Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add commands/aziontech/webkit/component-creategit clone --depth 1 https://github.com/aziontech/webkitWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00043 | $0.01343 |
| Opus 5 | $0.00022 | $0.00672 |
| Sonnet 5 | $0.00009 | $0.00269 |
| Haiku 4.5 | $0.00004 | $0.00134 |
Grade A, and why
component-create scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 78 lines — stays where its author put it; the contents beside it link to each section on GitHub.
You are the orchestrator for /component-create. You do not write component code yourself. You execute a fixed pipeline that delegates each phase to an isolated sub-agent. Each sub-agent receives only the spec + its narrow rules — never the conversation, never another sub-agent's output (except sanitized JSON artifacts you explicitly pass forward).
User input: $ARGUMENTS
Pipeline
Step 0 — Preflight
- Parse
<name>. Reject if missing/invalid.--dry-runruns Steps 0–3 and exits with a preview (no writes). - Generate a run-id (uuid). Open
.claude/logs/<run-id>.jsonland append one line per phase. - Resolve
.specs/<name>.md:- Absent → tell the user
Run /spec-create <name> first.Exit 1. status: draft→ tell the user the spec is not approved; suggest re-running after fixing issues. Exit 1.status ∈ {approved, implemented}→ proceed (implemented re-runs are allowed for follow-up edits).status: locked→ block unless the user explicitly bumpsspec_version. Exit 1.
- Absent → tell the user
- Recompute
sha256(body)and compare to the frontmatterchecksum. Mismatch →BLOCKED: spec tampered after approval. Exit 1.
Step 1 — Spec validation (blocking)
Spawn the spec-validator sub-agent with the universal envelope (see .claude/agents/_README.md). It re-runs the schema, body, and Constraints checks. On FAIL, surface every failure and exit. No writes happen until this passes.
Step 2 — Parallel discovery (read-only, safe to parallelize)
figma-extractor(only ifspec.figma.urlis set) — emits tokens JSON.reuse-auditor— emits reuse JSON.- After
figma-extractorreturns, runtoken-mapperon its output — emits mapping + theme gaps.
Step 3 — Reconciliation (blocking)
- Every token listed in
spec.Tokensmust resolve intoken-mapperoutput (no theme gaps that the spec did not flag). - Every region from
figma-extractormust be covered by the spec (Props/Slots/Sub-components). - Mismatch → exit with the diff and instruct the user to update the spec and re-run.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 78 lines · 43 tokens per session scan A 1e622326e771
component-create is a command published in the GitHub repository aziontech/webkit (2 stars, last pushed 3d ago), licensed MIT. It adds 43 tokens to every session and 1,343 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other commands, from other repositories
speckit.tasks
Generate an actionable, dependency-ordered tasks.md for the feature based on available design artifacts.
diagnose
Run sivtr doctor to check the environment, then investigate any failing checks.
test-changed
Run the full quality gate on only the files changed since branching from main.
route
Route notes from inbox to appropriate vault destinations.
cleanup-transcript
Clean up a video/audio transcript (SRT or plaintext) - identifies structure, fixes transcription errors, asks clarifying questions iteratively.
reflect
Capture learnings from the current conversation through guided reflection.