Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/KirKruglov/claude-project-managerWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/commands/kirkruglov/claude-project-manager/risk-update)<a href="https://agentmods.dev/commands/kirkruglov/claude-project-manager/risk-update"><img src="https://agentmods.dev/badge/commands/kirkruglov/claude-project-manager/risk-update.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00007 | $0.00416 |
| Opus 5 | $0.00003 | $0.00208 |
| Sonnet 5 | $0.00001 | $0.00083 |
| Haiku 4.5 | $0.00001 | $0.00042 |
Grade A, and why
risk-update scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
Risk Update Command
Purpose
Periodically review and update the project risk register based on current project state, recent deviation data, and meeting discussions. Maintain risk mitigation strategies as project progresses.
Steps
-
Determine current phase
- Read
project-state.md - Confirm phase for context (risk register updates are active across all phases)
- Read
-
Retrieve current risk register
- Read
01-initiation/risk-register.md - Note current version and last update date
- Read
-
Gather recent evidence
- Read all deviation reports in
reports/(most recent first, up to last 30 days) - Read all meeting protocols in
meetings/(most recent first, up to last 3 meetings) - Identify emerging risks and risk status changes
- Read all deviation reports in
-
Trigger risk generation in update mode
- Call
generate-risk-registerskill with:mode=update(not initial)- Current risk register version
- Recent deviation report summaries
- Key discussion items from meetings
- Skill will review existing risks and recommend updates/additions
- Call
-
Present draft to user
- Display updated risk register as draft
- Highlight changes from previous version (new risks, closed risks, updated priorities)
- Show risk scoring changes
- Include mitigation strategy updates
-
Wait for user approval
- Request user review and approval of draft
- Allow user to comment or request modifications
- Do not proceed without explicit approval
-
Save updated register
- After approval, save updated register to
01-initiation/risk-register.md - Preserve version history (update version number incrementally)
- After approval, save updated register to
-
Update project state
- Update
project-state.mdwith:- Last risk review timestamp
- Risk register version
- Number of active risks by priority
- Log action in project audit trail
- Update
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 54 lines · 7 tokens per session scan A a1c58afa72e7
risk-update is a command published in the GitHub repository KirKruglov/claude-project-manager (6 stars, last pushed 4mo ago), licensed MIT. It adds 7 tokens to every session and 416 once invoked, about $0.0000 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other commands, from other repositories
project-estimate
Generate detailed project cost estimates with line items, labor, materials, contingency, and summary breakdowns.
change-order
Draft change order documentation with scope changes, cost impacts, schedule adjustments, and approval routing.
progress-report
Create weekly or monthly progress reports with milestone tracking, budget status, and risk assessments.
run-event-workflow
Manage event registrations, reminder cadence, post-event follow-up, and participation reporting.
client-update
Write a clear, reassuring client progress update from a few notes about where the job stands.
parallel
You are executing the /hydra:parallel command. Start multiple agents simultaneously in different worktrees.