Borrowing it
Nothing to install: this file belongs to saubakirov/trace-first-starter. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/saubakirov/trace-first-starter/master/.claude/commands/tfw-update.mdgit clone --depth 1 https://github.com/saubakirov/trace-first-starterWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/commands/saubakirov/trace-first-starter/tfw-update)<a href="https://agentmods.dev/commands/saubakirov/trace-first-starter/tfw-update"><img src="https://agentmods.dev/badge/commands/saubakirov/trace-first-starter/tfw-update.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00013 | $0.02110 |
| Opus 5 | $0.00006 | $0.01055 |
| Sonnet 5 | $0.00003 | $0.00422 |
| Haiku 4.5 | $0.00001 | $0.00211 |
Grade A, and why
tfw-update scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 158 lines — stays where its author put it; the contents beside it link to each section on GitHub.
TFW Update — Framework Upgrade Workflow
Role: Coordinator Trigger: Manually, when a new TFW version is available upstream Source:
tfw.upstreamin.tfw/project_config.yaml
Step −1: follow the target's workflow, not this file
As soon as the payload is pinned (Step 0), open .tfw/.upstream/.tfw/workflows/update.md and
follow it from Step 1 on. The installed copy is what the update replaces; once, an installed
1.x workflow drove a major update by a minor procedure.
Step 0: pin the source from the tag the operator names
Resolve tfw.upstream to a local Git checkout (clone a URL into .tfw/.upstream-source/; use a
local path as given). The operator names the target — a tag, or a commit when the owner
deliberately takes an untagged payload and says so in the checklist. Derive everything from it,
never from the source's HEAD: on a live source HEAD has moved past its release.
target_ref=v{target} # named by the operator
source_head=$(git -C {source} rev-parse --verify "$target_ref^{commit}")
target=$(git -C {source} show "$source_head:.tfw/VERSION")
test "$target_ref" = "v$target"
If the tag is missing or VERSION at that commit disagrees with its name, stop: the tag must
identify the payload. For a local source,
git -C {source} status --porcelain -- .tfw/ must print nothing; a dirty tasks/ is irrelevant.
Record target_ref, source_head, target and source path in the update checklist.
Materialize the pinned payload into .tfw/.upstream/ with git -C {source} archive "$source_head";
never copy the live working tree. In CL mode, present the resolved command.
Step 1: compare versions
Read the project's tfw.version and .tfw/.upstream/.tfw/VERSION. If equal, stop. Otherwise
list every intervening CHANGELOG entry; each entry's updating section names the earlier sections
a receiver on an older tag must also perform.
Step 2: route major migrations
If the target crosses a major version, read and follow .tfw/.upstream/.tfw/migrations/{major}.md
before continuing. A major release without that guide is incomplete.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago Changed · +1 lines deab790b6612
- 6d ago First seen · 157 lines · 13 tokens per session scan A d71cb18e009a
tfw-update is a command published in the GitHub repository saubakirov/trace-first-starter (29 stars, last pushed 3d ago), licensed MIT. It adds 13 tokens to every session and 2,110 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other commands, from other repositories
pr-handle
Check out a PR, rebase onto main, audit the skill diff for discovery misuse, triage open review comments, and validate skill changes.
squash-message
Generate a single squash commit message for the current PR.
pr-summary
Update the current PR description with a fresh summary.
release
Command "release" from voodootikigod/skills-check, covering arguments and steps.
github-swarm
Create a specialized swarm for GitHub repository management.
pr-enhance
Command "pr-enhance" from smith-horn/skillsmith, covering pr-enhance, usage, options, examples and fetch/manage pr data via the cli escape hatch.