Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add commands/openclaw/crabbox/rungit clone --depth 1 https://github.com/openclaw/crabboxWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00000 | $0.10458 |
| Opus 5 | $0.00000 | $0.05229 |
| Sonnet 5 | $0.00000 | $0.02092 |
| Haiku 4.5 | $0.00000 | $0.01046 |
Grade B, and why
run scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks for rootmediumPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
non-interactive `sudo -n`; Crabbox never elevates the workload, grants How it starts
The opening of the file, as written. The whole thing — 829 lines — stays where its author put it; the contents beside it link to each section on GitHub.
run
crabbox run syncs the current dirty checkout to a box, runs a command there,
streams the output back, and exits with the remote command's exit code. It is
the core verb: lease (or reuse) a machine, ship your code, run something, get
the result.
crabbox run --id swift-crab -- pnpm test:changed
crabbox run --class beast -- pnpm check
crabbox run --provider aws --class beast --market on-demand -- pnpm check
crabbox run --provider azure --class beast -- pnpm check
crabbox run --provider azure --arch arm64 --class fast -- go test ./...
crabbox run --tailscale -- pnpm check
crabbox run --id swift-crab --network tailscale -- pnpm test
crabbox run --browser -- google-chrome --headless --version
crabbox run --desktop --browser --shell 'echo "$DISPLAY"; "$BROWSER" --version'
crabbox run --id swift-crab --shell 'pnpm install --frozen-lockfile && pnpm test'
crabbox run --id swift-crab --script ./scripts/live-smoke.sh
crabbox run --id swift-crab --full-resync -- pnpm check:changed
crabbox run --label "update flow smoke" -- pnpm test:changed
crabbox run --slug update-flow-smoke -- pnpm test:changed
crabbox run --pond alpha --slug web -- pnpm test:integration
crabbox run --fresh-pr example-org/my-app#123 --script ./scripts/e2e-smoke.sh
crabbox run --id cbx_abcdef123456 --junit junit.xml -- go test ./...
crabbox run --provider ssh --target macos --static-host mac-studio.local -- xcodebuild test
crabbox run --provider ssh --target windows --windows-mode normal --static-host win-dev.local -- dotnet test
crabbox run --profile live-qa --preset qa-live --scenario login-regression --emit-proof /tmp/proof.md --stop-after success
crabbox run --pool example/app/main/linux --pool-compatibility-key linux-16-vcpu -- pnpm test
crabbox run --pool example/app/main/linux --pool-identity-file pool-identity.json -- pnpm test
The trailing command after -- is sent to the box verbatim as argv. Use
--shell to run it through the remote shell instead, for multi-statement
snippets, pipes, or shell expansion.
On POSIX and WSL2 SSH targets, private command staging does not change the remote caller's umask for user work. Commands keep the target shell's creation policy; Crabbox's staged scripts, input, and workspace-owner state remain private. Keeping or reusing a POSIX SSH lease also preserves the remote caller's SIGINT and SIGQUIT dispositions, including intentionally ignored signals.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 829 lines · 0 tokens per session scan B 07f4bc020454
run is a command published in the GitHub repository openclaw/crabbox (1,343 stars, last pushed 2d ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 10,458 tokens. A static security scan graded it B with 1 finding (asks for root). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other commands, from other repositories
merge
Finalize work on a branch: verify docs + tree are clean, merge to main, clean up. Supports both standard git checkout -b branches and git worktree flows — auto-detected at pre-flight.
expect
Diff-aware AI browser testing — reads the git diff, maps changes to affected pages via the route map, generates a targeted test plan, and executes it via agent-browser (Rust daemon + CDP, ARIA-tree-first) with pass/fail reporting. Use when testing UI changes, verifying PRs before merge, or running regression checks on…
speckit.tasks
Generate an actionable, dependency-ordered tasks.md for the feature based on available design artifacts.
dev
Runs Vendure in development mode. By default it starts three processes: the GraphQL server (ts-node ./src/index.ts), the worker (ts-node ./src/index-worker.ts), and the dashboard (a Vite dev server).
start
Runs a project that has already been compiled with vendure build.
pipeline-undo
Undo a pipeline run's result. With worktree isolation (the current engine), this is clean and low-risk: a run never touches your checkout — its result lives only on a pipeline/ branch (and, for a --push run, on the remote). "Undo" therefore means deleting that branch and its worktree, not reverting your working tree.