Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add commands/omermaksutii/rugproof/explaingit clone --depth 1 https://github.com/omermaksutii/RugProofWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00018 | $0.00417 |
| Opus 5 | $0.00009 | $0.00209 |
| Sonnet 5 | $0.00004 | $0.00083 |
| Haiku 4.5 | $0.00002 | $0.00042 |
Grade A, and why
explain scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
/explain — explain a finding
For $ARGUMENTS (finding ID like REENT-001), produce a plain-English explanation.
Default audience: engineer
Assume the reader is a competent Solidity engineer but not a security specialist. Cover:
- What the finding is (one sentence, no jargon).
- Why it matters (concrete impact: "anyone can drain the vault", "the admin can pause withdrawals forever", etc.).
- How it works (short walkthrough of the exploit).
- What to do (the fix, with a code diff if appropriate).
- Related real-world incidents (cite if found in
c4-history/sherlock-history).
Audience: beginner
For --audience=beginner, soften:
- Explain technical terms inline (reentrancy → "when a function pauses in the middle and a sneaky caller jumps in to drain it").
- Use analogies (e.g. "withdrawing from an ATM that gives you cash before subtracting the balance").
- Skip "EIP-712 domain separator" details; focus on the user impact.
Audience: exec
For --audience=exec:
- One paragraph max.
- Lead with the dollar value at risk and the probability of exploitation.
- Skip the code; just describe risk.
- Compare to a known incident the reader is likely to recognize ("similar to the $X exploit of Y in 20ZZ").
Notes
- Don't be condescending to beginners.
- For executives, don't soften — they need the truth to make budget calls.
- If the finding ID isn't in the current audit context, ask the user for it or remind them to run
/auditfirst.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 41 lines · 18 tokens per session scan A 47b6252e679c
explain is a command published in the GitHub repository omermaksutii/RugProof (9 stars, last pushed 1mo ago), licensed MIT. It adds 18 tokens to every session and 417 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other commands, from other repositories
phase6-start
Command "phase6-start" from kota1026/quantum-shield, covering phase 6 $arguments 開始, step 1: 進捗状況を確認, step 2: 未完了画面を特定, step 3: 必須ファイルを読み込む and step 4: インフラ確認.
codespace-verify
Command "codespace-verify" from kota1026/quantum-shield, covering codespaces ui確認コマンド, 1. codespaces起動確認, サービス起動状態確認, postgresql, redis, rabbitmqが起動していない場合 and フロントエンド起動.
pr-merge
Command "pr-merge" from kota1026/quantum-shield, covering pr作成・マージコマンド, 1. 変更確認, 2. コミット（未コミットがある場合）, 3. pr作成 and 4. マージ.
krait
Run a complete multi-phase security audit on the target codebase.
krait-init
Standalone readiness check before running /krait. Verifies tools, project shape, gitignore, MCP wiring, and /.claude install. Reports what's missing — does NOT install or modify anything.
audit
Attacker-minded security audit of scoped files. Traces auth + money-path data flows, streams compact findings incrementally (never one giant end-of-session JSON dump). Usage: /audit [attack-class].