Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/rjmurillo/ai-agentsnpx agentmods add commands/rjmurillo/ai-agents/syncWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/commands/rjmurillo/ai-agents/sync)<a href="https://agentmods.dev/commands/rjmurillo/ai-agents/sync"><img src="https://agentmods.dev/badge/commands/rjmurillo/ai-agents/sync/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/commands/rjmurillo/ai-agents/sync"><img src="https://agentmods.dev/badge/commands/rjmurillo/ai-agents/sync.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00041 | $0.01192 |
| Opus 5.5 | $0.00016 | $0.00477 |
| Sonnet 5.5 | $0.00008 | $0.00238 |
| Haiku 4.5 | $0.00004 | $0.00119 |
Grade C, and why
sync scanned grade C with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Hidden instructionshighPrompt injection
Directives inside HTML comments, invisible characters or bidirectional overrides are read by the model and not by the person reviewing the file.
- **Intentional forward reference**: the spec names a planned path that does not exist yet. Mark the line with a trailing `<!-- sync-drift-ignore -->` so the detector skips it. How it starts
The opening of the file, as written. The whole thing — 92 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Sync Command
Sync: $ARGUMENTS
The forward path (/spec -> /plan -> /build) turns intent into code. There is no clean reverse path. When you hand-edit code (refactor, hotfix, taste change), the spec drifts silently and the staleness surfaces only at /review time, late and often misattributed as "the spec was wrong" instead of "the spec needs updating". /sync closes that loop: it finds the drift while you still remember why you made the change.
What this slice does
This command detects Spec->Code drift and reports it. It does NOT auto-rewrite specs. Detection runs; patch proposal is a follow-up (see Step 3).
Triggers
| Phrase | Action |
|---|---|
/sync |
Scan all spec tiers for stale code references |
/sync .agents/specs/design |
Scan one spec tier |
detect spec drift |
Run the detector and report drift |
Process
Step 1: Detect drift
Run the drift detector against the specification tier:
python3 scripts/sync/detect_spec_drift.py --output-format human
The detector scans .agents/specs/requirements, .agents/specs/design, and .agents/specs/tasks for backticked references to code and artifact paths (scripts/..., build/scripts/..., .claude/skills/..., .claude/commands/..., templates/..., tests/..., src/...). Each reference is resolved against the working tree. A reference to a path absent on disk is drift: the spec points at code that moved or was deleted.
To scan one tier only, pass --target:
python3 scripts/sync/detect_spec_drift.py --target .agents/specs/design --output-format human
Exit codes (per ADR-035): 0 no drift, 1 drift found, 2 configuration error. Unsafe --target values (absolute paths, .., or symlink escapes) return exit 2. Unsafe spec references are reported as drift instead of probing outside the repo.
Step 2: Triage the findings
For each DRIFT line the detector reports (spec_file:line -> path absent on disk), decide which case applies:
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 92 lines · 41 tokens per session scan C f6e8579a330a
sync is a command published in the GitHub repository rjmurillo/ai-agents (49 stars, last pushed today), licensed MIT. It adds 41 tokens to every session and 1,192 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it C with 1 finding (hidden instructions). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other commands, from other repositories
focused-fix
Deep-dive feature repair — systematically fix an entire feature/module. Usage: /focused-fix.
recover-orphans
Scan for pipeline-orphaned issues stuck in intermediate workflow states and recover them — diagnose each orphan's actual GitHub state, apply recovery actions, clean up worktrees.
audit
Trace a production issue or pipeline failure end-to-end through GitHub artifacts, then file a detailed improvement issue to the Forge repo.
diagnose
Trace a failed or stalled pipeline run — identify which FORGE annotation is missing or malformed, diagnose the failure point, and suggest specific remediation steps.
compat-audit
On-demand Claude Code compatibility and feature parity report — compares installed version against the breakpoints registry and lists affected ForgeDock features.
incident-response
Coordinate P0 incident response — hotfix validation, timeline reconstruction, and post-incident analysis.