Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/hmj1026/dhpkWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/commands/hmj1026/dhpk/matrix-cell-onboard)<a href="https://agentmods.dev/commands/hmj1026/dhpk/matrix-cell-onboard"><img src="https://agentmods.dev/badge/commands/hmj1026/dhpk/matrix-cell-onboard.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00088 | $0.00655 |
| Opus 5 | $0.00044 | $0.00328 |
| Sonnet 5 | $0.00018 | $0.00131 |
| Haiku 4.5 | $0.00009 | $0.00065 |
Grade B, and why
matrix-cell-onboard scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Reads agent configuration directoriesmediumAgent snooping
.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.
- Active dhpk modules: !`grep -A 20 '"modules"' .claude/settings.local.json 2>/dev/null | head -25` What it actually says
⚠️ Must read and follow the skill below before executing this command:
@skills/dhpk-matrix-cell-onboard/SKILL.md
Context
- composer.json: !
grep -E '"(php|laravel/framework|monolog/monolog|orchestra/testbench|phpunit/phpunit)"' composer.json 2>/dev/null | head -10 - workflow files: !
ls .github/workflows/ 2>/dev/null - Active dhpk modules: !
grep -A 20 '"modules"' .claude/settings.local.json 2>/dev/null | head -25
Arguments
| Parameter | Description |
|---|---|
<php> |
Target PHP version (e.g. 8.3) |
<laravel> |
Target Laravel major (e.g. 12) |
[phpunit] |
Optional explicit PHPUnit major; defaults to Laravel-compatible minimum |
[monolog] |
Optional explicit Monolog major; defaults to Laravel-compatible minimum |
If only <php> <laravel> are supplied, the skill derives the remaining
versions from the Laravel ↔ Testbench ↔ PHPUnit mapping table.
Prerequisites
| Prerequisite | Check |
|---|---|
library-author module enabled |
[email protected] in .claude/settings.local.json |
composer.json uses || across majors |
grep '||' composer.json returns hits in require |
.github/workflows/ has a matrix definition |
ls .github/workflows/ shows tests.yml or similar |
If library-author is not enabled, the skill still runs but cannot
auto-trigger the polyfill-reviewer sentinel on the resulting edits.
Enable it first via /dhpk:setup or by editing
.claude/settings.local.json.
Execution
Follow the SKILL.md procedure step-by-step. Do not skip step 4 (polyfill branch coverage) — it is the most common source of silent matrix-add regressions in multi-major libraries.
Output a single onboarding report matching the SKILL.md ## Output
template, then ask the user whether to apply the composer.json /
workflow YAML edits in this same session or defer to a follow-up.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 53 lines · 88 tokens per session scan B 71f9048d84c1
matrix-cell-onboard is a command published in the GitHub repository hmj1026/dhpk (2 stars, last pushed today), licensed MIT. It adds 88 tokens to every session and 655 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it B with 1 finding (reads agent configuration directories). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-05.
Other commands, from other repositories
review-before-deploy
Execute comprehensive pre-deployment review using code-review-agent with all relevant platform agents. Run complete deployment readiness checklist: verify all tests pass (unit, integration, E2E), security audit clean (no Critical/High issues), performance benchmarks met (Lighthouse > 90), TypeScript compilation…
review-before-deploy
Execute comprehensive pre-deployment review using code-review-agent with all relevant platform agents. Run complete deployment readiness checklist: verify all tests pass (unit, integration, E2E), security audit clean (no Critical/High issues), performance benchmarks met (Lighthouse > 90), TypeScript compilation…
partition-dev
Derive test cases from Z specification using TTF testing tactics.
ccc-audit
Run npm audit + bundle size check + lint scan. Returns vulnerabilities, oversized bundles, and lint errors.
validate
Mechanically validate the sonu plugin repo before a PR — manifest sync, YAML frontmatter, shell-fence syntax, named-source and AI-attribution scans, cross-reference integrity, skill reachability. Only meaningful inside the claude-plugins repo; in any other repo, say so and stop.
tdd
Test-driven development with observed red and green evidence.