Borrowing it
Nothing to install: this file belongs to colophon-group/jobseek. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/colophon-group/jobseek/main/.claude/commands/jobseek-error-review.mdgit clone --depth 1 https://github.com/colophon-group/jobseekWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/commands/colophon-group/jobseek/jobseek-error-review)<a href="https://agentmods.dev/commands/colophon-group/jobseek/jobseek-error-review"><img src="https://agentmods.dev/badge/commands/colophon-group/jobseek/jobseek-error-review/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/commands/colophon-group/jobseek/jobseek-error-review"><img src="https://agentmods.dev/badge/commands/colophon-group/jobseek/jobseek-error-review.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00058 | $0.03966 |
| Opus 5.5 | $0.00023 | $0.01586 |
| Sonnet 5.5 | $0.00012 | $0.00793 |
| Haiku 4.5 | $0.00006 | $0.00397 |
Grade B, and why
jobseek-error-review scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks for rootmediumPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
All runnable without sudo by the `deploy` user: How it starts
The opening of the file, as written. The whole thing — 371 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Daily review of jobseek crawler errors. Read-only. Operate from this prompt alone — do not rely on prior conversation context.
================================================================ MISSION
Scan the last 24h of errors on the crawler Hetzner box, classify against prior reviews, write a dated Markdown report, and file a GitHub issue for anything novel, regressing, or spiking. Model output after prior issues #2622, #2621, #2470, #2431. Never mutate remote state.
================================================================ TARGET
Prefer the root-collected runner bundle. For a local manual fallback, resolve the production crawler host from approved operator configuration and never copy its address into reports, traces, prompts, or GitHub content. Compose: /home/deploy/docker-compose.yml
Long-running services — collect logs with
docker logs --since <ISO> --until <ISO> <name>:
deploy-worker-1-1 HTTP worker
deploy-worker-2-1 HTTP worker
deploy-worker-3-1 HTTP worker
deploy-browser-1-1 Playwright/Lightpanda worker
deploy-exporter-1 Postgres → Supabase + Typesense CDC
deploy-drain-1 R2 description uploader
deploy-indexnow-1 IndexNow notifier
deploy-redis-1 local queue (only OOM + level=error lines)
deploy-alloy-1 log/metric shipper (only Alloy's own level=error)
Ephemeral one-shots — enumerate with
docker ps -a --filter status=exited --format '{{.Names}} {{.Image}} {{.CreatedAt}} {{.Status}}'
filtered to containers whose CreatedAt falls inside the window and whose
image matches ghcr.io/*/jobseek-crawler:*. These are crawler refresh-typesense | backfill-typesense | sync | notify-indexnow | reconcile runs. Grab their logs with docker logs <id> before they age
out (Docker retains exited container logs until the container is pruned).
Ignore interactive debug containers (user-spawned, noisy): names like tesla-debug, stupefied_hofstadter, goofy_haibt.
================================================================ INPUTS
- Window: last 24h ending at UTC now, rounded down to the minute. Use an
explicit --since/--until pair so the window matches the report header
exactly.
If a runner evidence bundle is available, read manifest.json,
host/docker-inspect-state.txt, host/docker-cgroup-memory.json, and
host/docker-lifecycle.jsonl first. Also read
host/maintenance-correlation.json before classifying a synchronized service
stop. The lifecycle stream durably records allowlisted
create/start/restart/die/oom/kill/stop/destroy events, exit codes/signals,
and pseudonymous container generations; the cgroup file contains
generation-safe memory.events counters.
Always read host/redis-capacity.prom and
host/redis-capacity-observer.log. If manifest.json records
redis_capacity.complete=false, report the capacity evidence gap rather than
treating the Redis container's cgroup percentage as healthy capacity.
Always read the disk_capacity manifest entry and the six bounded files
host/docker-system-df.txt, host/docker-container-sizes.txt,
host/docker-images.txt, host/disk-attribution.txt,
host/docker-gc-timer.txt, and host/docker-gc.log.
Treat disk_capacity.complete=false as an attribution gap. When
/or Docker is at least 85% full, identify the dominant allowlisted root/image family and check the exact-window GC journal; never close or downgrade the incident from the percentage alone. If evidence is incomplete, name the exact missing artifact instead. Treat active(running) as a healthy in-flight timer and inspect its target service separately. A quiescent timer must be active(waiting) with a finite next trigger; active(elapsed), any other state, or waiting with a missing/infinite next trigger is a failed recurrence guard even while disk usage is safe. - Prior review reports: read every
.mdunder ~/dev/claude/review-jobseek-errors/ before classifying. That directory is the agent's cross-run memory. - Prior GitHub issues (dedup + pattern matching):
gh issue list --label daily-error-review --state all --limit 200
--json number,title,state,createdAt,body - Recently merged PRs (regression correlation — prior issues reference
specific PRs like
pre-#2232): gh pr list --state merged --limit 40 --json number,title,mergedAt
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago Changed · +38 lines 8b8bdc17a5a1
- 1mo ago Changed · +12 lines 35e6a27ba0ea
- 2mo ago First seen · 321 lines · 58 tokens per session scan B 02281e3aa808
jobseek-error-review is a command published in the GitHub repository colophon-group/jobseek (223 stars, last pushed yesterday), licensed MIT. It adds 58 tokens to every session and 3,966 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it B with 1 finding (asks for root). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
jobseek-error-review compared with commands from other repositories
| Mod | Type | Stars | Last push | Licence | Scan | Tokens | Works with |
|---|---|---|---|---|---|---|---|
| jobseek-error-reviewcolophon-group/jobseek | Command | 223 | yesterday | MIT | B | 58 | Claude Code |
| qa-changesOpenHands/extensions | Command | 176 | yesterday | MIT | A | 63 | Claude Code |
| http-serviceMadAppGang/magus | Command | 14 | yesterday | MIT | A | 27 | Claude Code |
| doctordoncheli/don-cheli-sdd | Command | 59 | 2mo ago | Apache-2.0 | A | 76 | Claude Code |
| doctorfatihkan/badi | Command | 7 | 1mo ago | MIT | A | 0 | Claude Code |
| fixstefan-jansen/claude-code-toolkit | Command | 92 | 4mo ago | MIT | A | 9 | Claude Code |
| debugcaptainluzik/oh-my-embedded | Command | 38 | 8mo ago | MIT | A | 13 | Claude Code |