Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add commands/teamspwk/nova/autogit clone --depth 1 https://github.com/TeamSPWK/novaWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00024 | $0.00905 |
| Opus 5 | $0.00012 | $0.00452 |
| Sonnet 5 | $0.00005 | $0.00181 |
| Haiku 4.5 | $0.00002 | $0.00090 |
Grade C, and why
auto scanned grade C with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Recursive force deletehighDestructive command
rm -rf with a variable or a broad path is one typo away from removing the wrong tree.
"Bash(rm -rf *)", What it actually says
Nova Auto
적용 규칙 (on-demand 로드)
docs/nova-rules.md §6복잡한 작업의 스프린트 분할docs/nova-rules.md §7블로커 분류 (Auto/Soft/Hard)docs/nova-rules.md §9긴급 모드 (--emergency: 즉시 수정, 검증 사후)docs/nova-rules.md §10관찰성 계약 — Phase 전이·스프린트·블로커 이벤트 기록 (orchestrator 스킬이 담당)
스킬 orchestrator를 실행한다.
사용자 입력을 그대로 스킬에 전달한다.
예시:
- /nova:auto "proptech-lab에 건폐율 시각화 추가"
- /nova:auto "nova-landing 한국어 버전 추가" --design-only
- /nova:auto "3개 프로젝트에 다크모드 통일" --strict
- /nova:auto --deep "대규모 인증 시스템 교체"
- /nova:auto --fresh --deep "기존 Plan 무시하고 깊은 재설계"
플래그
| 플래그 | 동작 |
|---|---|
| (없음) | 전체 사이클 (설계→구현→검증→수정). 기존 Plan/Design 있으면 자동 재사용 |
--design-only |
설계까지만 (구현 전 확인용) |
--skip-qa |
QA 생략 (빠른 프로토타이핑) |
--strict |
QA를 Full 검증으로 강제 |
--fresh |
기존 Plan/Design 무시, 강제 fresh Architect (escape hatch) |
--deep |
deepplan(Explorer×3 병렬→Synth→Critic→Refiner) 호출 후 결과 Plan으로 파이프라인 진입. 아키텍처 전환·큰 마이그레이션에 권장. Plan이 이미 존재하면 --deep 무시 + 경고 |
--fresh --deep |
기존 Plan 무시 + deepplan으로 새 Plan 생성 후 파이프라인 진입 |
autoMode 안전 가드 (Claude Code v2.1.136+)
자동 실행 흐름에서 위험 명령을 차단하려면 사용자 .claude/settings.json의 autoMode.hard_deny 배열을 활용한다 (CC v2.1.136 도입). Nova /nova:auto는 LLM 분류 기반이라 명시적 deny 규칙과 병행 사용 권장.
{
"autoMode": {
"allow": ["$defaults"],
"soft_deny": ["$defaults"],
"hard_deny": [
"Bash(rm -rf *)",
"Bash(git push --force*)",
"Bash(*sh -c *rm -rf*)"
]
}
}
hard_deny는 분류기 우회 불가능한 무조건 거부.--emergency모드에서도 적용됨.- Nova
/nova:setup --permissions로 관리되는permissions.deny(런타임 차단)와 직교 — 둘 다 활용이 안전 기반선. - 광범위 glob 주의:
*rm*처럼 단어 일부만 매칭하면terraform,performance,platform등 정상 명령도 차단된다. 명령 + 공백을 포함한 정확한 패턴(rm -rf)을 권장. - 출처: https://code.claude.com/docs/en/changelog (v2.1.136)
관련
- 단일 완료 조건의 다중-턴 자동 진행은 Anthropic 공식
/goal커맨드(CC v2.1.139+, Research Preview). Nova/nova:auto는 CPS 구조 + Generator-Evaluator 분리 + 5기둥 통합으로 차별화.
Input
$ARGUMENTS
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 68 lines · 24 tokens per session scan C 56d04a6284ca
auto is a command published in the GitHub repository TeamSPWK/nova (2 stars, last pushed 2d ago), licensed MIT. It adds 24 tokens to every session and 905 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it C with 1 finding (recursive force delete). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other commands, from other repositories
loopx
Run the loopx setup helper and read its output.
grow-scanner
Autonomous task: increase real-world adoption of the AgentDiscover scanner.
gedd-chat
You are a GEDD coaching assistant. You guide the user through building a golden evaluation dataset for their AI agent using Open Coding methodology, then help them evaluate and annotate responses — all without leaving Claude Code.
gedd
You are a GEDD coaching agent. You guide a Domain Expert through building a golden evaluation dataset, deploy the agent, then hand off to an ML Engineer who wires it into a SageMaker MLflow production pipeline.
gedd-status
Read session.json (use the Read tool) and display a concise dashboard. If the file doesn't exist, say so and suggest running /gedd to start.
iteration-cap
Set the Second Pass iteration cap — the max number of revision attempts before the skill delivers the best attempt and stops. Accepts a positive integer.