Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add commands/sfc-gh-eraigosa/dotfiles/syncgit clone --depth 1 https://github.com/sfc-gh-eraigosa/dotfilesWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/commands/sfc-gh-eraigosa/dotfiles/sync)<a href="https://agentmods.dev/commands/sfc-gh-eraigosa/dotfiles/sync"><img src="https://agentmods.dev/badge/commands/sfc-gh-eraigosa/dotfiles/sync.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00017 | $0.00869 |
| Opus 5 | $0.00009 | $0.00434 |
| Sonnet 5 | $0.00003 | $0.00174 |
| Haiku 4.5 | $0.00002 | $0.00087 |
Grade A, and why
sync scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 39 lines — stays where its author put it; the contents beside it link to each section on GitHub.
You are running the /sync workflow — a thin wrapper around the git-safe-sync skill for the common "commit + push to main" path.
Current state
!git status --short --branch
Pending diff (stats)
!git diff --stat
!git diff --cached --stat
Recent commits (for tone/style)
!git log --oneline -5
Arguments (optional commit subject hint): $ARGUMENTS
Required workflow
Follow the git-safe-sync skill rules strictly. The sequence below is mandatory — do not collapse turns.
- Research (this turn): summarize what would be committed and propose a commit message. If
$ARGUMENTSis non-empty, use it as the subject; otherwise infer a Conventional Commits subject from the diff. Group co-changing files; flag any that look unrelated and should be split. - Confirm (this turn): present the user with explicit options via
AskUserQuestion: Commit & Push to main, Open a PR instead, Commit only, or Cancel. Do NOT execute any git/gss command yet. - Execute (next turn, only after the user picks an option):
- Stage files by explicit name (never
git add -A/git add .). - Commit using a HEREDOC message that ends with
Co-Authored-By: Claude Opus 4.7 (1M context) <[email protected]>. - For Push: generate the approval token as a separate Bash call (
mkdir -p ~/.config/gss && git rev-parse HEAD > ~/.config/gss/approval.token), then rungss pushas a second Bash call. Chaining them with&&is intentionally blocked bysafety_guard.sh. If the pushed branch already has an open PR,gss pushupdates the branch but NOT the PR body — you MUST then refresh it withgh pr edit <number> --title/--bodyso the description covers every commit now on the PR (re-derive What/Why/Impact/Testing fromgit log <base>..HEAD). Leaving a stale description is an incomplete sync. - For PR: use the same two-call pattern with
gss prinstead ofgss push. Per the skill's PR Hygiene rule, you MUST pass a real description —gss pr --title "<subject>" --body "<What/Why/Impact/Testing markdown>".gss prdoes not infer a body, so omitting--bodyships an empty PR description. (gss prhas no--draftflag; classic PRs are created ready-for-review.)
- Stage files by explicit name (never
- Surface (post-execution): show the commit SHA, the safety backup branch, and the GitHub compare/PR URL. If you pushed to an existing PR, confirm its description was refreshed to match the new scope. Then ask whether to open the URL in the browser — to open it, run the
open-url <url>helper (opt/scripts/misc/open-url), which selects the right opener per platform (openon macOS,wslview/explorer.exeunder WSL,xdg-openon Linux). If it exits non-zero (e.g. headless session), just leave the link visible.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 39 lines · 17 tokens per session scan A 4af5648d0828
sync is a command published in the GitHub repository sfc-gh-eraigosa/dotfiles (46 stars, last pushed today), licensed Apache-2.0. It adds 17 tokens to every session and 869 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other commands, from other repositories
activate
Command "activate" from 1shooperman/claude-env, covering claudenv <name>, usage, what it does, the default env and errors.
config
Command "config" from 1shooperman/claude-env, covering claudenv config, usage, what it does, naming rules and errors.
remove
Command "remove" from 1shooperman/claude-env, covering claudenv remove, usage, what it does and errors.
upgrade
Upgrade claudenv to a specific release or the latest version.
deactivate
Deactivate the current env and restore the original CLAUDECONFIGDIR.
list
Command "list" from 1shooperman/claude-env, covering claudenv list, usage and output.