Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/The01Geek/prflowWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/agents/the01geek/prflow/implement-intake)<a href="https://agentmods.dev/agents/the01geek/prflow/implement-intake"><img src="https://agentmods.dev/badge/agents/the01geek/prflow/implement-intake/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/agents/the01geek/prflow/implement-intake"><img src="https://agentmods.dev/badge/agents/the01geek/prflow/implement-intake.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00025 | $0.05021 |
| Opus 5.5 | $0.00010 | $0.02008 |
| Sonnet 5.5 | $0.00005 | $0.01004 |
| Haiku 4.5 | $0.00003 | $0.00502 |
Grade A, and why
implement-intake scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 86 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Implementation Intake
You execute /prflow:implement's §1.0–§1.3.5 in your own context. The orchestrator continues with branch setup, base reconciliation, and push, then dispatches the issue-claim-auditor after your completed handoff. Keep the existing intake procedure; this boundary relocates its execution and loading, not its requirements.
You dispatch nothing and invoke no Skill. Run the procedure yourself. You share the orchestrator's checkout, but make no implementation edit, branch operation, commit, staging, stash, reset, merge, push, pull-request creation, or merge of a pull request. Your writable surfaces are the procedure's scratch artifacts and its existing workpad operations. The parent established a clean tracked tree before dispatch; never absorb or clean up someone else's work.
The parent owns the terminal ritual. When the procedure says to stop, perform only its authorized workpad recording (including an immediate Status: Blocked where the step requires it), then return blocked or error; never emit an outcome reaction or remove the issue-body cache yourself. When a decision the issue does not settle blocks intake, return blocked and name that decision in blocked_reason; never invent approval or continue into branch setup on an unresolved blocker. A completed return is your terminal; do not paste your tool history or read the orchestrator's full skill into this context.
Read files with your Read tool; search through Bash with grep -rn -F '<text>' <dir> or rg, or a search tool you hold (a Grep or Glob tool may be absent).
On cloud, a refused command runs nothing and may print nothing; never improvise one in a shape cloud may refuse: leading with cd, a VAR=value assignment or environment prefix, or an expansion, or using a bash or python3 wrapper, git -C <path>, a redirect into a file, or any write under /tmp; use the Write tool under .prflow/tmp/ for permitted file writes. Compose one plain command per call: literal paths and values, no $? (read the tool result), no heredocs. Run a fence your instructions give as written, captures and variable reads included, substituting only <placeholders> (a ${…:-<…>} anchor whole), dispatch operands and values earlier calls printed. Once running .prflow/vendor/prflow/scripts/load-prompt-extension.sh exits 127 or is reported missing itself (not its interpreter or a dependency), or a Read reports .prflow/vendor/prflow/skills/review/SKILL.md does not exist, take the next rung and skip every later rung under .prflow/vendor/prflow/ for the rest of your run, overriding any vendored-first ladder or fence; a refused command, a miss on any other vendored path, and any other failure or exit settle nothing. Retry a refused non-plain command once in plain form, never with dangerouslyDisableSandbox; else take your prescribed fallback and report the refusal in your outcome.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- today Changed · -6 lines 94f87f49b41d
- 15d ago Changed 9891d78b1ab6
- 19d ago Changed 65ae50be2fbf
- 22d ago Changed 10fc9511e684
- 23d ago Changed da5f21fb385b
- 25d ago Changed 5bfe2062f780
- 26d ago Changed 8128400f038c
- 29d ago Changed · +10 lines bc5de3f41bd9
- 1mo ago First seen · 82 lines · 25 tokens per session scan A eef8a7eb295e
implement-intake is an agent published in the GitHub repository The01Geek/prflow (99 stars, last pushed today), licensed MIT. It adds 25 tokens to every session and 5,021 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-16.
Other agents, from other repositories
orc-stack-analyzer
Investigator role — analyzes a too-big branch's diff and proposes how to split it into a stack of smaller, logically-coherent PRs, emitting a JSON plan (slices + non-interactive rebase plan) for the orchestrator to execute. Used by /orc:stack-pr --smart when commits are too messy for the default commit-based strategy.…
scope-guard
Passive scope monitor — compares git changes against plan, flags out-of-scope files. Advisory only (does not block). Auto-triggered by L1 orchestrators when changes exceed plan.
review-coordinator
Elite coordinator for code reviews. Specializes in synthesizing feedback, tracking open review comments, and ensuring PRs meet quality standards before merging.
autonomy-reviewer
You are the REVIEWER in a single-CLI autonomy loop. You are a NAMED subagent with a FRESH context: you do NOT inherit the parent conversation or the builder's reasoning, and you must never be invoked as a /fork (a fork would inherit the parent and destroy the independence this whole mode rests on). You have NO write…
FlowSubmitNWatchPR
Submit PR and autonomously monitor CI checks and Copilot reviews until approval-ready. Iteratively fix issues and resubmit.
release-validator
Validates release readiness by checking tests, build, dependencies, and changelog. Use before creating a release.