Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/EvolveHQ/docflowWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/plugins/evolvehq/docflow/docflow)<a href="https://agentmods.dev/plugins/evolvehq/docflow/docflow"><img src="https://agentmods.dev/badge/plugins/evolvehq/docflow/docflow/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/plugins/evolvehq/docflow/docflow"><img src="https://agentmods.dev/badge/plugins/evolvehq/docflow/docflow.svg" alt="Reviewed on agentmods" width="80" height="20"></a>Grade A, and why
docflow scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
{
"name": "docflow",
"description": "ADR-driven documentation workflow: a bootstrap skill that scaffolds an Architecture Decision Record (ADR) catalogue, a plan/ queue, AGENTS.md conventions, and _agent/ coordination — plus lifecycle skills to author ADRs, queue and ship work, add conventions, audit consistency, brainstorm decisions, run agent waves, and roll up a multi-repo product's catalogues, and five portable-workspace skills (workspace-setup, workspace-status, workspace-scope, workspace-dispatch, workspace-sync) that set up, read, plan and coordinate cross-repository work. Fourteen skills in total. Scales from one repo to a multi-repo federation. Works on Claude Code, pi, Codex, OpenCode, Grok, Cursor, omp, and Copilot.",
"version": "0.10.0",
"author": {
"name": "Eugenio Minardi",
"email": "[email protected]"
}
}
What it installs
The manifest is a name and a version. 14 skills travel with it, and installing the plugin installs all of them — 1,393 tokens a session between them. Each is measured on its own page, and each can be installed alone.
- Skill bootstrap A 114 tokens
- Skill agent-wave A 82 tokens
- Skill new-plan A 118 tokens
- Skill audit A 141 tokens
- Skill add-convention A 150 tokens
- Skill new-adr A 147 tokens
- Skill ship-item A 83 tokens
- Skill workspace-dispatch A 71 tokens
- Skill workspace-scope A 77 tokens
- Skill workspace-setup A 52 tokens
- Skill workspace-status A 62 tokens
- Skill brainstorm A 87 tokens
- Skill rollup A 109 tokens
- Skill workspace-sync A 100 tokens
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago Changed 6851183cd418
- 1mo ago First seen · 10 lines scan A 190e5280ef15
docflow is a plugin published in the GitHub repository EvolveHQ/docflow (16 stars, last pushed today), licensed MIT. Its token cost is not measured: this kind of file is read by the harness, not the model. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other plugins, from other repositories
adr
Complete lifecycle management for Architectural Decision Records (ADRs): create, update, supersede, search, audit compliance, and export.
han-coding
Coding-facing skills for the Han suite: writing, reviewing, testing, investigating, and standardizing code. Home of the tdd skill, which drives a feature or behavior through a BDD-framed red-green-refactor loop with an enforced observed-failure gate, and the refactor skill, which restructures existing code without…
han-communication
Foundational communication plugin for the Han suite. Owns the canonical readability standard, the writing-voice profile, and the explanation standard for talking to a reader who will not implement the work, plus the readability-guidance skill that surfaces the first two into a calling skill's own context for in-voice…
han-core
The shared foundation of the Han suite: the specialist agent roster the other plugins dispatch (adversarial reviewers, analysts, architects, investigators, and the plan synthesizer), the project-discovery skill with its project-scanner agent, and the canonical evidence and YAGNI rule files. The documentation skills…
han-linear
Linear-facing extensions to the Han suite. Adds work-items-to-linear, which creates one Linear issue per slice from a work-items file. Works through the Linear MCP server and requires it to be configured. Depends on no other Han plugin. Opt-in: installed on its own, not pulled in by the han meta-plugin.
han-plugin-builder
Guidance and tooling for building Claude Code skills and plugins. Carries the full body of skill-authoring, agent-authoring, and plugin-configuration guidance, and an init step that vendors that guidance into any repo as a path-scoped rule index so contributors get the right guidance loaded for the file they are…