Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add commands/sigistry/marketplace/data-flow-analysisgit clone --depth 1 https://github.com/sigistry/marketplaceWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/commands/sigistry/marketplace/data-flow-analysis)<a href="https://agentmods.dev/commands/sigistry/marketplace/data-flow-analysis"><img src="https://agentmods.dev/badge/commands/sigistry/marketplace/data-flow-analysis.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00011 | $0.04234 |
| Opus 5 | $0.00005 | $0.02117 |
| Sonnet 5 | $0.00002 | $0.00847 |
| Haiku 4.5 | $0.00001 | $0.00423 |
Grade A, and why
data-flow-analysis scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 709 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Data Flow Analysis Command
Trace how specific data moves through the entire system - from where it enters, through all transformations, to where it's stored or output. This helps understand data pipelines, transformations, and dependencies.
Objective
For a given data entity or type, map its complete journey through the system:
- Entry points (APIs, file uploads, integrations)
- All transformations and enrichments
- Storage locations (databases, caches, files)
- Output destinations (APIs, reports, external systems)
- Access patterns (who reads/writes it)
Step 1: Data Entity Identification
If Entity Specified
- Find the entity definition (model, schema, type)
- Identify all fields and their types
- Note any computed or derived fields
If No Entity Specified
- List main data entities in the system
- Suggest which to analyze based on:
- Core business entities
- Entities with complex transformations
- Data that flows between multiple systems
Output Format
## Data Entity: [EntityName]
**Definition Location**: `file_path:line_number`
**Schema**:
```typescript
interface EntityName {
id: string; // Primary identifier
field1: string; // [Purpose]
field2: number; // [Purpose]
computed: boolean; // Derived from [source]
relations: {
relatedEntity: RelatedType;
};
}
Business Purpose: [What this data represents in business terms]
Data Classification:
- Sensitivity: [Public/Internal/Confidential/PII]
- Lifecycle: [How long it's retained]
- Compliance: [Any regulatory requirements]
## Step 2: Data Entry Points
Identify all ways data enters the system:
### Entry Point Types
- API endpoints (POST/PUT requests)
- File uploads
- Data imports/migrations
- External system integrations
- User input forms
- Scheduled data fetches
- Event consumers
### Output Format
```markdown
## Data Entry Points
### Entry Point 1: [Name]
**Type**: [API/Upload/Integration/etc.]
**Location**: `file_path:line_number`
**How Data Arrives**:
```json
{
"rawField1": "value",
"rawField2": 123,
"sourceSystem": "external-api"
}
Validation Applied:
- ✓ Type checking: [What's validated]
- ✓ Business rules: [What's enforced]
- ✗ Missing validation for: [What's not checked]
- Location:
file_path:line_number
Initial Transformation:
- [Transformation 1] at
file_path:line_number - [Transformation 2] at
file_path:line_number
After Entry Processing:
{
"id": "generated-uuid",
"field1": "NORMALIZED_VALUE",
"field2": 123,
"status": "pending",
"createdAt": "2024-01-01T00:00:00Z"
}
Error Handling:
- Invalid data: [How it's handled]
- Duplicate detection: [Yes/No] at
file_path:line_number - Partial data: [How it's handled]
Volume/Frequency:
- Estimated: [X] records per [time period]
- Peak times: [When]
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 709 lines · 11 tokens per session scan A 676f3fc3a844
data-flow-analysis is a command published in the GitHub repository sigistry/marketplace (3 stars, last pushed yesterday), licensed MIT. It adds 11 tokens to every session and 4,234 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other commands, from other repositories
f5-db
Database operations and migrations.
psql-query
Run ad-hoc PostgreSQL analytics queries against dev/test database.
build
Guided feature development with approval gates at each phase.
release
Generate changelog, bump version, and create git tag.
index
Visual overview of Beacon index — chunks, coverage, provider. Pass --files to list indexed files.
notebook-query
Query the notebook knowledge base (SQLite) built by /agy:notebook — precise, grounded, cited. Ask in natural language ("sum the amounts by category", "which docs mention 'Acme Corp'", "build a project timeline") or pass raw SQL. Read-only. Use this when you need exact aggregates/lookups across a document corpus…