Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/fatihkan/badiWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/commands/fatihkan/badi/health)<a href="https://agentmods.dev/commands/fatihkan/badi/health"><img src="https://agentmods.dev/badge/commands/fatihkan/badi/health.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00000 | $0.01040 |
| Opus 5 | $0.00000 | $0.00520 |
| Sonnet 5 | $0.00000 | $0.00208 |
| Haiku 4.5 | $0.00000 | $0.00104 |
Grade A, and why
health scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 121 lines — stays where its author put it; the contents beside it link to each section on GitHub.
System health check. Audits dependencies, security, performance, and (if present) the production domain with a triple scan.
Badi CLI Commands
These checks use the following CLI commands (v1.6+):
badi doctor— Badi installation validationbadi secret-scan— Secret/credential scan (17 patterns)badi ssl [domain]— Production SSL certificate (if any)badi dns [domain]— Email security (SPF/DMARC/CAA)badi lighthouse [url]— Core Web Vitalsbadi a11y [url]— WCAG 2.1 compliance
Required Tools
- Bash (npm audit, system commands)
- Read (configuration files)
- Glob (project file scan)
- Grep (pattern search)
- Agent (security-scanner: security scan, performance-profiler: performance analysis)
Scheduling
Running this command is especially recommended after /start on Monday mornings.
A weekly health-check routine keeps the project healthy.
Check 1: Dependency Audit
Step 1: Detect the Package Manager
- If
package.jsonexists, use npm/yarn/pnpm - If
Cargo.tomlexists, use cargo - If
pyproject.tomlorrequirements.txtexists, use pip
Step 2: Run the Audit Scan
- Run
npm audit --jsonon npm projects - Additionally run
badi secret-scan— 17-pattern secret scan (working tree) - Classify results by severity (critical, high, moderate, low)
- List packages that need updating
Step 3: Dependency Status Assessment
- GREEN: No critical or high severity issues
- YELLOW: Only moderate severity issues
- RED: Critical or high severity issues present
Check 2: Security Scan
Step 4: Invoke the Security-Scanner Agent
Run the security-scanner agent via the Agent tool:
- Scan code for hardcoded secrets (.env, API keys, tokens)
- Check security headers (CORS, CSP, X-Frame-Options)
- Review the auth configuration
- Look for known vulnerability patterns (SQL injection, XSS vectors)
Step 5: Security Status Assessment
- GREEN: No known security issues
- YELLOW: Low-risk findings or improvement suggestions
- RED: Critical vulnerability detected
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- today First seen · 121 lines · 0 tokens per session scan A 261891c25575
health is a command published in the GitHub repository fatihkan/badi (7 stars, last pushed yesterday), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 1,040 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-06.
Other commands, from other repositories
canary
Post-deploy monitoring — watch production after a deploy and alert on regressions.
audit-agents-skills
Audit quality of agents, skills, and commands in a Claude Code project.
land-and-deploy
Merge PR, wait for CI, verify deploy, run canary — the complete landing pipeline.
qa
Systematic QA testing of a web application — diff-aware, tiered, with fix-and-verify loop.
review-pr
Perform a comprehensive code review of a pull request.
security-audit
Comprehensive security audit with scored posture assessment.