Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/deepfusionlabs/deep-initWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/commands/deepfusionlabs/deep-init/plugin-update)<a href="https://agentmods.dev/commands/deepfusionlabs/deep-init/plugin-update"><img src="https://agentmods.dev/badge/commands/deepfusionlabs/deep-init/plugin-update/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/commands/deepfusionlabs/deep-init/plugin-update"><img src="https://agentmods.dev/badge/commands/deepfusionlabs/deep-init/plugin-update.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00037 | $0.01021 |
| Opus 5.5 | $0.00015 | $0.00408 |
| Sonnet 5.5 | $0.00007 | $0.00204 |
| Haiku 4.5 | $0.00004 | $0.00102 |
Grade A, and why
plugin-update scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 34 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Bring the running DeepInit up to date. Claude Code has no first-party "pull the latest plugin" command — the request (anthropics/claude-code#38271) was closed as not-planned, so this command IS that flow. Do this:
-
Detect the install kind:
- Marketplace install (the plugin loads from
~/.claude/plugins/) → go to step 2. - Local clone (you're running this repo's
skills/deep-init/directly) → there is nothing to fetch; skip to step 4 (a reload just picks up your local edits).
- Marketplace install (the plugin loads from
-
Detect your host first — it changes BOTH how you update and how you activate. Read your runtime host from your system context (e.g. a note that you're "running inside a VSCode native extension environment"), then follow only the matching block. Resolve the target
deep-init@<marketplace>— read the marketplace alias from the installed plugin state under~/.claude/plugins/, else fall back to thenamein.claude-plugin/marketplace.json.- VS Code / JetBrains extension → the chat panel does not shell out and the
claudeCLI is not on its PATH, so do not present a bare-shellclaude plugin updatehere. Update through the in-extension UI: open the/pluginmanager → Plugins tab → selectdeep-init→ Update / reinstall. - Plain terminal / CLI → refresh the catalog FIRST, then update, in the shell:
Refresh first, or the update quietly does nothing: if the catalog isn't refreshed,/plugin marketplace update <marketplace> # refresh the catalog so the newest version is visible claude plugin update deep-init@<marketplace> # pull the newest to disk (reversible; updates installed_plugins.json)claude plugin updatecompares against the stale advertised version, treats the old one as newest, and silently no-ops with no error — you'll believe it updated when nothing changed. If it reports "nothing to update" but the version didn't move, re-run themarketplace updateand try again. - Desktop app / web → there's no shell either; update through the
/pluginmanager (selectdeep-init→ Update / reinstall), same as the extension.
- VS Code / JetBrains extension → the chat panel does not shell out and the
-
Confirm before changing anything. State exactly what will run and that it changes host plugin state (not your repo, not git, reversible). Then WAIT for an explicit yes — never run it on assumption. On yes, perform the update for the detected host — run
claude plugin update deep-init@<marketplace>via the shell only in the plain terminal; in every other host drive the/pluginUI — and report the old → new version. -
Activate it — the one step left for you (a command can't self-invoke a reload). The update pulled the new version to disk; it is staged but not yet running, because Claude Code loads plugin markdown ONCE per session. Your single remaining action depends on your host:
- Plain terminal / CLI → run
/reload-plugins, or (more reliable for a command/version flip) start a new session. A reload picks up skills and hooks but does not rebuild the slash-command index (#37862), so the version canary may not flip from it — a new session is the sure path. - VS Code / JetBrains extension → restart the IDE itself — a full quit + reopen.
Developer: Reload Windowdoes not reload the plugin host (nor does opening a new chat in the same window), so the freshly-updated version stays invisible until a true app restart. - Desktop app / web → fully restart the app (or reload the session) — a window reload alone is not enough.
- Plain terminal / CLI → run
-
Confirm it flipped. After you reload/restart, run
/deep-init:version— the LOADED line should now equal the on-disk version (it reports what's actually running, so it's the honest check that activation worked).
For a full active-vs-installed-vs-newest diagnosis across every plugin (and duplicate-shadow detection), /oss-kit:oss-plugin-doctor owns that.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 34 lines · 37 tokens per session scan A c8aba32bcd90
plugin-update is a command published in the GitHub repository deepfusionlabs/deep-init (6 stars, last pushed 23d ago), licensed MIT. It adds 37 tokens to every session and 1,021 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other commands, from other repositories
feedback
A design-stage security review for product requirement documents and other planning documents; a PRD is a document describing what a product should do.
compliance
A follow-up security check that verifies whether earlier findings were fixed and, depending on the selected mode, looks for new problems.
va
A read-only security review of a codebase across eight architecture areas, with findings checked against file-and-line evidence.
pentest
A read-only penetration-testing command for examining source code from an attacker’s perspective and producing proof-of-concept checks. Penetration testing is authorized security testing that tries to verify exploitable weaknesses.
redteam
A read-only review of infrastructure settings, infrastructure-as-code, and CI/CD pipelines using MITRE ATT&CK attack paths. MITRE ATT&CK is a catalogue of techniques attackers use, while CI/CD means the automated process that builds, tests, and deploys software.
run
A security-workflow coordinator that turns a natural-language request into a plan involving code review, verification, attack testing, or reporting.