Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add commands/swingerman/engineer/kill-mutantsgit clone --depth 1 https://github.com/swingerman/engineerWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00029 | $0.00539 |
| Opus 5 | $0.00015 | $0.00269 |
| Sonnet 5 | $0.00006 | $0.00108 |
| Haiku 4.5 | $0.00003 | $0.00054 |
Grade A, and why
kill-mutants scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 54 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Analyze surviving mutants and write tests to kill them.
Instructions
-
Read the most recent mutation testing report/results. If no report exists, inform the user to run
/atdd:mutatefirst. -
List all surviving mutants. For each, determine:
- What was mutated (the operator: boundary change, removed call, inverted condition, etc.)
- What behavior is unguarded by the current test suite
- Whether the mutant is equivalent (mutation doesn't change observable behavior)
-
If
$ARGUMENTSspecifies a file or mutant IDs, filter to only those survivors. -
For each non-equivalent survivor: a. Write a targeted unit test that:
- Exercises the exact code path affected by the mutation
- Asserts the correct behavior that the mutation would break
- Follows existing test naming conventions and patterns in the project b. Run the new test against the original code — it must pass c. Verify the test would fail against the mutant (conceptual verification)
-
After writing all new tests, re-run mutation testing (
/atdd:mutate) to confirm:- Previously surviving mutants are now killed
- No regressions (previously killed mutants still killed)
- This re-run is differential — adding a test changes the covering tests' hash, so only the affected function re-mutates; the rest are reused from the manifest
-
Report the updated mutation score and remaining survivors.
-
For any remaining equivalent mutants, document them:
Equivalent mutants (safe to ignore): - src/utils.ts:42 — `x + 0` → `x + 1` (no behavioral change)
Rules
- Never modify existing tests to make mutants survive. Only ADD new tests.
- Never modify source code to kill mutants. The source is correct; the tests need strengthening.
- Never modify spec files. Mutation testing operates on unit tests only.
- If a surviving mutant reveals a genuine bug in the source code (not just a test gap), report it to the user rather than writing a test that asserts the buggy behavior.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 54 lines · 29 tokens per session scan A 44076a66cf3a
kill-mutants is a command published in the GitHub repository swingerman/engineer (144 stars, last pushed 6d ago), licensed MIT. It adds 29 tokens to every session and 539 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other commands, from other repositories
paul:help
Show available PAUL commands and usage guide.
paul:progress
Smart status with routing - suggests ONE next action.
safe-refactor
Safe refactoring with automated review, testing, and rollback capabilities.
test
Smart test runner with filtering, coverage, and health monitoring.
paul:verify
Guide manual user acceptance testing of recently built features.
expect
Diff-aware AI browser testing — reads the git diff, maps changes to affected pages via the route map, generates a targeted test plan, and executes it via agent-browser (Rust daemon + CDP, ARIA-tree-first) with pass/fail reporting. Use when testing UI changes, verifying PRs before merge, or running regression checks on…