Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/fullstacktard/claude-workflowWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/commands/fullstacktard/claude-workflow/x-onboard)<a href="https://agentmods.dev/commands/fullstacktard/claude-workflow/x-onboard"><img src="https://agentmods.dev/badge/commands/fullstacktard/claude-workflow/x-onboard/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/commands/fullstacktard/claude-workflow/x-onboard"><img src="https://agentmods.dev/badge/commands/fullstacktard/claude-workflow/x-onboard.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00011 | $0.01007 |
| Opus 5.5 | $0.00004 | $0.00403 |
| Sonnet 5.5 | $0.00002 | $0.00201 |
| Haiku 4.5 | $0.00001 | $0.00101 |
Grade A, and why
x-onboard scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 62 lines — stays where its author put it; the contents beside it link to each section on GitHub.
$ARGUMENTS
X Account Onboarding Pipeline
You are orchestrating the X account onboarding workflow. This creates new X/Twitter accounts end-to-end.
Phase 1: Handle Selection
Spawn the x-account-creator agent to check handle availability and prepare the batch:
Task(subagent_type="x-account-creator", prompt="Phase: handle_selection\n\nSelect and verify available X handles for account creation.\n\nUser request: $ARGUMENTS\n\nSteps:\n1. Use geelark_change_handle to validate each desired handle is available (validates in real-time before saving)\n2. Generate alternative handles if any are taken\n3. Output the list of confirmed available handles\n\nDefault to 1 account if count not specified.")
Phase 2: Email Provisioning
For each confirmed handle, provision a dedicated email account. This is REQUIRED -- geelark_create_x_account requires a pre-provisioned mail.com/GMX email.
Task(subagent_type="email-provisioner", prompt="Phase: email_provisioning\n\nCreate email accounts for X signup verification.\n\nAccounts needed: {count}\n\nSteps:\n1. For each account, call email_create_account with provider 'mail.com'\n2. Record the account_id and email from each result\n3. Add 30-60 second delays between creations\n4. Output the list of provisioned emails with account_ids\n\nThese emails will be passed to geelark_create_x_account in the next phase.")
Phase 3: Account Creation
For each confirmed handle + provisioned email pair, spawn x-account-creator to run the full signup flow:
Task(subagent_type="x-account-creator", prompt="Phase: account_creation\n\nCreate an X account with the confirmed handle.\n\nHandle: {handle}\nEmail: {email}\nEmail Account ID: {email_account_id}\n\nSteps:\n1. Launch phone with geelark_launch_phone({ phone_id: 'PHONE_ID' })\n2. Call geelark_create_x_account with email, email_password, phone_id, and optional name/password/DOB\n3. Poll geelark_check_job_status every 15s until completed (takes 3-5 min)\n4. Account is auto-imported to vault on success -- no separate import step\n5. If creation fails, retry up to 3 times\n6. Report success/failure with account_id")
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 62 lines · 11 tokens per session scan A cf4d728b619a
x-onboard is a command published in the GitHub repository fullstacktard/claude-workflow (12 stars, last pushed 6mo ago), licensed MIT. It adds 11 tokens to every session and 1,007 once invoked, about $0.0000 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-01.
Other commands, from other repositories
auto-browse
Auto-browse — learn, optimize, and graduate browser operations or web data-mining workflows.
webapp-testing
Toolkit for interacting with and testing local web applications using Playwright. Supports verifying frontend functionality, debugging UI behavior, capturing browser screenshots, and viewing browser logs.
verify-pr
Verify a PR's frontend changes through browser automation.
gh-issue-use-cypress
Like /gh-issue-use-browser, but pinned to the Cypress MCP — use when your project runs the Cypress MCP for browser automation. Example — /gh-issue-use-cypress "Composer > Save" saving toasts failure but the record persists.
can-i-use
Check browser support for web platform features against the project's browser targets.
qa
Smoke or browser-walk a running app. Report only. Do not implement. Do not merge.