Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/sifxprime/kodelyth-eccWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/commands/sifxprime/kodelyth-ecc/immune)<a href="https://agentmods.dev/commands/sifxprime/kodelyth-ecc/immune"><img src="https://agentmods.dev/badge/commands/sifxprime/kodelyth-ecc/immune/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/commands/sifxprime/kodelyth-ecc/immune"><img src="https://agentmods.dev/badge/commands/sifxprime/kodelyth-ecc/immune.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00026 | $0.00939 |
| Opus 5.5 | $0.00010 | $0.00376 |
| Sonnet 5.5 | $0.00005 | $0.00188 |
| Haiku 4.5 | $0.00003 | $0.00094 |
Grade A, and why
immune scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 90 lines — stays where its author put it; the contents beside it link to each section on GitHub.
/immune — the arena's findings, made executable
The arena finds bugs one repository at a time and remembers them as prose. Prose
does not scan a codebase. /immune turns each confirmed class into a
detector that runs, so a bug proven here can be found anywhere — including in
repositories that never ran the arena.
kodelythecc immune # scan the current directory
kodelythecc immune scripts/ # scan a subtree
kodelythecc immune --json # machine-readable
kodelythecc immune --tests # include test files (normally skipped)
Exits non-zero when anything high is found, so it drops straight into CI.
What it looks for
Every detector below encodes a class that was reproduced with a real repro during an arena run. Nothing here is hypothetical.
| Detector | Confirmed | What it catches |
|---|---|---|
lexical-containment |
5× | startsWith(root) with no realpath — a symlink inside the root passes while pointing anywhere on disk |
prototype-key-map |
1× | map['constructor'] is truthy, so if (!map[k]) never fires |
truncate-then-write |
3× | writeFileSync on durable state truncates to zero before writing |
predictable-temp-name |
1× | a pid-derived temp path can be pre-planted with a symlink |
How each detector earns its place
A detector ships only if it does both:
- FIRES on the exact source the arena found the bug in
- Goes SILENT on the source after the fix
Both halves matter. A detector that misses the real bug is decoration; one that
still fires after the fix is a false positive. The fixtures in
tests/immune/detectors.test.js are real code quoted from this repository at
v2.7.0 — the last release before any arena fix landed.
Two classes were deliberately NOT shipped
This matters more than the four that were.
ReDoS. The class is real: an unbounded quantifier cost 7.6 s on 293 KB. But arena run #1 measured five structurally identical regexes in one file — the fenced-code, inline-code, bare-URL and file-path patterns were all linear, and only the link-target pattern was quadratic. The difference is whether the closing delimiter is commonly absent in real input: a property of the data, not the pattern, and invisible to a scanner. A detector would have flagged all five and been wrong about four.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 90 lines · 26 tokens per session scan A ea668e370fcd
immune is a command published in the GitHub repository sifxprime/kodelyth-ecc (11 stars, last pushed 14d ago), licensed MIT. It adds 26 tokens to every session and 939 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-07.
Other commands, from other repositories
fix-issues
Diagnose, reproduce, then fix reproducible open GitHub issues in parallel: one clean worktree/issue; symlink build artifacts to avoid rebuilds.
investigate
Establish the proven causal chain for the target — from the observed symptom to the root cause that actually explains it — and write a report a fixer or planner can act on without repeating your work. You change nothing and fix nothing: the repository must be exactly as you found it when you finish. No one watches the…
maintainer-review-error-handling
Review the PR for error-handling correctness — surfaced errors, no silent swallows, consistent error patterns (Pi-tuned).
review-errors
Find either defect: a real failure crosses the changed code and becomes indistinguishable from success to the caller, operator, or user who must react; or it escapes its owning item and aborts independent work. Not every error needs logging; recovery is correct when the contract permits it and the right owner can…
toh-fix
Evidence-first debugging — find the root cause with proof before touching code.
check-drift
Run verification and drift checks on the AI knowledge-base to identify missing documentation or stale references.