Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/andreaserradev-gbj/dev-workflow/dev-checkpointnpx skills add andreaserradev-gbj/dev-workflow --skill dev-checkpointgit clone --depth 1 https://github.com/andreaserradev-gbj/dev-workflowWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00043 | $0.05295 |
| Opus 5 | $0.00022 | $0.02648 |
| Sonnet 5 | $0.00009 | $0.01059 |
| Haiku 4.5 | $0.00004 | $0.00530 |
Grade A, and why
dev-checkpoint scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 372 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Checkpoint Current Session
Review the current session and create a continuation prompt for the next session.
SAVE-ONLY MODE
This skill analyzes and saves. It does NOT fix, investigate, or implement anything.
- Do NOT investigate bugs or errors mentioned during the session
- Do NOT start implementing fixes or next steps
- Do NOT move to the next phase or task
- If the user mentions bugs during confirmation (Step 4), note them in
<blockers>or<notes>but do NOT attempt to fix them
Why commit-first ordering
The branch/worktree decision and the optional commit happen before PRD markers are updated and the checkpoint is written. This way the saved checkpoint records the branch and commit the session actually ends on — a branch created after the checkpoint would make the next /dev-resume report drifted. The PRD-marker edits and checkpoint.md/session-log.md written after the commit are honestly recorded as uncommittedChanges: true; they get swept into the next session's commit.
Step 0: Discover Project Root
Run the discovery script:
bash "$DISCOVER" root
Where $DISCOVER is the absolute path to scripts/discover.sh within this skill's directory.
Path safety — shell state does not persist between tool calls, so you must provide full script paths on each call:
- Use
$HOMEinstead of the literal home directory (e.g.,bash "$HOME/code/…/discover.sh", notbash "/Users/name/…/discover.sh"). This prevents username hallucination. - Copy values from tool output. When reusing a value returned by a previous command (like
$PROJECT_ROOT), copy it verbatim from that command's output. Never retype a path from memory. - Verify on first call: if a script call fails with "No such file", the path is wrong — STOP and re-derive from the skill-loading context.
- Never ignore a non-zero exit. If any script in this skill fails, stop and report the error before continuing.
Store the output as $PROJECT_ROOT. If the command fails, inform the user and stop.
What ships with it
7 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 372 lines · 43 tokens per session scan A 3903153aeb69
dev-checkpoint is a skill published in the GitHub repository andreaserradev-gbj/dev-workflow (2 stars, last pushed 4d ago), licensed MIT. It adds 43 tokens to every session and 5,295 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
gsd-debug
Systematic debugging with persistent state across context resets.
gsd-capture
Capture ideas, tasks, notes, and seeds to their destination.
gsd-config
Configure GSD settings — workflow toggles, advanced knobs, integrations, and model profile.
gsd-add-tests
Generate tests for a completed phase based on UAT criteria and implementation.
gsd-ai-integration-phase
Generate an AI-SPEC.md design contract for phases that involve building AI systems.
gsd-audit-milestone
Audit milestone completion against original intent before archiving.