Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add commands/bro3886/rem/releasegit clone --depth 1 https://github.com/BRO3886/remWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00000 | $0.01004 |
| Opus 5 | $0.00000 | $0.00502 |
| Sonnet 5 | $0.00000 | $0.00201 |
| Haiku 4.5 | $0.00000 | $0.00100 |
Grade C, and why
release scanned grade C with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Downloads and executes remote codehighSupply chain
curl | sh runs whatever the server returns today, which is not necessarily what it returned when this was reviewed.
curl -fsSL https://rem.sidv.dev/install | bash Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
curl -fsSL https://rem.sidv.dev/install | bash How it starts
The opening of the file, as written. The whole thing — 130 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Create a new release for the rem project.
Step 1: Analyze Changes
Run these commands to understand what changed since the last release:
git tag --sort=-v:refname | head -1 # Latest tag
git log <latest-tag>..HEAD --oneline # Commits since last release
git diff <latest-tag>..HEAD --stat # Files changed
Read the commit messages carefully. Classify the release:
Semver Rules
- MAJOR (vX.0.0): Breaking changes — removed commands, renamed flags, changed default behavior, dropped compatibility
- MINOR (v0.X.0): New features, new commands, new flags, new packages. No breaking changes.
- PATCH (v0.0.X): Bug fixes, docs-only changes, performance improvements, dependency bumps. No new features.
Look for commits prefixed with:
feat(...)→ MINOR bump (or MAJOR iffeat!or containsBREAKING CHANGE)fix(...)→ PATCH bumpdocs(...),chore(...),refactor(...),perf(...)→ PATCH bump!suffix orBREAKING CHANGEin body → MAJOR bump
If the current version is pre-1.0 (v0.x.y), breaking changes bump MINOR not MAJOR.
Present the proposed version to the user and ask for confirmation before proceeding.
Step 2: Run Tests
go test ./...
All tests must pass. Do not proceed if any test fails.
Step 3: Tag FIRST, Then Build
CRITICAL: The tag MUST be created BEFORE building. The Makefile uses git describe --tags to embed the version string in the binary. If you build before tagging, the binary will report the wrong version (e.g., v0.5.0-2-gae75da9 instead of v0.6.0).
git tag v<VERSION>
git push origin v<VERSION>
Step 4: Build Release Binaries
make release
This produces bin/rem-darwin-arm64.tar.gz and bin/rem-darwin-amd64.tar.gz.
Verify the version is correct before uploading:
cd /tmp && tar -xzf /path/to/bin/rem-darwin-arm64.tar.gz && ./rem version && rm ./rem
The output must show rem v<VERSION>, not a describe-style string like v0.X.Y-N-gHASH.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 130 lines · 0 tokens per session scan C f317d8e5373a
release is a command published in the GitHub repository BRO3886/rem (149 stars, last pushed 2mo ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 1,004 tokens. A static security scan graded it C with 2 findings (downloads and executes remote code, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other commands, from other repositories
Manage macOS Mail.app - list, read, search, send, reply, update flags, move, delete, and verify sender authentication.
reminders
Manage macOS reminders - list, search, create, complete, update, delete with filtering and batch operations.
authorize
Check and request macOS permissions for calendars, reminders, contacts, and Mail.app automation.
calendars
Manage macOS calendar events - list, search, create, update, delete with batch operations.
configure
Configure which domains, calendars, and reminder lists the plugin can access.
contacts
Manage macOS contacts - list, search, get details, create, update, delete.