Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/HermeticOrmus/LibreEmbed-Claude-CodeWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/commands/hermeticormus/libreembed-claude-code/safety)<a href="https://agentmods.dev/commands/hermeticormus/libreembed-claude-code/safety"><img src="https://agentmods.dev/badge/commands/hermeticormus/libreembed-claude-code/safety/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/commands/hermeticormus/libreembed-claude-code/safety"><img src="https://agentmods.dev/badge/commands/hermeticormus/libreembed-claude-code/safety.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00025 | $0.00836 |
| Opus 5.5 | $0.00010 | $0.00334 |
| Sonnet 5.5 | $0.00005 | $0.00167 |
| Haiku 4.5 | $0.00003 | $0.00084 |
Grade A, and why
safety scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 15d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 110 lines — stays where its author put it; the contents beside it link to each section on GitHub.
/safety
Safety-critical firmware command: MISRA analysis, defensive patterns, watchdog, certification.
Trigger
/safety <action> [options]
Actions
analyze
Analyze C code for MISRA violations and safety issues.
/safety analyze --file src/motor_control.c --ruleset misra-2012
/safety analyze --dir src/ --level required-mandatory --output report.txt
enforce
Rewrite a function to be MISRA compliant.
/safety enforce --function process_command --rule 15.5
/safety enforce --function set_register --rule 11.3
report
Generate a deviation report for a known violation.
/safety report --rule 11.5 --file hal_wrapper.c --line 42 --reason "HAL requires void*"
certify
Generate a certification evidence checklist.
/safety certify --standard iec-61508 --sil 2
/safety certify --standard do-178c --dal B
Process
- Identify applicable safety standard and required integrity level.
- Configure static analysis tool with the MISRA ruleset.
- Run analysis on all source files.
- Categorize violations: fix immediately (mandatory) or document deviation (required/advisory).
- Write deviation records for each documented suppression.
- Verify 100% statement coverage with gcov or Polyspace.
Output Examples
cppcheck MISRA check
# Install: pip install cppcheck (or package manager)
cppcheck --enable=all --std=c11 \
--addon=misra.json \
--suppressions-list=misra_suppressions.txt \
--xml --xml-version=2 \
src/ 2> misra_report.xml
MISRA deviation log entry
Deviation Record: DEV-2024-011
Rule: MISRA C:2012 Rule 11.5
File: src/hal_wrapper.c, line 42
Violation: Cast from void* to SPI_HandleTypeDef*
Justification: STM32 HAL API requires void* parameter. Type is
verified by handle initialization in MX_SPI1_Init().
Risk: Low. Type mismatch would cause fault at initialization,
not silently at runtime.
Test: TC-HAL-001: SPI loopback test verifies correct operation.
Approved: J. Smith, 2024-03-15
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 15d ago First seen · 110 lines · 25 tokens per session scan A 5bb4fdbcdb1e
safety is a command published in the GitHub repository HermeticOrmus/LibreEmbed-Claude-Code (50 stars, last pushed 6d ago), licensed MIT. It adds 25 tokens to every session and 836 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-01.
Other commands, from other repositories
debug
A command-line debugging toolkit for embedded programs using J-Link or OpenOCD, tools that connect a computer to a microcontroller for inspection.
la
A command for capturing and decoding signals with a Saleae logic analyzer, a device that records electrical digital signals over time. It supports buses such as UART, SPI, and I2C, which are common ways chips communicate with peripherals.
flash
A command for writing firmware to a microcontroller using OpenOCD, a tool that programs chips through a connected debugging probe.
test
A command for generating and running tests for embedded C code, either on a computer or on a physical development board. It creates both runnable test code and a written list of test cases.
map
A parser for Keil compiler map files, which are build reports describing where program code and data are placed in memory. It reports object sizes, memory regions, symbols, and stack or heap details.
verify
An embedded-device verification workflow that checks a development step through building, flashing firmware, debugging with J-Link, and reading serial logs. Firmware is software that runs directly on a microcontroller or other device.