Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add commands/lantisprime/claude-sdlc/token-reviewgit clone --depth 1 https://github.com/lantisprime/claude-sdlcWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/commands/lantisprime/claude-sdlc/token-review)<a href="https://agentmods.dev/commands/lantisprime/claude-sdlc/token-review"><img src="https://agentmods.dev/badge/commands/lantisprime/claude-sdlc/token-review.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00041 | $0.00562 |
| Opus 5 | $0.00020 | $0.00281 |
| Sonnet 5 | $0.00008 | $0.00112 |
| Haiku 4.5 | $0.00004 | $0.00056 |
Grade A, and why
token-review scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 46 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Produce a token-usage review to guide skill/prompt optimization.
Inputs
.claude/sdlc/token-log.json— snapshot of the most recent session (overwritten eachStop).claude/sdlc/token-history.jsonl— one JSON object per session, rolling
If neither file exists, tell the user token tracking is disabled and point them at config/tools.json → token_tracking.enabled = true. Do not invent data.
Analysis to run
Use Read for small files. For token-history.jsonl over ~500 lines, use jq via Bash to avoid loading the whole file into context.
Report these sections, in this order:
-
Last run summary
- Task slug and completion time
- Per-phase table:
input | output | cache_creation | cache_read - Totals row
- Cache hit ratio per phase:
cache_read / (cache_read + cache_creation)
-
Cross-run trends (only if ≥3 entries in history)
- Mean output tokens per phase (across all runs)
- Mean cache hit ratio per phase
- Phases where output tokens are trending up over the last 5 runs (flag as regression candidates)
-
Optimization candidates — top 3, ranked by expected impact
- For each: phase name, the signal that flagged it, one concrete suggestion (which skill/template to tighten, or which context to stop re-loading)
- Example flags:
- High
cache_creationwith lowcache_read→ context is churning; skill probably re-reads files on every invocation - High
outputrelative to phase norm → skill's output structure too loose; tighten template - High
inputwith low cache usage → prompt includes fresh content each call; candidate for system-prompt promotion
- High
-
Unattributed bucket (if non-zero)
- Flag it — means tokens were spent without a gate being signed, which is a process issue, not a token issue
What NOT to do
- Do not propose pricing or dollar figures. The hook records raw tokens only; pricing coefficients are intentionally out of scope.
- Do not suggest edits to skills or templates directly from this command — surface candidates only. Actual changes go through the normal Plan → Build flow.
- Do not draw conclusions from a single run. Note sample size in the report; recommend ≥5 runs before acting on trends.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 46 lines · 41 tokens per session scan A a946d1e87e25
token-review is a command published in the GitHub repository lantisprime/claude-sdlc (3 stars, last pushed 4mo ago), licensed MIT. It adds 41 tokens to every session and 562 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other commands, from other repositories
waterfall:quit
Cleanly stops the active workflow (shutdown teammates, marker cleanup, state preservation).
resume
Resumes an interrupted workflow at the current step.
review
Code review with security and @MX tag compliance check.
tax-review
Tax-filing compliance check — invokes tax-reviewer to produce TM-tax-{slug}.md with MeF e-file schema, Form 8879, PTIN/Circular 230, and IRC §7216 consent gaps.
test-feature
Test a React Native feature on the running simulator/emulator. Verifies UI, user flows, and internal state. Generates a persistent Maestro test file.
paper-trail-search
Search the validated registry for references matching a topic (author, title, year, slug). Returns only refs in state page1validated or sotacitedconfirmed by default — i.e. references that have been technically validated (PDF acquired, page 1 OK) or fully audited (content validated against PDF). Used by sota-writer /…