Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
git clone --depth 1 https://github.com/synaptiai/synapti-marketplaceWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/plugins/synaptiai/synapti-marketplace/flow)<a href="https://agentmods.dev/plugins/synaptiai/synapti-marketplace/flow"><img src="https://agentmods.dev/badge/plugins/synaptiai/synapti-marketplace/flow/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/plugins/synaptiai/synapti-marketplace/flow"><img src="https://agentmods.dev/badge/plugins/synaptiai/synapti-marketplace/flow.svg" alt="Reviewed on agentmods" width="80" height="20"></a>Grade A, and why
flow scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
{
"name": "flow",
"version": "3.9.0",
"description": "Skill-driven workflow plugin for GitHub development with excellence-by-default quality gates. Encodes team knowledge as composable skills, enforces safety through hooks, and compounds learning across sessions. Strict TDD, Stranger Test, holdout validation, and evidence-based verification built in. Durable goals, workflows, triggers, and runs at .flow/. Requires bash, git, gh, jq, and python3 with PyYAML; on Windows, Git Bash (see docs/windows-support.md).",
"author": {
"name": "Synapti AI",
"url": "https://github.com/synaptiai"
},
"license": "Apache-2.0",
"keywords": [
"github",
"workflow",
"skills",
"autonomous",
"agent-teams",
"hooks",
"learning",
"development"
],
"repository": "https://github.com/synaptiai/synapti-marketplace",
"homepage": "https://github.com/synaptiai/synapti-marketplace/tree/main/plugins/flow"
}
What it installs
The manifest is a name and a version. 33 skills, 20 commands, 10 agents travel with it, and installing the plugin installs all of them — 4,852 tokens a session between them. Each is measured on its own page, and each can be installed alone.
- Skill trigger-policy A 145 tokens
- Skill goal-evidence-ledger A 123 tokens
- Skill run-state-management A 151 tokens
- Skill runtime-verification A 116 tokens
- Skill visual-verification A 137 tokens
- Skill capability-discovery A 77 tokens
- Skill change-classification A 86 tokens
- Skill criterion-verification-map A 115 tokens
- Skill debugging-patterns A 90 tokens
- Skill feedback-resolution A 103 tokens
- Skill goal-lifecycle A 138 tokens
- Skill holdout-validation A 130 tokens
- Skill merge-and-release A 82 tokens
- Skill merge-conflict-resolution A 114 tokens
- Skill tdd-patterns A 166 tokens
- Skill workflow-validation A 135 tokens
- Skill brainstorming A 60 tokens
- Skill branch-and-task-management A 60 tokens
- Skill convention-enforcement A 80 tokens
- Skill issue-crafting A 64 tokens
- Skill autonomous-workflow A 83 tokens
- Skill code-review-methodology A 107 tokens
- Skill goal-contract-capture A 109 tokens
- Skill goal-evaluator A 94 tokens
- Skill specification-capture A 135 tokens
- Skill a-check-that-can-only-confirm A 161 tokens
- Skill architecture-patterns A 66 tokens
- Skill code-quality-principles A 83 tokens
- Skill llm-operator-principles A 148 tokens
- Skill pr-lifecycle A 76 tokens
- Skill preflight-checks A 64 tokens
- Skill team-coordination A 75 tokens
- Skill evidence-based-development A 80 tokens
- Command start A 29 tokens
- Command learn A 35 tokens
- Command merge A 32 tokens
- Command goal A 71 tokens
- Command commit A 24 tokens
- Command resume A 63 tokens
- Command workflow A 31 tokens
- Command brainstorm A 22 tokens
- Command debug A 20 tokens
- Command design A 24 tokens
- Command resolve A 0 tokens
- Command release A 27 tokens
- Command watch A 60 tokens
- Command explain A 38 tokens
- Command flow A 56 tokens
- Command issue A 28 tokens
- Command run A 21 tokens
- Command trigger A 49 tokens
- Command pr C 27 tokens
- Command address D 23 tokens
- Agent code-reviewer A 103 tokens
- Agent security-reviewer A 45 tokens
- Agent goal-evaluator-judge A 161 tokens
- Agent error-handler-inspector A 63 tokens
- Agent integration-verifier A 62 tokens
- Agent finding-critic A 87 tokens
- Agent implementation-planner A 51 tokens
- Agent convention-checker A 53 tokens
- Agent test-runner A 45 tokens
- Agent verdict-judge A 49 tokens
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 6d ago Changed 79b90f886554
- 21d ago Changed 1f60aed65590
- 28d ago Changed 31179475deb5
- 1mo ago Changed 49ad7841dde7
- 1mo ago Changed 29365a8db708
- 1mo ago Changed 4b10b3e5d5c7
- 1mo ago Changed 368e79deeb9f
- 1mo ago Changed a7f1e782e2f0
- 1mo ago First seen · 23 lines scan A 9bc318cd2890
flow is a plugin published in the GitHub repository synaptiai/synapti-marketplace (7 stars, last pushed 4d ago), licensed Apache-2.0. Its token cost is not measured: this kind of file is read by the harness, not the model. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other plugins, from other repositories
engineering-practices
Git commits, conventional releases, refactoring, test-driven development, and engineering ways of working skills.
deep-implement
Implement code from /deep-plan sections with TDD, code review, and git workflow.
opinionated-software-engineering
Core opinionated software engineering skills: SICP-based software engineering, paradigm skills (functional, OOP, logic), and development process (TDD, git).
aldc
AI-Native AL Development Collection for Microsoft Dynamics 365 Business Central. Agents (architect, developer, conductor, pre-sales, agent-builder, triage, dredd) + TDD subagents, skills, and workflows for extension-only development with TDD, BCQuality-cited review/audit, event-driven architecture, and HITL gates.
atdd
Acceptance Test Driven Development for Claude Code. Enforces the ATDD methodology: write Given/When/Then specs first, generate a project-specific test pipeline, maintain two test streams (acceptance + unit). Inspired by Robert C. Martin's acceptance test approach from empire-2025.
es6kr
Reusable AI coding skills: TDD, commit management, dotfile sync, and more.