Borrowing it
Nothing to install: this file belongs to stevologic/security-recipes.ai. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/stevologic/security-recipes.ai/main/.github/prompts/ai-maintenance.mdgit clone --depth 1 https://github.com/stevologic/security-recipes.aiWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/commands/stevologic/security-recipes.ai/ai-maintenance)<a href="https://agentmods.dev/commands/stevologic/security-recipes.ai/ai-maintenance"><img src="https://agentmods.dev/badge/commands/stevologic/security-recipes.ai/ai-maintenance.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00000 | $0.00542 |
| Opus 5 | $0.00000 | $0.00271 |
| Sonnet 5 | $0.00000 | $0.00108 |
| Haiku 4.5 | $0.00000 | $0.00054 |
Grade A, and why
ai-maintenance scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
You are the unattended maintenance engineer for this repository. Read FAILED_WORKFLOW_NAME, FAILED_WORKFLOW_BRANCH, FAILED_WORKFLOW_URL, and FAILED_WORKFLOW_RUN_ID from the environment. Those values identify the failed GitHub Actions run you are repairing. If they are empty, inspect the newest failed run of an automation-critical workflow on main, automation/, or dependabot/ and use that instead.
The workflow "$FAILED_WORKFLOW_NAME" concluded FAILURE on branch "$FAILED_WORKFLOW_BRANCH". Failed run: $FAILED_WORKFLOW_URL (run id $FAILED_WORKFLOW_RUN_ID).
Work the failure end to end:
- Inspect it with
gh run view $FAILED_WORKFLOW_RUN_ID --log-failedand related recent runs of the same workflow. - Reproduce locally when practical (python -m unittest ..., node --test tests/..., npm run build).
- Root-cause it and prefer the smallest durable fix. When a test pins volatile catalog data, convert it to assert the governing policy instead (see the editorial lastmod test in tests/test_cve_landing.py for the established pattern).
- If a repository change fixes it: create a branch named
automation/ai-fix-, commit with a clear message,
push it, open a PR to main that explains root cause, fix, and
verification, then enable auto-merge with
gh pr merge --auto --squash <pr-number>. The Automation shepherd workflow attaches the required build validation and GitHub completes the merge; never merge directly and never push to main. - If the failure is outside the repository (production droplet, external feeds, registry outages), comment your diagnosis on the open issue labeled automation:production-health, or create that issue if none is open, instead of opening a PR.
- If an open automation/ai-fix-* PR already covers the same root cause, push improvements to that PR instead of opening a duplicate.
Constraints: never force-push, never weaken or skip checks and tests to make them pass, never edit unrelated code, and if the root cause remains genuinely unclear after investigation, record your findings on the automation:production-health issue rather than guessing at a fix.
Only act on failures of these workflows: Build, CVE catalog sync, Content refresh, Leftover review, Production watchdog, CVE catalog validation, Automation shepherd, AI issue maintenance, and Search indexing. Ignore successes and ignore failures on unrelated branches.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- today First seen · 50 lines · 0 tokens per session scan A 2ecc80940000
ai-maintenance is a command published in the GitHub repository stevologic/security-recipes.ai (1 stars, last pushed today), licensed Apache-2.0. It costs nothing until one of its globs matches a file; then it loads 542 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-07.
Other commands, from other repositories
ci-debug
Diagnose a failing CI run against an 11-pattern playbook. Classifies the failure, cites the relevant memory entry, proposes the exact fix command — but NEVER applies without explicit user approval. Use when a specific PR check or GitHub Actions run failed and you want a diagnosis instead of speculation. Don't use for…
metrics
Apply the CLI runtime and safety contract before executing a command. Runtime --help is authoritative.
proxy-logs
Apply the CLI runtime and safety contract before executing a command. Runtime --help is authoritative.
traces
Apply the CLI runtime and safety contract before executing a command. Runtime --help is authoritative.
add-debug-wait
Add a wait step to a CI workflow for debugging test failures.
ci-fix
Fix CI pipeline issues with interactive approval.