Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add instructions/yc-clt/cmd-exec-mcp/agents-mdgit clone --depth 1 https://github.com/YC-CLT/cmd-exec-mcpWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/instructions/yc-clt/cmd-exec-mcp/agents-md)<a href="https://agentmods.dev/instructions/yc-clt/cmd-exec-mcp/agents-md"><img src="https://agentmods.dev/badge/instructions/yc-clt/cmd-exec-mcp/agents-md.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.03723 | $0.03723 |
| Opus 5 | $0.01861 | $0.01861 |
| Sonnet 5 | $0.00745 | $0.00745 |
| Haiku 4.5 | $0.00372 | $0.00372 |
Grade E, and why
cmd-exec-mcp AGENTS.md scanned grade E with 3 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Harvests environment variableshighData exfiltration
Enumerating or grepping the environment for keys collects credentials unrelated to what the mod says it does.
- **subprocess 三大坑**：① `env=` 替换整个环境，先 `os.environ.copy()` 再 `.update()`；② `shell=True` + `cmd /c` 双层引号转义断裂；③ `timeout=` 只杀父进程，用 `Popen` + `taskkill /F /T /PID` Reaches for credential fileshighPrivilege escalation
SSH keys, cloud credentials, git-credentials, .npmrc, /etc/shadow: reading these is how a config file becomes a credential leak.
- **`os.path.expanduser` 跨平台**：`~/.ssh/id_rsa` 在 Windows 上展开为 `C:\Users\xxx/.ssh/id_rsa`，asyncssh 认 Windows 路径，无需平台判断 Runs shell commandslowCapability
Expected in a hook, worth knowing in a rule or an instructions file.
- **Windows 管道句柄继承**：`asyncio.create_subprocess_shell` 管道可被孙子进程继承，改用 `loop.run_in_executor` + `subprocess.run(stdin=DEVNULL, capture_output=True)` How it starts
The opening of the file, as written. The whole thing — 133 lines — stays where its author put it; the contents beside it link to each section on GitHub.
AGENTS.md
环境
- Python 3.11，uv 管理依赖
- config.py 集中配置所有常量，pyproject.toml 管理依赖
- 命令：用
cmd-exec-mcp
关键文件
| 文件 | 作用 |
|---|---|
config.py |
所有配置常量（安全、沙箱、SSH、后端切换） |
main.py |
MCP 服务入口，工具注册、安全校验、进程检测单例 |
executors/base.py |
执行器抽象基类 |
executors/local.py |
本地命令执行器 |
executors/sandbox.py |
Docker 沙箱执行器 |
executors/opensandbox.py |
OpenSandbox 沙箱执行器 |
executors/remote.py |
SSH 远程执行器（asyncssh） |
executors/session.py |
SessionManager + ProcessSession 会话管理 |
models.py |
ExecResult 数据模型 |
tests/ |
测试目录 |
关键常量
| 常量 | 位置 | 说明 |
|---|---|---|
SECURITY_MODE |
config.py | 安全模式 restricted/full |
COMMAND_WHITELIST / BLACKLIST |
config.py | 本地/远程命令黑白名单 |
SANDBOX_BACKEND |
config.py | 沙箱后端 docker/opensandbox |
SANDBOX_SECURITY_MODE |
config.py | 沙箱安全模式（仅 Docker 后端） |
SANDBOX_COMMAND_WHITELIST / BLACKLIST |
config.py | 沙箱命令黑白名单 |
SANDBOX_DEFAULT_IMAGE |
config.py | Docker 沙箱默认镜像 |
SANDBOX_OPEN_* |
config.py | OpenSandbox 连接配置组 |
DEFAULT_TIMEOUT |
config.py | 默认超时 30s，-1 无限 |
FORCE_SHELL |
config.py | 强制指定 Shell pwsh/cmd/bash/wsl |
SSH_DEFAULT_TARGET |
config.py | SSH 默认目标 [user@]host[:port] |
SSH_DEFAULT_USER |
config.py | SSH 默认用户名 |
SSH_DEFAULT_PORT |
config.py | SSH 默认端口 22 |
SSH_PERSISTENT |
config.py | SSH 长连接复用 |
WSL_DISTRO / WSL_USER |
config.py | WSL 发行版/用户名 |
OUTPUT_TRUNCATE_LENGTH |
config.py | output_file 截断长度 |
SESSION_DEFAULT_ALIVE_TIMEOUT |
config.py | session 默认 alive 超时 |
SESSION_MAX_OUTPUT_LINES |
config.py | session 输出最大行数 |
SESSION_MAX_OUTPUT_BYTES |
config.py | session 输出最大字节 |
规则
- monkeypatch 必须用
import config+config.X：from config import X创建本地副本，monkeypatch 无法穿透；executor 同理 patchexecutors.模块名.X - executor 签名变更需全链同步：方法签名变，main.py 工具、测试、同接口其他 executor 都改
- config 重命名全量 grep：常量改名/移除后搜索所有引用
- 跨 Task 依赖等待：并行派发时先检查上游产物是否存在
查文献指南
| 资源 | 路径 |
|---|---|
| 项目设计文档 | docs/superpowers/specs/ |
| 项目实现计划 | docs/superpowers/plans/ |
| OpenSandbox 文档 | docs/opensandbox/（api/configuration/pysdk/server/调查报告） |
| OpenSandbox 官方 | open-sandbox.ai/sdks/code-interpreter/python |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 133 lines · 3,723 tokens per session scan E dbe07940573e
cmd-exec-mcp AGENTS.md is an instructions file published in the GitHub repository YC-CLT/cmd-exec-mcp (0 stars, last pushed 4d ago), licensed MIT. It adds 3,723 tokens to every session, about $0.0186 per session on Opus 5. A static security scan graded it E with 3 findings (harvests environment variables, reaches for credential files, runs shell commands). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other instructions, from other repositories
vscode buildNext.instructions.md
Working notes and architecture documentation for the new esbuild-based build system in build/next. Use when making changes to the new build pipeline (transpile/bundle commands, NLS plugin, source-map handling, resource copying, or self-hosting watch tasks).
spec-kit AGENTS.md
AGENTS.md instructions for github/spec-kit, covering agents.md, about spec kit and specify, quickstart — add a new integration in 5 steps, integration architecture and integrationmanifest — file tracking.
codex AGENTS.md
AGENTS.md instructions for openai/codex, covering rust/codex-rs, the codex-core crate, code review rules, crate api surface and model visible context.
langchain AGENTS.md
AGENTS.md instructions for langchain-ai/langchain, covering global development guidelines for the langchain monorepo, corridor security analysis, project architecture and context, monorepo structure and development tools & commands.
vscode oss-third-party-notices.instructions.md
Instructions for microsoft/vscode, covering vs code oss third-party-notices pipeline, architecture, pipeline flow in ci, applying the notice (cutover) and fallback chain (never fail the build).
next.js AGENTS.md
Instructions for vercel/next.js, covering next.js development guide, codebase structure, monorepo overview, core package: packages/next and other important packages.