Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add commands/skymanbp/cc-enforcer/checklistgit clone --depth 1 https://github.com/skymanbp/cc-enforcerWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00054 | $0.05750 |
| Opus 5 | $0.00027 | $0.02875 |
| Sonnet 5 | $0.00011 | $0.01150 |
| Haiku 4.5 | $0.00005 | $0.00575 |
Grade A, and why
checklist scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
C1 · 重触发原症状 ✅ $ curl -X POST /login concurrent x100 → 0 errors (修前 23 errors) How it starts
The opening of the file, as written. The whole thing — 199 lines — stays where its author put it; the contents beside it link to each section on GitHub.
/cc-enforcer:checklist
强制纪律检查。无参数则同时输出 A "改前"、B "改后"、C "收敛验证"、D "任务忠实"、E "改前必读·写前必想"、F "系统式修改"、G "大白话 TL;DR 收尾"、H "全库同步" 八份清单； 参数为
before/after/converge/fidelity/pre-edit/systematic/tldr/sync则只输出对应一份。
请你（receiving agent）逐项核对以下检查清单，并明确回答每一条 ✅ / ❌ / N/A。
不要笼统地说"都做了"——每一条都要单独写明依据（file:line 或具体动作）。
A. 修改前自检（参考 rules/01,02,04）
- A1 · 完整阅读 — 我即将修改的文件是否在本会话内
Read过完整内容？引用：<file>在本会话第 N 次工具调用读过。 - A2 · 影响面探查 — 我是否
Grep过该文件被引用的所有位置？引用：列出 grep 命令与命中。 - A3 · 上下游 Read — 对所有调用点是否
Read过上下文？至少对 top-3 调用点。 - A4 · 七问完成 — 是否回答了规则 02 的 7 个问题（架构定位 / 职责 / 根源 / 方案触底 / 连带 / 风险 / 全局）？请简述每个回答。
- A5 · 验证未猜测 — 修改方案中所有关于 API、版本、行为的断言是否有验证依据？引用：每个断言对应的
Read/Grep/命令输出。 - A6 · 最小有效更改 — 这次修改是否只做被要求的事，没有顺手重构、没有投机抽象？
B. 修改后自检（参考 rules/03,05）
- B1 · 根因 vs 症状 — 这次修改是否触达根本原因？是否避免了 try/except 静默、
--no-verify、time.sleep掩盖竞态、@ts-ignore屏蔽类型？ - B2 · 全部连带项已处理 — 修改文件 X 后，所有需要同步改的下游、测试、文档是否一并改了？请列出。
- B3 · 新引入的不变量已记录 — 如果修改建立了新的不变量（"X 永远不为 null"、"必须先获取锁"），是否在代码注释或文档里说明？
- B4 · 引用可追溯 — 我描述这次修改时是否每一个代码位置都附
file:line、每一条外部断言都附链接/章节？ - B5 · 半成品检查 — 是否留下任何 "TODO"、"FIXME"、"暂时这样"？如有，是否在回复中明确告知用户？
C. 收敛验证（参考 rules/06） —— 完成 B 之后必走 ⚠️
声称"已完成"之前必须全部 ✅。任意一项 ❌ → 未收敛，回到规则 02 重新分析。
- C1 · 重触发原症状 — 用用户最初描述失败的同一条命令 / 同一份输入重新跑一次，附完整输出。原报错 / 原异常已消失？引用：粘贴前后命令 + 输出对照。
- C2 · 边界 + 反向用例 — 跑了至少 1 个边界场景（空 / 异常 / 并发 / 跨平台路径 / Unicode）+ 1 个反向用例（明确应该 fail 的仍 fail）？引用：列出每个测试与结果。
- C3 · 连带不破坏 — 跑了既有测试套件 / lint / 类型检查；附输出。引用："
pytest tests/ → 22 passed" 等。 - C4 · 自答 4 题（强制） —
- C4.1 · 是不是真的解决了问题？ 我有什么具体证据？这条证据如何排除"巧合 / 缓存 / 环境差异"？
- C4.2 · 有没有更好的解决方法？ 与替代方案在 简洁性 / 性能 / 可维护性 / 与现有架构契合度 上的对比是？为什么不选那种？
- C4.3 · 改动是否经过验证？ 哪一行代码 / 哪一个连带项没被 C1-C3 触达？为什么不需要？
- C4.4 · 验证是否合理？ 我跑的测试 / 命令对应了原问题的哪个机理？是否覆盖了根因（rule 03）的因果链？
- C5 · 量化证据（仅当涉及性能 / 竞态 / 兼容性时）— "快了" 给数字、"稳定了" 重跑 N≥10 次、"兼容了" 列出测试矩阵。
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 199 lines · 54 tokens per session scan A 77392b76eeda
checklist is a command published in the GitHub repository skymanbp/cc-enforcer (5 stars, last pushed 7d ago), licensed MIT. It adds 54 tokens to every session and 5,750 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other commands, from other repositories
brooks-audit
Run a Brooks-Lint architecture audit.
todo
The quality-gated task list: tasks with real descriptions, testable acceptance criteria, and evidence — a task only closes when the controller agrees it is done.
release
The pre-tag controller: version sync, changelog, clean tree, gate, and suite — every failure listed, the tag printed, never run.
security
The security pass: secrets (blocking), SAST, dependency vulns — plus the index's entry points to review from.
git
The pre-finish status: branch, hygiene findings, message checks, workflow lint, template state.
init
Install the formatters this repository needs, with every command visible before it runs.