Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add commands/sbom-tool/gh-guard/check-updatesgit clone --depth 1 https://github.com/sbom-tool/gh-guardWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/commands/sbom-tool/gh-guard/check-updates)<a href="https://agentmods.dev/commands/sbom-tool/gh-guard/check-updates"><img src="https://agentmods.dev/badge/commands/sbom-tool/gh-guard/check-updates.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00019 | $0.00780 |
| Opus 5 | $0.00010 | $0.00390 |
| Sonnet 5 | $0.00004 | $0.00156 |
| Haiku 4.5 | $0.00002 | $0.00078 |
Grade A, and why
check-updates scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 87 lines — stays where its author put it; the contents beside it link to each section on GitHub.
/check-updates — SHA Pin Staleness Checker
Check deployed GitHub Actions workflow files for outdated SHA pins by comparing against the latest tags.
Workflow
Step 1: Find Deployed Workflows
Load templates/versions.json from the gh-guard plugin directory as the source of truth for expected versions. Then scan .github/workflows/*.yml for all uses: lines that reference SHA-pinned actions.
Extract each action reference into a list:
actions/checkout@de0fac2e... (comment: v6.0.2)
dtolnay/rust-toolchain@efa25f... (no version comment)
Step 2: Check Each Action for Updates
For each unique action, query the latest release or tag:
# Get latest release tag
gh api repos/OWNER/REPO/releases/latest --jq '.tag_name' 2>/dev/null
# Get the SHA for a tag
gh api repos/OWNER/REPO/git/ref/tags/TAG --jq '.object.sha' 2>/dev/null
Compare the pinned SHA against the latest tag's SHA.
Rate limiting: GitHub API has rate limits. Cache results for actions that appear in multiple workflows. If rate-limited, show what was checked and suggest re-running later.
Step 3: Check CLI Tool Versions
For workflows that install CLI tools (e.g., cargo install cargo-audit --version X.Y.Z):
- Extract the pinned version
- Check latest version on crates.io:
cargo search cargo-audit --limit 1 - Flag if a newer version exists
Step 4: Generate Report
## SHA Pin Status Report
### Actions
| Action | Pinned | Current | Latest | Status |
|--------|--------|---------|--------|--------|
| actions/checkout | de0fac2... | v6.0.2 | v6.0.2 | ✅ Up to date |
| dtolnay/rust-toolchain | efa25f7... | master | master | ✅ Up to date |
| ossf/scorecard-action | 4eaacf0... | v2.4.3 | v2.5.0 | ⚠️ Update available |
### CLI Tools
| Tool | Pinned | Latest | Status |
|------|--------|--------|--------|
| cargo-audit | 0.21.2 | 0.22.0 | ⚠️ Update available |
### Update Instructions
For each outdated action:
1. Verify the changelog: `gh api repos/OWNER/REPO/releases/latest --jq '.body' | head -20`
2. Get the new SHA: `gh api repos/OWNER/REPO/git/ref/tags/TAG --jq '.object.sha'`
3. Update the `uses:` line and version comment in the workflow
4. Update `templates/VERSIONS.md` if using gh-guard templates
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 87 lines · 19 tokens per session scan A 0b246e5b84f9
check-updates is a command published in the GitHub repository sbom-tool/gh-guard (15 stars, last pushed 5mo ago), licensed MIT. It adds 19 tokens to every session and 780 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other commands, from other repositories
monitor-ci
You are the orchestrator for monitoring Nx Cloud CI pipeline executions and handling self-healing fixes. You spawn the ci-monitor-subagent subagent to poll CI status and make decisions based on the results.
actions
Command "actions" from openclaw/crabbox, covering actions, subcommands, hydrate, register and dispatch.
dart-fix-ci
Command "dart-fix-ci" from dartsim/dart, covering required reading, workflow and output.
access
Apply the CLI runtime and safety contract before executing a command. Runtime --help is authoritative.
check-release-health
Summarize the CI health of an OpenShift release using live data from the openshift-ci-mcp server.
cf-scaffold-project
Scaffold a Cloudflare project — Worker, Pages, or Worker+D1+R2 starter — with Wrangler config, Terraform skeleton, and GitHub Actions deploy using scoped API tokens.