migrate-optimizely

A command for moving an Optimizely setup to Confidence, including access settings, feature flags, and code changes. Optimizely and Confidence are platforms for controlling features and experiments in software.

In plain words
What is it for?
Use it to plan, adjust, or execute the migration of teams, roles, groups, policies, flag settings, and related application code.
Why use it?
It separates reviewing a migration plan from applying changes, so you can inspect or adjust proposed users, flags, and code before writing them.

Command

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add commands/spotify/confidence-ai-plugins/migrate-optimizely
Clone the repo
git clone --depth 1 https://github.com/spotify/confidence-ai-plugins
Per session 73 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.
When invoked 1,063 The whole file, excluding the scripts and references it only reads on demand.
Security scan B 1 finding. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00073 $0.01063
Opus 5 $0.00036 $0.00531
Sonnet 5 $0.00015 $0.00213
Haiku 4.5 $0.00007 $0.00106

Measured 2d ago against content hash b0c527d6e1cd, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade B, and why

migrate-optimizely scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Reads agent configuration directoriesmediumAgent snooping

.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.

For **`execute flags`**, find `.claude/plans/optimizely-flag-migration-*.md`. After flag create completes, **ASK** the targeting-rules import handoff (`[1] Start targeting-rules import` suggested). After rules import com
commands/migrate-optimizely.md · 45 lines

What it actually says

All migration instructions are in skills/migrate-optimizely/SKILL.md and skills/migrate-optimizely/access.md.

Default: If the user runs /migrate-optimizely with no arguments (or only whitespace), treat it as plan access — start Phase 0 from the beginning. Same for natural language like “migrate from Optimizely” with no phase named.

Same split: plan/adjust write the file, execute performs writes.

Plan (file only) Execute (writes)
plan access (users/teams/roles and Flag-client proposal in Step 4) — also the bare /migrate-optimizely default execute access (groups, invites, ticked Flag clients, provision)
adjust access (users, groups, roles, policies, clients) same execute access (applies the updated tables)
plan flags execute flags
adjust flags (scope, ticks, client, bucketing, schema, rules) same execute flags
plan code execute code
adjust code (style, resolve mode, transforms, files/flags) same execute code

Before doing anything else, Read skills/migrate-optimizely/SKILL.md. If the user asked for access, users, teams, groups, roles, policies, invites, or clients, or used the bare /migrate-optimizely default, also Read skills/migrate-optimizely/access.md.

For plan access (including bare /migrate-optimizely), follow Plan Access: Steps: overview, resume check (do not create a new plan file yet), tracker, Opening questions (source method first). ASK first, create the plan file after they answer. After the access file (or REST) is confirmed, run Extract context (look around / paste / skip). Flag clients are Step 4 of this command (propose + ASK; no POST /v1/clients). There is no separate plan clients command — re-run plan access if SDK keys arrive later. After Step 5 Overall is complete, ASK the Step 5 exit question (adjust / tick consent / execute / done) — there is no automatic path into adjust; if they pick adjust, enter it in the same turn.

For adjust access, follow adjust access in access.md (also entered from the plan access Step 5 exit ask). Edit the existing access plan (users, groups, roles, policies, clients). Natural language is enough. No IAM writes. If they already stated the change, apply it. Then execute access applies the tables.

For plan flags, follow Plan Flag: Steps. After Overall is complete, ASK the Step 5 exit question (adjust flags / tick / execute / done). If they pick adjust, enter Adjust Flags: Steps in the same turn.

For adjust flags, follow Adjust Flags: Steps in SKILL.md. Edit the existing flag plan. No createFlag.

For plan code, follow Plan Code: Steps. After Overall is complete, ASK the Step 5 exit question (adjust code / execute / done). If they pick adjust, enter Adjust Code: Steps in the same turn.

For adjust code, follow Adjust Code: Steps in SKILL.md. Edit the existing code plan. No source edits / PRs.

For execute flags, find .claude/plans/optimizely-flag-migration-*.md. After flag create completes, ASK the targeting-rules import handoff ([1] Start targeting-rules import suggested). After rules import completes, ASK the resolve-verify handoff ([1] Start resolve-verify all flags suggested — validates Phase 1 via segment match on every migrated flag). Only after that gate passes, suggest plan code. For execute code, find .claude/plans/optimizely-code-migration-*.md. If the plan is missing, run the matching plan command first.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2d ago First seen · 45 lines · 73 tokens per session scan B b0c527d6e1cd

Subscribe to this mod's changes

migrate-optimizely is a command published in the GitHub repository spotify/confidence-ai-plugins (8 stars, last pushed today), licensed Apache-2.0. It adds 73 tokens to every session and 1,063 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it B with 1 finding (reads agent configuration directories). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.