Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add commands/mostashraf/ai-sdlc-harness/analyzegit clone --depth 1 https://github.com/MostAshraf/ai-sdlc-harnessWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/commands/mostashraf/ai-sdlc-harness/analyze)<a href="https://agentmods.dev/commands/mostashraf/ai-sdlc-harness/analyze"><img src="https://agentmods.dev/badge/commands/mostashraf/ai-sdlc-harness/analyze.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00000 | $0.00649 |
| Opus 5 | $0.00000 | $0.00324 |
| Sonnet 5 | $0.00000 | $0.00130 |
| Haiku 4.5 | $0.00000 | $0.00065 |
Grade A, and why
analyze scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 48 lines — stays where its author put it; the contents beside it link to each section on GitHub.
/story-workflow analyze
Pre-refinement readiness check. Evaluates a work item against quality criteria and produces a readiness report with actionable flags. Standalone and non-destructive — it never rewrites the story.
For most sessions
improveis the better choice — it folds readiness analysis into refinement in one adaptive pass. Reach foranalyzewhen you want a standalone report to share with the PO before touching the story.
Steps
- Fetch the work item per
shared/provider-io.md. Extract title, type, state, description, and acceptance criteria. If it isn't found, stop. - Domain context (optional): skim
shared/context.mdonly if you need the repo landscape to judge whether the story's scope is realistic. - Evaluate the story against every dimension in
templates/readiness-report.md. For each, assign a 🔴/🟡/🟢 flag with a specific explanation. Rules:- Be specific, not generic. Not "ACs could be improved" but "AC #2 says
'handles errors gracefully' — untestable; suggest 'Given an invalid token,
When login is attempted, Then a 401 with code
AUTH_INVALID_TOKENis returned'." - UI ACs must name observable DOM semantics. "the Next button is
disabled" reads two defensible ways — rendered carrying
disabled, or not rendered at all — and each yields incompatible code AND incompatible tests. Flag it and draft the specific one (field: two independent runs of one story read exactly that AC in opposite directions and shipped mutually incompatible work, each internally consistent). Same for "shows an error", "the row is highlighted", "the field is cleared". - Suggest, don't only critique. Every 🔴/🟡 carries a concrete fix — draft the replacement text where you can.
- Constructive tone. The PO and team will read this.
- Be specific, not generic. Not "ACs could be improved" but "AC #2 says
'handles errors gracefully' — untestable; suggest 'Given an invalid token,
When login is attempted, Then a 401 with code
- Write the report in the
templates/readiness-report.mdformat: flags with explanations, suggested improvements (draft Given/When/Then ACs where ACs are missing or vague), and a 2–3 sentence summary assessment. - Present the full report in the conversation, then ask whether to post it
as a comment on the item. On yes, post it per
shared/provider-io.md. Forlocal-markdown(or any provider), the report is a comment — never overwrite the story with it; if the user wants it persisted separately, offer a sibling file (e.g.<id>-readiness.md) via theWritetool.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 48 lines · 0 tokens per session scan A a5a4f8aba04f
analyze is a command published in the GitHub repository MostAshraf/ai-sdlc-harness (18 stars, last pushed 9d ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 649 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other commands, from other repositories
add-phase
Add phase to end of current milestone in roadmap.
insert-phase
Insert urgent work as decimal phase (e.g., 72.1) between existing phases.
remove-phase
Remove a future phase from roadmap and renumber subsequent phases.
research-phase
Research how to implement a phase (standalone — usually use /pbr:plan-phase instead).
reapply-patches
Reapply local modifications after a PBR update.
update
Update PBR to latest version with changelog display.