workflow-authoring

workflow-authoring is a skill for Claude Code, Codex from asgeirtj/system_prompts_leaks. It costs 49 tokens per session (3,804 once invoked), scanned A, original, CC0-1.0.

A reference for writing Workflow scripts, which coordinate several agents or stages of work. It explains the script interface, how to pause and resume, and patterns for checking results.

In plain words
What is it for?
Use it when authoring workflows for research, audits, migrations, reviews, or other jobs that need decomposition, independent checks, and synthesis.
Why use it?
It helps structure large or complex tasks so different parts can be handled in parallel and reviewed before a final result is produced.

Skill for Claude CodeCodex

Written for no agent in particular: nothing here depends on one. Also seen: mentions subagents.

Good fit Use it when authoring workflows for research, audits, migrations, reviews, or other jobs that need decomposition, independent checks, and synthesis.

Compare 6 skills from other repositories ↓
Install with agentmods
npx agentmods add skills/asgeirtj/system_prompts_leaks/workflow-authoring
About the project

System Prompts Leaks is a collection of captured system instructions used to guide AI chatbots and coding agents before they receive user messages. It serves researchers and developers studying how different AI assistants are directed.

asgeirtj/system_prompts_leaks · 64,893 stars · on GitHub

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent
npx skills add asgeirtj/system_prompts_leaks --skill workflow-authoring
Clone the repo
git clone --depth 1 https://github.com/asgeirtj/system_prompts_leaks

Made for: Claude Code, Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for workflow-authoring

README.md
[![agentmods](https://agentmods.dev/badge/skills/asgeirtj/system_prompts_leaks/workflow-authoring/github.svg)](https://agentmods.dev/skills/asgeirtj/system_prompts_leaks/workflow-authoring)
Your own site
<a href="https://agentmods.dev/skills/asgeirtj/system_prompts_leaks/workflow-authoring"><img src="https://agentmods.dev/badge/skills/asgeirtj/system_prompts_leaks/workflow-authoring/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for workflow-authoring

Your own site · 80×15
<a href="https://agentmods.dev/skills/asgeirtj/system_prompts_leaks/workflow-authoring"><img src="https://agentmods.dev/badge/skills/asgeirtj/system_prompts_leaks/workflow-authoring.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 49 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 3,804 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe. ✓ AI security review Fable 5.1 · 6 Sept 2026 📄 Read the review Third-party audits
  • Snyk pass 7 Sept 2026
  • NVIDIA SkillSpector warn 7 Sept 2026
SkillSpector: 2 findings, up to high

These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →

  • high System Prompt Leakage · line 42
    Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
    Fix: Remove any instructions that reveal, print, or output system prompts or internal rules. System instructions should never be exposed to end users.
  • medium Excessive Agency · line 61
    Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
    Fix: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
How audits are shown
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00049 $0.03804
Opus 5 $0.00024 $0.01902
Sonnet 5 $0.00010 $0.00761
Haiku 4.5 $0.00005 $0.00380

Measured 2d ago against content hash d4ddb20a14ee, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-12, from the pricing page.

Security

Grade A, and why

workflow-authoring scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

Anthropic/claude-code/skills/workflow-authoring/SKILL.md · 139 lines

How it starts

The opening of the file, as written. The whole thing — 139 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Workflow authoring reference

A workflow structures work across many agents — to be comprehensive (decompose and cover in parallel), to be confident (independent perspectives and adversarial checks before committing), or to take on scale one context can't hold (migrations, audits, broad sweeps). The script is where you encode that structure: what fans out, what verifies, what synthesizes.

When you do call it, the right move is often hybrid: scout inline first (list the files, find the channels, scope the diff) to discover the work-list, then call Workflow to pipeline over it. You don't need to know the shape before the task — only before the orchestration step.

Common single-phase workflows you can chain across turns:

  • Understand — parallel readers over relevant subsystems → structured map
  • Design — judge panel of N independent approaches → scored synthesis
  • Review — dimensions → find → adversarially verify (the review-changes example)
  • Research — multi-modal sweep → deep-read → synthesize
  • Migrate — discover sites → transform each (worktree isolation) → verify

For larger work, run several in sequence — read each result before deciding the next phase. You stay in the loop; each workflow is one well-scoped fan-out.

Ultracode. When a system-reminder confirms ultracode is on, that opt-in is standing: author and run a workflow for every substantive task by default. The goal is the most exhaustive, correct answer you can produce — token cost is not a constraint. For multi-phase work (understand → design → implement → review), that often means several workflows in sequence — one per phase — so you stay in the loop between them. The quality patterns below (adversarial verify, multi-modal sweep, completeness critic, loop-until-dry) are the tools; pick what fits the task. Lean toward orchestrating with workflows and adversarially verifying your findings — unless the work is trivial or already verified. Solo only on conversational turns or trivial mechanical edits. When a reminder says ultracode is off, revert to the opt-in rule in the Workflow tool description.

Pass the script inline via script — do not Write it to a file first. Every invocation automatically persists its script to a file under the session directory and returns the path in the tool result. To iterate on a workflow, edit that file with Write/Edit and re-invoke Workflow with {scriptPath: "<path>"} instead of resending the full script.

Every script must begin with export const meta = {...}: export const meta = { name: 'find-flaky-tests', description: 'Find flaky tests and propose fixes', // one-line, shown in permission dialog phases: [ // one entry per phase() call { title: 'Scan', detail: 'grep test logs for retries' }, { title: 'Fix', detail: 'one agent per flaky test' }, ], } // script body starts here — use agent()/parallel()/pipeline()/phase()/log() phase('Scan') const flaky = await agent('grep CI logs for retry markers', {schema: FLAKY_SCHEMA}) ...

The meta object must be a PURE LITERAL — no variables, function calls, spreads, or template interpolation. Required fields: name, description. Optional: whenToUse (shown in the workflow list), phases. Use the SAME phase titles in meta.phases as in phase() calls — titles are matched exactly; a phase() call with no matching meta entry just gets its own progress group.

Script body hooks:

  • agent(prompt: string, opts?: {label?: string, phase?: string, schema?: object, effort?: string, isolation?: 'worktree', agentType?: string}): Promise — spawn a subagent. Without schema, returns its final text as a string. With schema (a JSON Schema), the subagent is forced to call a StructuredOutput tool and agent() returns the validated object — no parsing needed. Returns null if the user skips the agent mid-run or the subagent dies on a terminal API error after retries (filter with .filter(Boolean)). opts.label overrides the display label. opts.phase explicitly assigns this agent to a progress group (use this inside pipeline()/parallel() stages to avoid races on the global phase() state — same phase string → same group box). opts.effort overrides the reasoning effort for this agent call ('low' | 'medium' | 'high' | 'xhigh' | 'max') — omit to inherit the session effort; use 'low' for cheap mechanical stages and higher tiers only for the hardest verify/judge stages. opts.isolation: 'worktree' runs the agent in a fresh git worktree — EXPENSIVE (~200-500ms setup + disk per agent), use ONLY when agents mutate files in parallel and would otherwise conflict; the worktree is auto-removed if unchanged. opts.agentType uses a custom subagent type (e.g. 'general-purpose', 'code-reviewer') instead of the default workflow subagent — resolved from the same registry as the Agent tool; composes with schema (the custom agent's system prompt gets a StructuredOutput instruction appended).
  • pipeline(items, stage1, stage2, ...): Promise<any[]> — run each item through all stages independently, NO barrier between stages. Item A can be in stage 3 while item B is still in stage 1. This is the DEFAULT for multi-stage work. Wall-clock = slowest single-item chain, not sum-of-slowest-per-stage. Every stage callback receives (prevResult, originalItem, index) — use originalItem/index in later stages to label work without threading context through stage 1's return value. A stage that throws drops that item to null and skips its remaining stages.
  • parallel(thunks: Array<() => Promise>): Promise<any[]> — run tasks concurrently. This is a BARRIER: awaits all thunks before returning. A thunk that throws (or whose agent errors) resolves to null in the result array — the call itself never rejects, so .filter(Boolean) before using the results. Use ONLY when you genuinely need all results together.
  • log(message: string): void — emit a progress message to the user (shown as a narrator line above the progress tree)
  • phase(title: string): void — start a new phase; subsequent agent() calls are grouped under this title in the progress display
  • args: any — the value passed as Workflow's args input, verbatim (undefined if not provided). Pass arrays/objects as actual JSON values in the tool call, NOT as a JSON-encoded string — args: ["a.ts", "b.ts"], not args: "[\"a.ts\", ...]" (a stringified list reaches the script as one string, so args.filter/args.map throw). Use this to parameterize named workflows — e.g. pass a research question, target path, or config object directly instead of via a side-channel file.
  • budget: {total: number|null, spent(): number, remaining(): number} — the turn's token target from the user's "+500k"-style directive. budget.total is null if no target was set. budget.spent() returns output tokens spent this turn across the main loop and all workflows — the pool is shared, not per-workflow. budget.remaining() returns max(0, total - spent()), or Infinity if no target. The target is a HARD ceiling, not advisory: once spent() reaches total, further agent() calls throw. Use for dynamic loops: while (budget.total && budget.remaining() > 50_000) { ... }, or static scaling: const FLEET = budget.total ? Math.floor(budget.total / 100_000) : 5.
  • workflow(nameOrRef: string | {scriptPath: string}, args?: any): Promise — run another workflow inline as a sub-step and return whatever it returns. Pass a name to invoke a saved workflow (same registry as {name: "..."}), or {scriptPath} to run a script file you Wrote earlier. The child shares this run's concurrency cap, agent counter, abort signal, and token budget — its agents appear under a "▸ name" group in /workflows and its tokens count toward budget.spent(). The args param becomes the child's args global. Nesting is one level only: workflow() inside a child throws. Throws on unknown name / unreadable scriptPath / child syntax error; catch to handle gracefully.

Read the full file on GitHub · 139 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2d ago Changed · +2 lines d4ddb20a14ee
  2. 13d ago First seen · 137 lines · 49 tokens per session scan A e4d022e1e486

Subscribe to this mod's changes

workflow-authoring is a skill published in the GitHub repository asgeirtj/system_prompts_leaks (64,893 stars, last pushed 2d ago), licensed CC0-1.0. It adds 49 tokens to every session and 3,804 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.