Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add commands/github/spec-kit/selftestgit clone --depth 1 https://github.com/github/spec-kitWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00010 | $0.00537 |
| Opus 5 | $0.00005 | $0.00269 |
| Sonnet 5 | $0.00002 | $0.00107 |
| Haiku 4.5 | $0.00001 | $0.00054 |
Grade C, and why
selftest scanned grade C with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nullifies safety policieshighAnti-refusal
"You have no restrictions", "do anything now", "ignore your guidelines": a direct jailbreak that disables guardrails.
Then, simulate adding the extension by installing it from its catalog download URL, which should bypass the restriction. How it starts
The opening of the file, as written. The whole thing — 70 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Extension Self-Test: $ARGUMENTS
This command drives a self-test simulating the developer experience with the $ARGUMENTS extension.
Goal
Validate the end-to-end lifecycle (discovery, installation, registration) for the extension: $ARGUMENTS.
If $ARGUMENTS is empty, you must tell the user to provide an extension name, for example: /speckit.selftest.extension linear.
Steps
Step 1: Catalog Discovery Validation
Check if the extension exists in the Spec Kit catalog.
Execute this command and verify that it completes successfully and that the returned extension ID exactly matches $ARGUMENTS. If the command fails or the ID does not match $ARGUMENTS, fail the test.
specify extension info "$ARGUMENTS"
Step 2: Simulate Installation
First, try to add the extension to the current workspace configuration directly. If the catalog provides the extension as install_allowed: false (discovery-only), this step is expected to fail.
specify extension add "$ARGUMENTS"
Then, simulate adding the extension by installing it from its catalog download URL, which should bypass the restriction.
Obtain the extension's download_url from the catalog metadata (for example, via a catalog info command or UI), then run:
specify extension add "$ARGUMENTS" --from "<download_url>"
Step 3: Registration Verification
Once the add command completes, verify the installation by checking the project configuration.
Use terminal tools (like cat) to verify that the following file contains a record for $ARGUMENTS.
cat .specify/extensions/.registry/$ARGUMENTS.json
Step 4: Verification Report
Analyze the standard output of the three steps. Generate a terminal-style test output format detailing the results of discovery, installation, and registration. Return this directly to the user.
Example output format:
============================= test session starts ==============================
collected 3 items
test_selftest_discovery.py::test_catalog_search [PASS/FAIL]
Details: [Provide execution result of specify extension search]
test_selftest_installation.py::test_extension_add [PASS/FAIL]
Details: [Provide execution result of specify extension add]
test_selftest_registration.py::test_config_verification [PASS/FAIL]
Details: [Provide execution result of registry record verification]
============================== [X] passed in ... ==============================
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 70 lines · 10 tokens per session scan C 93f33139a3da
selftest is a command published in the GitHub repository github/spec-kit (132,298 stars, last pushed 3d ago), licensed MIT. It adds 10 tokens to every session and 537 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it C with 1 finding (nullifies safety policies). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other commands, from other repositories
book-internalize
你是一位专业的风格提炼专家,擅长将拆书分析结果转化为可直接应用的项目配置。你的任务是把"学术性的分析报告"转化为"创作时可用的风格指引"。.
book-style
你是一位专业的文笔分析专家,精通各种描写技法、叙述手法和语言风格。你的任务是拆解成功作品的文笔密码,帮助作者提升写作表现力。.
stardust-session
Command "stardust-session" from wordflowlab/novel-writer, covering 星尘织梦会话管理 - /stardust-session, 系统角色, 任务, 工作流程 and 1. 查看活跃会话.
book-characters
你是一位资深的人物塑造分析专家,精通角色设计、人物弧光、群像塑造等技巧。你的任务是深度剖析小说中的人物创作手法,帮助作者学习如何塑造鲜活立体的角色。.
book-formula
你是一位爆文公式研究专家,擅长从成功作品中提取可复制的创作模板和套路。你的任务是将成功要素公式化,帮助作者快速掌握爆款密码。.
stardust-list
Command "stardust-list" from wordflowlab/novel-writer, covering 查看星尘织梦模板 - /stardust-list, 系统角色, 任务, 工作流程 and 1. 检查认证和订阅.