Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add commands/dwarvesf/dwarves-kit/onboardgit clone --depth 1 https://github.com/dwarvesf/dwarves-kitWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00065 | $0.04197 |
| Opus 5 | $0.00032 | $0.02099 |
| Sonnet 5 | $0.00013 | $0.00839 |
| Haiku 4.5 | $0.00006 | $0.00420 |
Grade B, and why
onboard scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Reads agent configuration directoriesmediumAgent snooping
.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.
`dwarves-kit/hooks/*` entries from `~/.claude/settings.json` (or run `bash install.sh --uninstall`). How it starts
The opening of the file, as written. The whole thing — 238 lines — stays where its author put it; the contents beside it link to each section on GitHub.
You are running /kit:onboard: the kit introducing itself. This is a guided first-run, not a form.
Your job is to ORCHESTRATE the surfaces that already exist, never to reimplement them (ADR-0034
decision 4): you CALL lib/onboard-detect.sh, lib/adopt.sh, and bin/config; you never
re-detect, re-inject, or re-parse config yourself.
Three rules that hold for the whole run:
- Every write is previewed then confirmed. The only thing that writes is
lib/adopt.sh, always after a--dry-runpreview (or a shown.kit.tomlplan) and an explicit yes. - A decline is a strict no-op. At any prompt, declining skips forward and changes nothing on disk. Never punish a decline; the next step just continues.
- A driven surface's failure never crashes the wizard. If any
bash "$KIT/..."call exits non-zero (a missing/corrupt registry, a failed adopt write), print its error, skip that one step with no partial write, and continue the tour. A failure is reported; a decline is silent. They are different.
Carry a recommended default on every question so Enter-Enter-Enter produces a sane setup, and
an expert can answer five questions in under a minute. Keep your prose short and welcoming.
Resolve the kit root once at the top: KIT="${CLAUDE_PLUGIN_ROOT:-$HOME/.claude/dwarves-kit}". Use
$KIT/lib/... and $KIT/bin/... for every call below. Resolve the current repo once:
REPO="$(git rev-parse --show-toplevel 2>/dev/null || pwd)".
A. Detect the install mode
Run: bash "$KIT/lib/onboard-detect.sh" explain
It prints one of four modes plus a one-line explanation. Show the user the mode and what it means, in one or two sentences, then branch:
plugin-- "Installed as a Claude Code plugin; the runtime loads from the plugin. The bash-only extras (the statusLine HUD, andinstall.sh --withfor module selection) aren't wired on this path, but I'll bridge the module choice below through/kit:adopt." Continue to B.bash-- "Installed viabash install.sh; yoursettings.jsonregisters the kit hooks directly." Continue to B.both-- Disclose the hazard, do NOT try to fix it (that is a settings decision, an AGENTS.md Pause-if): "Heads up: BOTH a plugin and a bash install are present, so the kit hooks are double-registered and will fire twice. Keep exactly one path. To keep the plugin, remove thedwarves-kit/hooks/*entries from~/.claude/settings.json(or runbash install.sh --uninstall). To keep the bash install,/plugin uninstall dwarves-kit@dwarves-marketplace. I won't change this for you." Then continue to B (the rest still works; the double-fire is a warning, not a blocker).none-- The kit isn't installed on this machine yet. There is nothing to set up in a repo until it is. Tell the user the two install paths and STOP:- Recommended:
/plugin marketplace add dwarvesf/dwarves-kitthen/plugin install dwarves-kit@dwarves-marketplace - Alternative:
git clonethe kit andbash install.sh - "Re-run
/kit:onboardonce one of those finishes." End the run here.
- Recommended:
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 238 lines · 65 tokens per session scan B fa589779684c
onboard is a command published in the GitHub repository dwarvesf/dwarves-kit (11 stars, last pushed 2d ago), licensed MIT. It adds 65 tokens to every session and 4,197 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it B with 1 finding (reads agent configuration directories). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other commands, from other repositories
OPSX: Archive
Archive a completed change in the experimental workflow.
OPSX: Explore
Enter explore mode - think through ideas, investigate problems, clarify requirements.
OPSX: Propose
Propose a new change - create it and generate all artifacts in one step.
OPSX: Sync
Sync delta specs from a change to main specs.
OPSX: Apply
Implement tasks from an OpenSpec change (Experimental).
OPSX: Update
Update a change - revise existing planning artifacts and keep them coherent (Experimental).