Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add instructions/itdove/devaiflow/agents-mdgit clone --depth 1 https://github.com/itdove/devaiflowWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.19894 | $0.19894 |
| Opus 5 | $0.09947 | $0.09947 |
| Sonnet 5 | $0.03979 | $0.03979 |
| Haiku 4.5 | $0.01989 | $0.01989 |
Grade D, and why
devaiflow AGENTS.md scanned grade D with 3 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks for rootmediumPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
sudo apt install gh Recursive force deletehighDestructive command
rm -rf with a variable or a broad path is one typo away from removing the wrong tree.
find . -type d -name __pycache__ -exec rm -rf {} + 2>/dev/null || true Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
- ✓ Initial prompt uses daf jira view instead of curl How it starts
The opening of the file, as written. The whole thing — 1,843 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Agent Instructions for DevAIFlow
General Instructions
IMPORTANT: The following general instructions apply to the DevAIFlow project and MUST be followed when contributing to this codebase.
For JIRA operations: This project uses the daf tool for issue tracker integration. Always use daf jira commands (documented in the daf-workflow skill), NOT direct API calls.
Skills Documentation: The skills (CLI command documentation) are located in the devflow/cli_skills/ directory in the repository.
For comprehensive skills management documentation (discovery order, precedence rules, best practices), see docs/guides/skills-management.md.
⚠️ CRITICAL - Common Mistake to Avoid:
- ✅ CORRECT: Update files in
devflow/cli_skills/daf-*/SKILL.md(repository files that get committed) - ❌ WRONG: Do NOT update files in
~/.claude/skills/daf-*/SKILL.md(user's local cache, will be overwritten)
When updating command functionality or documentation, remember to update the corresponding SKILL.md file in the appropriate skill directory within the repository (devflow/cli_skills/).
Git Workflow
IMPORTANT: Never commit directly to the main branch. Always create a feature branch before making any commits.
Creating Branches and Pull Requests
-
Update main branch before creating a new branch:
git checkout main git pull origin mainIMPORTANT: Always ensure your main branch is up-to-date before creating a new feature branch.
-
Create a branch from the updated main branch:
git checkout -b <ISSUE-KEY>-<short-description>Example:
git checkout -b proj-12345-fix-validation -
Make your changes and commit them to the branch
-
Push the branch to remote:
git push -u origin <branch-name> -
Create a draft PR using auto-discovered PR templates (organization
.githubrepo first, then repository.github/directory, then user-configured URL, then default template) usingghCLI
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 1,843 lines · 19,894 tokens per session scan D cc0d41d0bfef
devaiflow AGENTS.md is an instructions file published in the GitHub repository itdove/devaiflow (2 stars, last pushed 13d ago), licensed Apache-2.0. It adds 19,894 tokens to every session, about $0.0995 per session on Opus 5. A static security scan graded it D with 3 findings (asks for root, recursive force delete, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other instructions, from other repositories
mcp-atlassian copilot-instructions.md
Instructions for sooperset/mcp-atlassian, covering mcp atlassian - development guide, build, test, and lint, run all tests, run with coverage and run single test file.
AllBeads CLAUDE.md
Instructions for thrashr888/AllBeads, covering claude.md, project overview, what allbeads does, current state (v0.2.0) and rust development commands.
atlassian-skills CLAUDE.md
Instructions for eunsanMountain/atlassian-skills, covering atlassian-skills — claude.md, project overview, build & run, install (uv recommended) and run the cli.
kraken AGENTS.md
Instructions for rafael-adcp/kraken, covering agents.md — running as a kraken tentacle, your operating contract — read these, then follow them, why there are no deltas any more and driving it non-interactively.
claude-code-plugins CLAUDE.md
Instructions for zhebil/claude-code-plugins, covering claude.md, what this repo is, plugins, auto-enrich and common commands.
ultra-jira-mcp AGENTS.md
Instructions for criblio/ultra-jira-mcp, covering agents.md and quick reference.