Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add commands/dsswift/ion/update-vocabularygit clone --depth 1 https://github.com/dsswift/ionWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/commands/dsswift/ion/update-vocabulary)<a href="https://agentmods.dev/commands/dsswift/ion/update-vocabulary"><img src="https://agentmods.dev/badge/commands/dsswift/ion/update-vocabulary.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00019 | $0.00404 |
| Opus 5 | $0.00010 | $0.00202 |
| Sonnet 5 | $0.00004 | $0.00081 |
| Haiku 4.5 | $0.00002 | $0.00040 |
Grade A, and why
update-vocabulary scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
You are running the /update-vocabulary command.
Invocation arguments. The raw arguments passed to this invocation (referred to as ARGS throughout this document) are:
$ARGUMENTS
If the block above is empty, inspect changes on the current branch since the merge base with its source branch. Derive vocabulary work only from those changes. If ARGS is not empty, treat it as a concept, domain, path, or client surface and analyze that target.
Follow this procedure in order:
- Read
docs/vocabulary/terms.jsonanddocs/vocabulary/index.md. - Query the code graph first with
graphify query,graphify explain, orgraphify path. If graphify is unavailable, fall through to grep and source reads without comment. - Confirm every candidate fact in source. Record a
file:linecitation for each fact. - Inspect related domains and every other client surface for the same concept.
- Classify each finding as a new term, alias, legacy name, rename, deprecation, or no-change.
- Update only facts confirmed in source. Never invent a term that is not present in source. Every entry must trace to a real symbol, contract, or user-visible surface.
- Run
make generate-vocabulary, thenmake check-vocabulary. - Surface unresolved decisions to the operator with a recommendation for each.
Hard rules
- Never rename a code symbol, contract field, wire event, or public API as part of this command. Vocabulary registry changes are documentation-layer only. Report a needed code rename as a recommendation. It requires a separate explicit operator request.
- Do not add an entry until its source fact is confirmed.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- today Changed · -1 lines a15e9efd0b1a
- 5d ago First seen · 32 lines · 19 tokens per session scan A f1adf146fb98
update-vocabulary is a command published in the GitHub repository dsswift/ion (4 stars, last pushed yesterday), licensed MIT. It adds 19 tokens to every session and 404 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other commands, from other repositories
memory-self-review
Mine recent agent history (claude-mem + usage stats) for recurring failures and repeated patterns, audit MEMORY.md health, and PROPOSE (never apply) CLAUDE.md/memory edits for human approval.
code-review
Provide a code review for the given pull request.
echo
This is a placeholder command definition for plugin framework tests.
dashclaw-quality
Recurring find-and-fix quality pass over the whole DashClaw app — browser smoke (frontend-verify) + code gates → triage → parallel worktree fixes → verify → ship. The goal prompt that drives the dashclaw-find-and-fix workflow.
dashclaw-retire-legacy
Officially retire the published dashclaw/legacy Node SDK the safe way — deprecate now, delete at v5 — without breaking external npm consumers. Drives the legacy-sdk-deprecation-sweep workflow.
apply-self-review
Apply the approved improvements from the latest memory-self-review PROPOSAL. Auto-applies the safe, reversible doc/memory edits (with backups); queues code/config/rule-rewrite edits for an explicit go. Never commits or pushes.