Borrowing it
Nothing to install: this file belongs to drabaioli/cdd. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/drabaioli/cdd/main/.claude/commands/cdd-retrofit.mdgit clone --depth 1 https://github.com/drabaioli/cddWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/commands/drabaioli/cdd/cdd-retrofit)<a href="https://agentmods.dev/commands/drabaioli/cdd/cdd-retrofit"><img src="https://agentmods.dev/badge/commands/drabaioli/cdd/cdd-retrofit/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/commands/drabaioli/cdd/cdd-retrofit"><img src="https://agentmods.dev/badge/commands/drabaioli/cdd/cdd-retrofit.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00000 | $0.09028 |
| Opus 5.5 | $0.00000 | $0.03611 |
| Sonnet 5.5 | $0.00000 | $0.01806 |
| Haiku 4.5 | $0.00000 | $0.00903 |
Grade B, and why
cdd-retrofit scanned grade B with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Reads agent configuration directoriesmediumAgent snooping
.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.
jq -n --slurpfile o "$STAGE/old/.claude/settings.json" \ Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
**Migrate into `.cdd/` — the third verdict.** A local hunk (the "local customization" or "both changed" rows) that swaps `gh issue …` / `gh pr …` for another backend (`jira`, `acli`, `glab`, `curl …atlassian.net/…`) is a How it starts
The opening of the file, as written. The whole thing — 362 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Install CDD into an existing project, or upgrade a project already running CDD, at the path given as argument: /cdd-retrofit <target-path>.
Run this command from a CDD-repo session (it needs the CDD repo's template/, bootstrap-cdd-project.sh, and git history). The mode — install or upgrade — is auto-detected from the target. This command exists only in the CDD repo; it deliberately has no counterpart in template/.claude/commands/ (it operates on target projects, so downstream projects have no use for it — see the process doc, Section 2.7).
Checkpoint discipline: nothing is written before the user has seen it. Clean, mechanical writes are collected into one batch, shown once before anything is written, and applied on a single approval; everything that needs judgement is approved per file (section 2.7). Never overwrite a project file silently. Identifier choices (name/slug/dir) are confirmed before anything is rendered. One approval is enough for the batch because every write lands on the dedicated retrofit branch (section 2.5) and reaches the project only through /cdd-pre-pr and a PR.
Target path: $ARGUMENTS
1. Resolve and validate the target
Resolve the argument to an absolute path. It must exist and be a directory; otherwise stop and report.
Check the target's git state:
git -C <target> rev-parse --is-inside-work-tree 2>/dev/null
git -C <target> status --porcelain 2>/dev/null
- If the target is not a git repo, warn the user (retrofit changes won't be revertable via git, and the isolated-worktree step in section 2.5 won't run) and ask whether to proceed.
- A dirty working tree no longer blocks the retrofit: section 2.5 writes into a fresh worktree branched from HEAD, so the target's current checkout is untouched. Do not hard-stop on a dirty tree. There is one nuance to warn about: because the worktree is taken from HEAD, any uncommitted local edits to the files the template ships (the two sets listed in section 4.4) are invisible to the upgrade comparison. If
git status --porcelainshows uncommitted changes to those files, tell the user to commit them first or they won't be considered, then let them decide whether to proceed.
Also note <target>/.gitignore: if any path the retrofit will write (.claude/, doc/, tools/) is gitignored, warn that those writes will not show in git status (and won't be staged by the retrofit commit in sections 3.4 / 4.7), and include this in the final summary.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- today Changed · +82 lines scan A → B dba356fc6450
- 6d ago Changed 5d4367b8b6f4
- 27d ago Changed 517bcf751a40
- 28d ago Changed 216f54fd9a24
- 29d ago Changed · +21 lines 8b7a58882160
- 1mo ago Changed · +14 lines 34e0b00f631c
- 1mo ago Changed · +34 lines 356dee30dc06
- 1mo ago Changed · +2 lines 3f9a5af137c3
- 2mo ago First seen · 209 lines · 0 tokens per session scan A f2cfd72edf37
cdd-retrofit is a command published in the GitHub repository drabaioli/cdd (2 stars, last pushed yesterday), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 9,028 tokens. A static security scan graded it B with 2 findings (reads agent configuration directories, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other commands, from other repositories
pdca-plan
Run only the PLAN phase of the PDCA framework (1a analysis, then 1b detailed plan).
pdca-act
Run only the ACT phase of the PDCA framework (retrospective and continuous improvement).
pdca-check
Run only the CHECK phase of the PDCA framework (completeness validation).
pdca-do
Run only the DO phase of the PDCA framework (TDD implementation with active oversight).
pdca
Run the full PDCA framework cycle (Plan, Do, Check, Act) — alias for the pdca-framework skill.
modernize-transform
Transform one legacy module to the target stack — idiomatic rewrite with behavior-equivalence tests.