Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add commands/harery/octalume/lifecycle-scangit clone --depth 1 https://github.com/Harery/OCTALUMEWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/commands/harery/octalume/lifecycle-scan)<a href="https://agentmods.dev/commands/harery/octalume/lifecycle-scan"><img src="https://agentmods.dev/badge/commands/harery/octalume/lifecycle-scan.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00009 | $0.01310 |
| Opus 5 | $0.00005 | $0.00655 |
| Sonnet 5 | $0.00002 | $0.00262 |
| Haiku 4.5 | $0.00001 | $0.00131 |
Grade A, and why
lifecycle_scan scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 238 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Run Security and Compliance Scans
Run comprehensive security and compliance scans for $ARGUMENTS.
Scan Types
1. SAST (Static Application Security Testing)
Scan source code for security vulnerabilities:
# Using Snyk
snyk test
snyk monitor
# Using SonarQube
sonar-scanner
# Using Semgrep
semgrep --config=auto src/
Output: Security vulnerabilities in source code with severity ratings
2. SCA (Software Composition Analysis)
Scan dependencies for known vulnerabilities:
# Using Snyk
snyk test --dev
# Using Dependabot
dependabot check
# Using npm audit
npm audit
# Using pip-audit
pip-audit
Output: Vulnerable dependencies with upgrade recommendations
3. DAST (Dynamic Application Security Testing)
Scan running application for runtime vulnerabilities:
# Using OWASP ZAP
zap-cli quick-scan --self-contained http://localhost:3000
zap-cli active-scan http://localhost:3000
# Using Burp Suite
burp-scan http://localhost:3000
Output: Runtime vulnerabilities with exploit details
4. Container Security
Scan Docker images for vulnerabilities:
# Using Trivy
trivy image myapp:latest
# Using Clair
clair-scanner myapp:latest
# Using Snyk
snyk container test myapp:latest
Output: Container image vulnerabilities
5. Infrastructure as Code Security
Scan Terraform/CloudFormation for security issues:
# Using tfsec
tfscan .
# Using checkov
checkov -d .
# Using Snyk Infrastructure
snyk iac test .
Output: Infrastructure security misconfigurations
6. Compliance Scans
Check compliance with regulations:
# HIPAA compliance check
python scripts/compliance/hipaa_check.py
# SOC 2 compliance check
python scripts/compliance/soc2_check.py
# PCI DSS compliance check
python scripts/compliance/pci_dss_check.py
# GDPR compliance check
python scripts/compliance/gdpr_check.py
Output: Compliance status with gap analysis
Scan Workflow
- Start Application: Ensure application is running:
source scripts/init.sh
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 238 lines · 9 tokens per session scan A 033772ebb126
lifecycle_scan is a command published in the GitHub repository Harery/OCTALUME (2 stars, last pushed 1mo ago), licensed MIT. It adds 9 tokens to every session and 1,310 once invoked, about $0.0000 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other commands, from other repositories
evidence
Export a signed compliance evidence package as JSON or PDF for regulatory handoff.
comply
Run a full EU AI Act compliance scan on your Python AI project.
at-nisg
You are helping an enterprise architect generate an Austrian NISG 2026 Compliance Assessment — the Austrian transposition of NIS2 (EU Directive 2022/2555). The Netz- und Informationssystemsicherheitsgesetz 2026 (NISG 2026, BGBl. I Nr. 94/2025) is a standalone act (not a mere amendment of the NISG 2018). It was passed…
at-dsgvo
You are helping an enterprise architect generate an Austrian Data Protection Assessment — the Austrian-specific GDPR layer applied by the Datenschutzbehörde (DSB) under the Datenschutzgesetz (DSG 2018, BGBl. I Nr. 165/1999 as amended). Run this after /arckit:eu-rgpd to add Austrian obligations that go beyond the EU…
agent-governance
Design AI agent governance — oversight models, approval workflows, audit requirements, compliance mapping.
au-energy-compliance
You are an enterprise architect generating an Australian energy-sector compliance architecture pack for a project, platform, service, or operating model with potential distribution, transmission, retail, metering, market, gas, DER, customer, or system-operator obligations.