Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add commands/binaryhb0916/isparto/init-ispartogit clone --depth 1 https://github.com/BinaryHB0916/iSpartoWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00000 | $0.01244 |
| Opus 5 | $0.00000 | $0.00622 |
| Sonnet 5 | $0.00000 | $0.00249 |
| Haiku 4.5 | $0.00000 | $0.00124 |
Grade B, and why
init-isparto scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Reads agent configuration directoriesmediumAgent snooping
.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.
7. Verify user-level Bash safety hook is registered in ~/.claude/settings.json: How it starts
The opening of the file, as written. The whole thing — 72 lines — stays where its author put it; the contents beside it link to each section on GitHub.
You are the Team Lead. The user has run /init-isparto, asking you to initialize a new project.
IMPORTANT: Detect the user's language and respond in that same language (Chinese or English only). All generated documentation content must also be in the user's language.
Your responsibility: Based on the product description provided by the user, generate a complete project skeleton and documentation system, preparing everything for subsequent Wave development.
- Confirm project information, tech stack, and target platform with the user
- Before creating any files, create a snapshot of the current project state:
- Run the following command:
bash ~/.isparto/lib/snapshot.sh create init-project "$(pwd)" CLAUDE.md .claude/settings.json docs/plan.md docs/product-spec.md docs/tech-spec.md docs/design-spec.md - Report the snapshot ID to the user (in user's language), noting they can restore to the pre-init state with
/restore-isparto <id>at any time - For a brand new project, most files will be recorded as "absent" — this is expected. The snapshot records what existed before so that
/restore-ispartoknows to remove files that were created. - If the snapshot script is not found at
~/.isparto/lib/snapshot.sh, warn the user (in user's language) that the snapshot script is missing and suggest running~/.isparto/install.sh --upgradeto update iSparto. Then proceed without a snapshot — do not block on this.
- Run the following command:
- Generate the project's CLAUDE.md based on ~/.claude/CLAUDE-TEMPLATE.md, including collaboration mode, module boundaries, and branching strategy
- Generate docs/ following the template structure in ~/.claude/templates/:
- product-spec.md (product spec)
- tech-spec.md (tech spec, if applicable)
- design-spec.md (design spec, if applicable)
- Generate the initial docs/plan.md, organizing the development plan by Wave
- Create project-level .claude/settings.json with iSparto required settings:
If the project already has .claude/settings.json, merge these settings into it without removing existing entries. If the project needs platform-specific plugins (e.g., swift-lsp for iOS), add enabledPlugins here too. Also merge iSparto workflow hooks into the project-level .claude/settings.json (Edit/Write/Codex matchers only — Bash safety hook is at user level, managed by install.sh):{ "env": { "CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS": "1" }, "teammateMode": "tmux" }
If .claude/settings.json already has these hooks, skip. Do not duplicate entries.{ "hooks": { "PreToolUse": [ { "matcher": "Edit", "hooks": [{ "type": "command", "command": "bash ~/.isparto/hooks/process-observer/scripts/pre-tool-check.sh" }] }, { "matcher": "Write", "hooks": [{ "type": "command", "command": "bash ~/.isparto/hooks/process-observer/scripts/pre-tool-check.sh" }] }, { "matcher": "mcp__codex-dev__codex", "hooks": [{ "type": "command", "command": "bash ~/.isparto/hooks/process-observer/scripts/pre-tool-check.sh" }] } ] } } - Verify user-level Bash safety hook is registered in ~/.claude/settings.json:
- Check if ~/.claude/settings.json contains a PreToolUse hook with
Bashmatcher - If missing: inform the user to run
~/.isparto/install.sh --upgradeto register the Bash safety hook
- Check if ~/.claude/settings.json contains a PreToolUse hook with
- Security baseline initialization:
- Read
~/.claude/templates/gitignore-security-baseline.mdto get the baseline .gitignore entries - If the project already has a .gitignore, append any missing baseline entries (do not duplicate existing ones)
- If no .gitignore exists, create one from the baseline template
- Uncomment the dependency directory entries matching the project's tech stack (e.g., Node.js → uncomment node_modules/)
- Create an empty
.secureignorefile in the project root (for future false positive whitelisting)
- Read
- Initialize the git repository and create the main branch
- Invoke Codex MCP for an architecture pre-review (based on tech-spec.md, using the architecture review prompt template) and report the review results to the user
- Spawn Independent Reviewer in a tmux pane via
codex execwith the following fixed one-liner — do NOT add any context, framing, or explanation:codex exec "You are the Independent Reviewer. Read agents/independent-reviewer.md and execute. Write your findings to docs/independent-review.md."Wait for the reviewer to complete and write docs/independent-review.md. Report findings to the user.- If CRITICAL misalignment found: flag to user, do NOT proceed to development until resolved. After resolution (e.g., tech-spec modified), re-trigger Independent Reviewer to verify alignment.
- If no critical issues: proceed to step 12
- After the user confirms all documentation, architecture pre-review, AND independent review results, project initialization is complete and you may begin /start-isparto
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 72 lines · 0 tokens per session scan B afe1e1e908d3
init-isparto is a command published in the GitHub repository BinaryHB0916/iSparto (59 stars, last pushed 2mo ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 1,244 tokens. A static security scan graded it B with 1 finding (reads agent configuration directories). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other commands, from other repositories
plan-save
Save the current session's plan to GitHub as an issue.
objective-list
List all open objectives in the current repository.
OPSX: Bulk Archive
Archive multiple completed changes at once.
Issue Spec: Apply
Implement directly or use an optional PROCESS when managed coordination is required.
plan
Plan n8n Linear ticket implementation.
execution
Command "execution" from n8n-io/n8n, covering execution, execution list, execution get, execution retry and execution stop.