Thinking a bit more... I wrote:

But I agree those attribute names make things icky.

Attributes named "add"/"delete"/"replace" are not the only problem cases. A program which generates LDIF must also take care with attributes named "control" and "changetype". And with OpenLDAP, "increment". Which may be a worse problem since it's not mentioned in the LDIF spec.

Still, the new ldapmodify seems to me to add very little value to the ldapadd program. It is ldapadd which accepts LDIF format. ldapmodify does not. Yet the only difference now seems to be that one can omit the "changetype:" line, one must still use the more verbose "add/..." and "_" lines.

Another possible approach: Strict LDIF format, a record's attributes shall use "add/replace/...: attribute" if and only if the record has a "changetype:" line. Without them, ldapadd does changetype:add + add:attrs, ldapmodify does changetype:modify + replace:attrs.