in .darkflow.d/state/config.json.
Updates are manual by design — the global worker never fetches or runs an installer on its own. To update just the worker + commands without touching a project, run
bash <(curl -fsSL https://raw.githubusercontent.com/alifanov/darkflow/main/install.sh) --self-update --yes.
Step 1b — Ask the user to restart the global worker
A running worker holds the old script in memory, so the update has no effect until the worker is restarted. Do NOT restart it yourself. The worker's claude/codex engine authenticates from the user's interactive shell (keychain / env credentials a Claude Code session does not have); a worker you launch inherits your credential-less environment and every routine fails with Not logged in · Please run /login.
Check whether a worker is running and tell the user what to do:
pgrep -f /.darkflow/darkflow-run.sh >/dev/null && echo "worker running — needs restart" || echo "worker not running"
If it is running, print this and ask the user to run it in their own terminal (where claude -p "ok" works) — do not run it for them, not in the background, not even if asked to "just restart it":
pkill -f /.darkflow/darkflow-run.sh
sleep 1
nohup /usr/local/bin/bash ~/.darkflow/darkflow-run.sh >/dev/null 2>> ~/.darkflow/worker.err.log &
If no worker was running, just note that the user should start it themselves when ready. (You may stop/kill the worker on request — that needs no credentials — but never start or restart it.)
Step 2 — Ensure .darkflow.d/state/config.json is in .gitignore
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 76 lines · 8 tokens per session scan A f7cb4bd34307
self-update is a command published in the GitHub repository alifanov/darkflow (2 stars, last pushed 3d ago), licensed MIT. It adds 8 tokens to every session and 811 once invoked, about $0.0000 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other commands, from other repositories
loop
Iteratively fix issues until all resolved or max iterations reached.
feature
Create a feature specification using spec-driven development.
quality-gate
Command "quality-gate" from VoDaiLocz/kilo-kit-mcp, covering ✅ quality gate command, workflow, gates, gate 1: pre-execution and gate 2: per-behavior.
memory
Search, store, and manage AI Team Memory — agent expertise, decisions, learnings, and code patterns. File-based by default, with an optional memory MCP overlay.
deep-audit.skeleton
Aciklama: Bu bolum Bootstrap tarafindan manifest verileriyle doldurulur. Gerekli manifest alanlari: project.description, stack.primary, project.structure, project.subprojects, stack.orm, stack.authmethod Ornek cikti.
do-it-retrospective
开关本项目的本地行为反馈记录，或输出已记录问题的去敏复盘报告。参数为 on / off / status / report。.