Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/Genius-Cai/myunsw-cliWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/commands/genius-cai/myunsw-cli/myunsw)<a href="https://agentmods.dev/commands/genius-cai/myunsw-cli/myunsw"><img src="https://agentmods.dev/badge/commands/genius-cai/myunsw-cli/myunsw.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00000 | $0.02216 |
| Opus 5 | $0.00000 | $0.01108 |
| Sonnet 5 | $0.00000 | $0.00443 |
| Haiku 4.5 | $0.00000 | $0.00222 |
Grade D, and why
myunsw scanned grade D with 3 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Sends data to an external URLmediumData exfiltration
A POST to an outside endpoint may be telemetry or may be exfiltration; either way the mod talks to somewhere, and you should know where.
curl -s -L -b $COOKIE -d "bsdsSequence=$SEQ&year=$YEAR&bsdsSubmit-update-enrol=Update+Enrolment" "$ENR/years.xml" -o /tmp/c.html Downloads and executes remote codehighSupply chain
curl | sh runs whatever the server returns today, which is not necessarily what it returned when this was reviewed.
curl -s -b $COOKIE "$ENR/classes.xml?data=classes" | python3 -m json.tool Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
Automate myUNSW operations (enrollment, grades, timetable, fees, personal info) via AI agent + curl. How it starts
The opening of the file, as written. The whole thing — 226 lines — stays where its author put it; the contents beside it link to each section on GitHub.
myUNSW CLI — UNSW Student Portal Automation
Automate myUNSW operations (enrollment, grades, timetable, fees, personal info) via AI agent + curl.
Usage: /myunsw $ARGUMENTS
Examples:
/myunsw setup— First-time cookie setup/myunsw status— Check enrollment & timetable/myunsw grades— View all grades & WAM/myunsw enrol COMP1521— Start enrollment flow/myunsw fees— View fee statements/myunsw search COMP T2— Search classes/myunsw timetable— View current timetable as JSON/myunsw personal— View personal info/myunsw waitlist— Check waitlist positions
0. First-Time Setup
If /tmp/myunsw_active.txt doesn't exist or session is expired, ask the user:
Please log in to https://my.unsw.edu.au in your browser, then:
- Open DevTools (F12) → Application → Cookies → my.unsw.edu.au
- Copy
JSESSIONID(path must be/active, NOT/portal)- Copy
AWSALBandAWSALBCORSPaste all three values.
Then write cookie file:
cat > /tmp/myunsw_active.txt << 'COOKIE'
my.unsw.edu.au FALSE /active FALSE 0 JSESSIONID {VALUE}
my.unsw.edu.au FALSE / FALSE 0 AWSALB {VALUE}
my.unsw.edu.au FALSE / FALSE 0 AWSALBCORS {VALUE}
COOKIE
Validate:
curl -s -b /tmp/myunsw_active.txt 'https://my.unsw.edu.au/active/studentClassEnrol/years.xml' | grep -c 'bsdsSequence'
# 1 = valid, 0 = expired
1. Architecture
Session Layers
Browser → CAS SSO (sso.unsw.edu.au) → Portal (/portal JSESSIONID) — DON'T USE
→ Active (/active JSESSIONID) — USE THIS
BSDS Framework (Every Request)
1. GET page → extract bsdsSequence from hidden input
2. POST to SAME URL → bsdsSequence + bsdsSubmit-{action} + params
3. Follow 302 → next page
4. Repeat with fresh bsdsSequence
Rules:
- bsdsSequence increments every page load — always use freshest
- Stale sequence = silently ignored
- Sequential only — no parallel requests
- POST target = current URL, not destination
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 226 lines · 0 tokens per session scan D 797a0b75ffc7
myunsw is a command published in the GitHub repository Genius-Cai/myunsw-cli (2 stars, last pushed 6mo ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 2,216 tokens. A static security scan graded it D with 3 findings (sends data to an external url, downloads and executes remote code, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other commands, from other repositories
act
Live agentic desktop + browser control via OAuth (no API key).
crear-skill
Crear, probar y mejorar skills de forma iterativa. Usa cuando el usuario dice "crear skill", "crear habilidad", "build skill", "create a skill", "skill development", "desarrollar skill", "nueva habilidad". Usa el workflow: draft → test → review → improve → repeat con evaluación cuantitativa y qualitative review.
promote-lessons
Promote mature lessons to rules, consolidate agent-memory orphans, and prune stale entries. Run periodically or at session end.
post-task
Execute post-task cleanup, performance analysis, and memory storage.
setup-aliases
Add the following bash aliases to /.bashrc for quick Claude Code commands.
focus
Move a running agent's pane into your view (--new | --replace).