agentmods.dev

codeflow-coding-agent-bundle

A repository-owned starter bundle of files and configuration for installing Codeflow with Claude Code, Codex, or compatible coding agents. It is distributed as an MIT-licensed package linked to the Codeflow repository.

In plain words
What is it for?
Use it as the starting package when setting up Codeflow-related coding-agent installations or distributing the repository’s agent configuration.
Why use it?
It gives a project a defined starting bundle for coding-agent setup instead of requiring each installation to be assembled manually. The included metadata identifies its name, version, author, license, and source repository.

Plugin for Claude Code

207 1mo ago A scan tokens not measured original MIT
View the source file xiaojiou176-open/codeflow
Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add plugins/xiaojiou176-open/codeflow/openvibecoding-coding-agent-bundle
Claude Code
/plugin marketplace add xiaojiou176-open/codeflow
Clone the repo
git clone --depth 1 https://github.com/xiaojiou176-open/codeflow

Made for: Claude Code.

Per session not measured What this adds to a session before it is invoked.
When invoked not measured Not applicable: nothing here is loaded into a session.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Security

Grade A, and why

codeflow-coding-agent-bundle scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

examples/coding-agents/plugin-bundles/openvibecoding-coding-agent-bundle/.claude-plugin/plugin.json · 12 lines

What it actually says

{
  "name": "codeflow-coding-agent-bundle",
  "description": "Repo-owned Codeflow starter bundle for Claude Code, Codex, and compatible coding-agent installs.",
  "version": "0.1.0",
  "author": {
    "name": "Codeflow"
  },
  "homepage": "https://github.com/xiaojiou176-open/codeflow",
  "repository": "https://github.com/xiaojiou176-open/codeflow",
  "license": "MIT"
}
Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. yesterday First seen · 12 lines scan A f629097f88c8

Subscribe to this mod's changes

codeflow-coding-agent-bundle is a plugin published in the GitHub repository xiaojiou176-open/codeflow (207 stars, last pushed 1mo ago), licensed MIT. Its token cost is not measured: this kind of file is read by the harness, not the model. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Backend and APIsFrontendai-agentsauditabilitycontrol-planedeveloper-toolsevidencefastapi
Related

Other plugins, from other repositories

wakeflow

A disciplined control loop for multi-window Claude Code work: a controller window dispatches scoped task packages across a tmux-resident fleet, collects immutable target results, obtains independent Test validation, reviews the evidence, and decides the next step. Explicit on-disk state roots keep the run auditable…

GxFn/Wakeflow · not measured

akb-claude-code

Bridge Claude Code's session lifecycle into AKB's agent-memory vault.

dnotitia/akb · not measured

akb-sessions

Ingest coding sessions into an AKB vault as structured notes.

dnotitia/akb · not measured

fact-check-x

Evidence-first multi-platform fact-checking with complete answer capture, citation preservation, structured comparison, and authoritative verification.

ASI2030/Fact-Check-X · not measured

fastapi-best-practices

FastAPI best practices — 3 skills, 41 rules total, grounded in the official FastAPI docs, with incorrect/correct examples. Core skill (33 rules: models, params, structure, DI, errors, async, streaming, background/config, lifespan, middleware, docs) plus dedicated fastapi-security (5 rules) and fastapi-testing (3…

dkmqflx/fastapi-best-practices-plugin · not measured

audiolla

Self-hosted audio-production API — stem separation, mastering, MIR analysis, DSP chains, MIDI, and AI restoration over REST and MCP.

psyb0t/docker-audiolla · not measured