Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add instructions/dsnger/dev-workflow-kit/agents-mdgit clone --depth 1 https://github.com/dsnger/dev-workflow-kitWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.04944 | $0.04944 |
| Opus 5 | $0.02472 | $0.02472 |
| Sonnet 5 | $0.00989 | $0.00989 |
| Haiku 4.5 | $0.00494 | $0.00494 |
Grade A, and why
dev-workflow-kit AGENTS.md scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 284 lines — stays where its author put it; the contents beside it link to each section on GitHub.
AGENTS.md — dev-workflow-kit
Single source of truth for architecture and invariants. Read directly by Codex at both review gates and by the PR review bots. Discipline rules live in @CLAUDE.md.
What this project is
A Claude Code marketplace shipping one plugin, dev-workflow, which installs a
spec-driven workflow for building software with coding agents. It adds three
mechanisms: two independent cross-model review gates (a different model reviews the
design at Gate A and the diff at Gate B), a fingerprinted hardening ledger where a
recurring finding escalates one rung harder (prose → lint → type → test), and one
repo-enforced quality command. Users are developers running Claude Code.
The product is prompts. Skills, slash commands, agent definitions, hook reminder
messages and every template /workflow-init scaffolds are the deliverable — plus one
POSIX-shell hook.
There is no application code, so there is no typechecker to catch a defect; review and
docs/prompt-standards.md are the only gates a prompt passes through.
Architecture
The tree below is the meaningful surface — the files a change is likely to touch or
break. Ordinary repo furniture (.gitignore, .claude/settings.json, generated state
under .mcp/) is deliberately absent, not overlooked.
README.md # what the kit is, setup, daily use, contributing
MANIFEST.md # inventory of source-files/, the frozen extraction seed
AGENTS.md # this file — the invariants both gates check
CLAUDE.md # discipline rules + the two review gates
todos.md # backlog; `pending` ledger rows point here by ref
.gitattributes # union merge for the append-only ledger
.mcp.json # the Codex reviewer, pinned
.claude-plugin/marketplace.json
.github/workflows/ci.yml # lint + hook tests + invariant checks + validate
scripts/check-invariants.sh # invariants 5, 6 + prompt conformance (rung 2)
scripts/check-invariants.test.sh # its regression suite — reject/accept pairs
scripts/check-version-bump.sh # invariant 12, mechanically — PR-only (rung 2)
scripts/check-version-bump.test.sh # its regression suite — policy/operational/accept
plugins/dev-workflow/
.claude-plugin/plugin.json # metadata only — no component keys (invariant 6)
CHANGELOG.md # every manifest version, newest first
skills/{intake,harden-finding}/SKILL.md
agents/finding-triage.md # read-only PR-comment checker (convention-loaded)
commands/{workflow-init,process-pr-review}.md
hooks/{hooks.json,codex-gate.sh,codex-gate.test.sh}
hooks/fixtures/ # captured PostToolUse payloads the suite replays
examples/ # ships, but never scaffolded — one stack's answers
docs/
architecture.md # layout + the two non-obvious design decisions
coding-workflow.md # the methodology this plugin encodes
getting-started.md # first story, end to end
prompt-standards.md # the 12-item checklist every prompt must pass
hardening-log.md # append-only findings ledger (union-merged)
hardening-taxonomy.md # this project's fingerprint classes
pr-review-bots.md # the Wait-for routing list + where each bot's findings appear
superpowers/{specs,plans,stories}/ # the approved artifacts behind past changes
source-files/ # the extraction seed this repo was built from
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 284 lines · 4,944 tokens per session scan A 66eb45030c51
dev-workflow-kit AGENTS.md is an instructions file published in the GitHub repository dsnger/dev-workflow-kit (5 stars, last pushed 6d ago), licensed MIT. It adds 4,944 tokens to every session, about $0.0247 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other instructions, from other repositories
brooks-lint AGENTS.md
Instructions for hyhmrright/brooks-lint, covering agents.md, core purpose, skill integration, engineering standards and project structure.
vibeguard AGENTS.md
Instructions for majiayu000/vibeguard, covering agent instructions, scope, start here, core rules and delivery policy.
logic-lens GEMINI.md
Instructions for hyhmrright/logic-lens, covering logic-lens — developer guide (gemini cli), invoking skills, installation, project layout and key conventions.
yocto-lens AGENTS.md
Instructions for prashantdivate/yocto-lens: You are working on Yocto Lens, a Go static analysis tool for Yocto Project and OpenEmbedded metadata.
sdlc-quality copilot-instructions.md
Instructions for zircote-plugins/sdlc-quality, covering copilot instructions for sdlc plugin, project overview, repository structure, key conventions and rfc 2119 terminology.
ailinter AGENTS.md
Instructions for ailinter/ailinter, covering agents.md, agent tl;dr, sub-agent delegation (ailinter scans), when to invoke @ailinter and what @ailinter does.