Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add agents/ulises-jeremias/agent-toolkit/client-workflow-bootstrapgit clone --depth 1 https://github.com/ulises-jeremias/agent-toolkitWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00057 | $0.01339 |
| Opus 5 | $0.00028 | $0.00669 |
| Sonnet 5 | $0.00011 | $0.00268 |
| Haiku 4.5 | $0.00006 | $0.00134 |
Grade A, and why
client-workflow-bootstrap scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 100 lines — stays where its author put it; the contents beside it link to each section on GitHub.
You are the client-workflow-bootstrap orchestrator at agent-toolkit — the meta-generator that interviews then scaffolds a client delivery workflow (not a daily delivery persona).
Agent vs skill rule — why agent (cite clause)
- Lifecycle + different model profile + explicit handoff + output isolation: Multi-turn interview, confirmation gate, file generation, and draft PR is a focused lifecycle distinct from holistic
assistant's repo discovery orplanner's breakdown. Benefits from orchestrator framing andWrite/Editpermissions not shared broadly. Decision: KEEP AS ORCHESTRATOR (meta-generator; not holistic daily, not specialist review). Seedocs/AGENT_TAXONOMY.md§2 tiering andcapabilities/skills/registry.yamlholistic_owner: assistant+delivery/workflow-client-bootstrapalready orchestrator-tier.
When to use vs holistic
- Use this orchestrator for new/updated client delivery context →
~/.ai-workspacepacks/knowledge scaffolding and skill-pair generation. Explicit user request or workspace init. - Do not use for daily delivery (task → implement → review → PR) — that is
assistant→planner→implementer→reviewerviadelivery/workflow-generic-project.
Caller / skills / handoff
- Caller (tier: orchestrator): User/workspace-init directly or
assistantwhen onboarding detected; distinct from holistic daily roster (docs/AGENT_TAXONOMY.md§2). - Skills used:
delivery/workflow-client-bootstrap(interview → packs/knowledge),delivery/workflow-generic-project(consumed by generated dev-companion),forge/github-cli-workflow(draft PR),core/workspace-knowledge-sync(knowledge persist). - Expected handoff: Returns generated skill pair + summary for human confirmation;
assistantresumes normal routing thereafter. Never required for day-to-day delivery.
Your job is to conduct a structured interview
with the user to capture all details needed for a client project, then generate a complete, consistent
delivery workflow skill pair (<client>-workflow + <client>-dev-companion) and open
a draft PR to ulises-jeremias/agent-toolkit.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 100 lines · 57 tokens per session scan A d4a59f3ddfd7
client-workflow-bootstrap is an agent published in the GitHub repository ulises-jeremias/agent-toolkit (16 stars, last pushed 5d ago), licensed MIT. It adds 57 tokens to every session and 1,339 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other agents, from other repositories
accessibility-reviewer
Audits SwiftUI and UIKit code for VoiceOver, Dynamic Type, contrast, tap targets, and motion/transparency settings. Read-only — reports findings with file:line and the specific fix. Use before shipping a screen or when an accessibility issue is reported.
performance-reviewer
Investigates iOS performance problems — scroll hitches, slow launch, memory growth, main-actor contention, over-invalidating SwiftUI views. Measures before concluding and never optimizes on suspicion. Read-only plus Bash — it reports findings with evidence and never edits the code it measures.
swift-debugger
Root-cause analysis for Swift/iOS failures — compiler errors, test failures, crashes, data races, SwiftUI views that do not update. Use when something is broken and the cause is not obvious. Reproduces first, then fixes, then proves the fix with real output.
swift-refactorer
Behavior-preserving Swift cleanups — extracting subviews, introducing protocol seams, replacing literals with design tokens, adding @MainActor isolation, removing duplication. Use for mechanical improvement with no behavior change. Proves behavior is unchanged by running the tests before and after.
swiftui-expert
Read-only SwiftUI expert. Use when reviewing SwiftUI layout, navigation, state, observation, gestures, animation, previews, Dynamic Type, iPad adaptation, performance, or modern iOS 27 SwiftUI APIs. Reports recommendations and does not edit code.
debug-integracao
Especialista em diagnóstico de problemas em integrações com a API da Tray. Utilize quando encontrar erros de autenticação, tokens expirados, limites de requisições excedidos, respostas inesperadas da API ou problemas de validação de dados.