Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add commands/kesteva/soloflow/verifygit clone --depth 1 https://github.com/kesteva/soloflowWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00023 | $0.01335 |
| Opus 5 | $0.00012 | $0.00668 |
| Sonnet 5 | $0.00005 | $0.00267 |
| Haiku 4.5 | $0.00002 | $0.00134 |
Grade C, and why
verify scanned grade C with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Downloads and executes remote codehighSupply chain
curl | sh runs whatever the server returns today, which is not necessarily what it returned when this was reviewed.
2. **Probe CLI.** Run `which maestro` via Bash. If not found AND MCP probe failed, report: "Maestro is not available via MCP or CLI. Install the CLI with: `curl -Ls 'https://get.maestro.mobile.dev' | bash`, or register t Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
2. **Probe CLI.** Run `which maestro` via Bash. If not found AND MCP probe failed, report: "Maestro is not available via MCP or CLI. Install the CLI with: `curl -Ls 'https://get.maestro.mobile.dev' | bash`, or register t How it starts
The opening of the file, as written. The whole thing — 97 lines — stays where its author put it; the contents beside it link to each section on GitHub.
/soloflow:verify
You are running standalone visual verification. The user wants to visually check a screen or feature without running the full workflow.
The target to verify is: $ARGUMENTS
Step 0: Check initialization
If .soloflow/ does not exist, report: "SoloFlow not initialized. Run /soloflow:init first." and stop.
Step 1: Check Availability
Pick a mobile path once per the Path Selection recipe in skills/visual-verify/SKILL.md, then probe web.
For mobile verification (MCP preferred, CLI fallback):
- Probe MCP. Call
mcp__maestro__list_devices. If it returns a result, setUSE_MAESTRO_MCP=true. If the tool is unbound or the call errors, continue. - Probe CLI. Run
which maestrovia Bash. If not found AND MCP probe failed, report: "Maestro is not available via MCP or CLI. Install the CLI with:curl -Ls 'https://get.maestro.mobile.dev' | bash, or register the MCP server with:claude mcp add --scope user maestro maestro mcp." - Probe device. Regardless of path, at least one simulator/emulator must be booted:
If both are zero, report: "No simulator/emulator booted. Start one with:IOS=$(xcrun simctl list devices booted 2>/dev/null | grep -c Booted || true) AND=$(adb devices 2>/dev/null | awk '$2=="device"' | wc -l | tr -d ' ' || true)open -a Simulator(iOS) oremulator -avd <name>(Android)." (MCP'sstart_devicecan also boot one for you if you prefer — but the user likely wants an explicit choice.)
For web verification:
- Run
which npxvia Bash. - If not found, report: "npx is not available. Ensure Node.js is installed."
- If found, attempt a Playwright MCP probe. If the MCP server is not running, report: "Playwright MCP server is not available. Ensure Playwright MCP is configured in your settings."
If neither mobile nor web tooling is available, report this to the user and stop.
Step 2: Discover Context
- Search the codebase for files related to the user's target (use Grep/Glob)
- Search for existing Maestro flows in
maestro/,.maestro/,test/maestro/that match the target - Determine whether this is a mobile UI, web UI, or both
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 97 lines · 23 tokens per session scan C b5e7b0cab7fe
verify is a command published in the GitHub repository kesteva/soloflow (41 stars, last pushed 3mo ago), licensed MIT. It adds 23 tokens to every session and 1,335 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it C with 2 findings (downloads and executes remote code, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other commands, from other repositories
scroll
Scroll targets in the background or explicitly synthesize foreground wheel input.
daemon
Start, stop, and inspect the headless Peekaboo daemon.
screen
Enumerate connected displays via peekaboo screen list.
toh-mobile
Turn the current web app into a mobile app — PWA (default) or native store build (Capacitor).
url
Print the tlive web terminal/dashboard link + QR code.
splunk-appdynamics-eum-setup
Render AppDynamics EUM, Browser RUM, Mobile RUM, IoT RUM, Session Replay, source-map, and beacon validation plans.