Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add commands/dhslegen/digital-delivery-team/implgit clone --depth 1 https://github.com/dhslegen/digital-delivery-teamWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00045 | $0.01727 |
| Opus 5 | $0.00023 | $0.00864 |
| Sonnet 5 | $0.00009 | $0.00345 |
| Haiku 4.5 | $0.00005 | $0.00173 |
Grade B, and why
impl scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Reads agent configuration directoriesmediumAgent snooping
.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.
[ -f "$DDT_PLUGIN_ROOT/bin/aggregate.mjs" ] || DDT_PLUGIN_ROOT=$(cat "${HOME}/.claude/delivery-metrics/.ddt-plugin-root" 2>/dev/null) How it starts
The opening of the file, as written. The whole thing — 171 lines — stays where its author put it; the contents beside it link to each section on GitHub.
/impl
M6.4 重大变更:v0.6.x 用 frontend-agent + backend-agent 同消息并行派发(黑盒);v0.7.0 改为串行调用 /build-api → /build-web,每步 main thread 流式可见,每步用户决策门。
彻底解决:
- 工时不可证明(lookback join 并发错配)
- 黑盒(subagent 黑盒派发,用户看不到)
- 用户失语(盲盒严重)
输入:$ARGUMENTS
Phase 1 — 前置校验
test -f docs/api-contract.yaml || { echo "❌ 请先运行 /design"; exit 1; }
[ -f "$DDT_PLUGIN_ROOT/bin/aggregate.mjs" ] || DDT_PLUGIN_ROOT=$(cat "${HOME}/.claude/delivery-metrics/.ddt-plugin-root" 2>/dev/null)
[ -f "$DDT_PLUGIN_ROOT/bin/aggregate.mjs" ] || DDT_PLUGIN_ROOT="${HOME}/.claude/plugins/marketplaces/digital-delivery-team"
[ -f "$DDT_PLUGIN_ROOT/bin/aggregate.mjs" ] || { echo "❌ DDT plugin root 未解析"; exit 1; }
export DDT_PLUGIN_ROOT
if printf '%s' "$ARGUMENTS" | grep -q -- '--dry-run'; then
node "$DDT_PLUGIN_ROOT/bin/print-dry-run.mjs" --phase impl --inputs "docs/api-contract.yaml,.ddt/tech-stack.json,docs/design-brief.md (spa)" --outputs "server/,web/" --next "/verify" --notes "编排命令: 串行调用 /build-api → 决策门 → /build-web"
exit 0
fi
node "$DDT_PLUGIN_ROOT/bin/emit-phase.mjs" --phase impl --action start
"$DDT_PLUGIN_ROOT/bin/check-blockers.sh" || exit 2
# 契约 lint 硬门禁
if command -v npx >/dev/null 2>&1; then
npx --yes @redocly/cli lint docs/api-contract.yaml || exit 4
else
echo "OpenAPI lint tool missing"; exit 5
fi
串行执行流程
Step 1: 后端实现(除非 --web-only)
if ! printf '%s' "$ARGUMENTS" | grep -q -- '--web-only'; then
echo "▶ 进入后端实现:/build-api"
# 透传 --module / --auto / --refresh
fi
main thread 调用 /build-api $ARGUMENTS_FILTERED(过滤掉 --web-only)。
/build-api 内部走 6-phase(EXPLORE → PLAN → APPROVE → IMPLEMENT → VERIFY → SUMMARY)+ 决策门:
- 用户在 PLAN 阶段批准 plan
- IMPLEMENT 每 step validation + checkpoint
- SUMMARY 后决策门 4 选项
未传 --auto 时 main thread 必须等待 build-api 决策门返回 accept 才进入 Step 2。
Step 2: 前端实现(除非 --api-only)
if ! printf '%s' "$ARGUMENTS" | grep -q -- '--api-only'; then
echo "▶ 进入前端实现:/build-web"
fi
main thread 调用 /build-web $ARGUMENTS_FILTERED(过滤掉 --api-only)。
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 171 lines · 45 tokens per session scan B 94d4135c38a7
impl is a command published in the GitHub repository dhslegen/digital-delivery-team (1 stars, last pushed 3mo ago), licensed MIT. It adds 45 tokens to every session and 1,727 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it B with 1 finding (reads agent configuration directories). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other commands, from other repositories
release
Cut a Pureinn framework release - inspect changes, propose version bump + message, confirm, then publish (bump, commit, push, tag, GitHub Release). The website rebuilds automatically.
design-to-code
Mockup-to-component pipeline using Google Stitch, 21st.dev, and Storybook MCP. Accepts a screenshot, a description, or a URL and produces production-ready React components, checking existing Storybook components before generating anything new. Use when implementing UI from a mockup or screenshot. To call the MCP tool…
specsmd-construction-agent
Command "specsmd-construction-agent" from fabriqaai/specs.md, covering activate construction agent, activation, parameters, critical first steps and your skills.
fire
FIRE orchestrator - Fast Intent-Run Engineering main entry point.
brand-setup
Configure a new brand profile with colors, fonts, logo, visual style, platforms, and compliance rules.
save
Save this conversation as a new or existing reusable context.