Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add commands/hesreallyhim/ultracode-workflows/wf-exportgit clone --depth 1 https://github.com/hesreallyhim/ultracode-workflowsWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00022 | $0.00641 |
| Opus 5 | $0.00011 | $0.00320 |
| Sonnet 5 | $0.00004 | $0.00128 |
| Haiku 4.5 | $0.00002 | $0.00064 |
Grade A, and why
wf-export scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 41 lines — stays where its author put it; the contents beside it link to each section on GitHub.
/wf-export
Copy workflow scripts out of the plugin and into a project's .claude/workflows/, where they load un-namespaced (/deep-code-review rather than /ultracode-workflows:deep-code-review) and become the user's to edit.
Nothing here is an install step — the plugin's own copies already run as-is. Reach for this when someone wants to change a workflow: retune a lens pool, add a dimension, drop a verification round. What comes out is a fork, with everything that implies about who maintains it afterwards.
Arguments
$ARGUMENTS may name specific workflows, a destination, both, or neither:
bug-hunt deep-code-review— fork just those twointo ../other-project— all of them, elsewhere- (blank) — ask which ones before copying all 26; forking the whole library is rarely what someone wants, and every copy is one more file that stops tracking upstream
Resolve names loosely (bughunt, bug hunt → bug-hunt). If a name matches nothing, list the near misses rather than guessing.
What to do
- Read the source directory:
${CLAUDE_PLUGIN_ROOT}/workflows/. If it is missing or empty, say so and stop — do not fabricate scripts. - Resolve the destination —
<target>/.claude/workflows/, defaulting to the current project. If the target directory does not exist, stop and say so; do not create a tree at a mistyped path. - Check for existing files before writing. For each script already present at the destination:
- Identical to the source: skip it, mention it was already current.
- Different: this is very likely the user's own edit. Show what changed and ask before overwriting. Never silently clobber — editing is the whole reason these files are here.
- Copy the resolved scripts. Copy, don't symlink: the plugin cache path changes on update, and a symlink would rot.
- Report what happened — copied, skipped, overwritten, and the destination path.
After copying
Tell the user plainly:
- The copies are independent. Plugin updates will not touch them, and they now own the maintenance.
- They load un-namespaced, so both
/deep-code-reviewand/ultracode-workflows:deep-code-reviewwill exist and may drift apart. - Review each edit against the workflow-authoring skill's hard-contract checklist. In a checkout of this repository, also run
node scripts/lint-workflows.mjs .claude/workflows/<name>.jsfrom the repository root.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 41 lines · 22 tokens per session scan A fe0275f733aa
wf-export is a command published in the GitHub repository hesreallyhim/ultracode-workflows (2 stars, last pushed 25d ago), licensed MIT. It adds 22 tokens to every session and 641 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other commands, from other repositories
export-md
Export this session's conversation to a markdown file.
qec-setup
Run the guided first-time system setup and diagnostic audit with user approbation safety gate.
qec-theorem
Look up exact mathematical formulations and verification obligations for Theorems 1-16 from the Reference Manual.
qec-facts
Print the verified QECTOR platform fact sheet (surfaces, decoders, code families, MCP entry points, strict-math and honesty rules).
qec-reproduce
Look up and execute reference manual Appendix D (D.1 through D.6) reproduction workflows.
qec-validate-mcp
Validate live MCP connectivity of the QECTOR servers (library first-class, workbench optional) - initialize handshake + mcpstatus + tools/list diff, then a pass/warn/fail verdict.