Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add commands/josix/agent-flow/orchestrategit clone --depth 1 https://github.com/josix/agent-flowWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00017 | $0.07862 |
| Opus 5 | $0.00009 | $0.03931 |
| Sonnet 5 | $0.00003 | $0.01572 |
| Haiku 4.5 | $0.00002 | $0.00786 |
Grade B, and why
orchestrate scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Reads agent configuration directoriesmediumAgent snooping
.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.
DEEP_DIVE_PHASE=$(grep '^phase:' .claude/deep-dive.local.md | sed 's/phase: *//' | tr -d '"') How it starts
The opening of the file, as written. The whole thing — 676 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Orchestrate Command
Coordinate complex tasks through sequential delegation to specialist agents.
Arguments
--use-deep-dive: Use existing deep-dive context to skip or accelerate exploration phase<task description>: The task to orchestrate
State Initialization
FIRST: Initialize orchestration state by running:
# Check for --use-deep-dive flag
USE_DEEP_DIVE=false
TASK_ARGS="$ARGUMENTS"
if [[ "$ARGUMENTS" == *"--use-deep-dive"* ]]; then
USE_DEEP_DIVE=true
TASK_ARGS=$(echo "$ARGUMENTS" | sed 's/--use-deep-dive//' | xargs)
fi
bash ${CLAUDE_PLUGIN_ROOT}/scripts/init-orchestration.sh "$TASK_ARGS"
This creates .claude/orchestration.local.md to track:
- Current phase and iteration
- Gate results for each phase
- Agent actions and timestamps
Prompt Refinement (Pre-Phase)
Before beginning orchestration, ensure the task is well-defined:
-
Check Task Clarity: Does "$ARGUMENTS" specify:
- What needs to be changed?
- Where in the codebase?
- What problem it solves?
-
If Vague: Ask ONE clarifying question before proceeding
- Provide options when possible
- Reference prompt-refinement skill for guidance
-
If Clear: Transform into structured format:
- Goal: One-sentence outcome
- Description: What and why (2-3 sentences)
- Actions: Concrete steps
- Constraints: Non-negotiable limits
- Assumptions: Things believed true that, if false, would change the approach
-
Classify task complexity using the
task-classificationskill tiers (Trivial / Exploratory / Implementation / Complex / Research). Note:task_complexityis the task-classification tier, NOT complexipy code/cognitive complexity. -
Detect explicit written-report request: independently of the complexity tier, determine whether the user explicitly asked for a written report, investigation guide, or planning document (e.g., "write me a report", "give me an investigation guide", "produce a planning doc"). Set
REPORT_REQUESTED_FLAGtotrueorfalseaccordingly.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 676 lines · 0 tokens per session scan B e2ede35d4fb3
orchestrate is a command published in the GitHub repository josix/agent-flow (7 stars, last pushed 17d ago), licensed MIT. It adds 17 tokens to every session and 7,862 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it B with 1 finding (reads agent configuration directories). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other commands, from other repositories
riskreview
The user invoked the /riskreview facade command from the risk-review-pipeline pack.
music-suno-prompt
Grounded Suno prompt synthesis from local knowledge corpus + persona canon + label canon. No vibes-prompting.
lavra-work-teams
Work on multiple beads with persistent worker teammates that self-organize through a ready queue.
triage
Triage review findings one by one — present pending TODOs for user decision (approve, skip, modify).
lavra-import
Import a markdown plan into beads as an epic with child tasks.
audit-plugin
Audit plugin skills, commands, and agents for structure, size, and naming issues.