Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/asysta-act/agent-flow/onboardnpx skills add asysta-act/agent-flow --skill onboardgit clone --depth 1 https://github.com/asysta-act/agent-flowWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/asysta-act/agent-flow/onboard)<a href="https://agentmods.dev/skills/asysta-act/agent-flow/onboard"><img src="https://agentmods.dev/badge/skills/asysta-act/agent-flow/onboard.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00009 | $0.03763 |
| Opus 5 | $0.00005 | $0.01881 |
| Sonnet 5 | $0.00002 | $0.00753 |
| Haiku 4.5 | $0.00001 | $0.00376 |
Grade C, and why
onboard scanned grade C with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Downloads and executes remote codehighSupply chain
curl | sh runs whatever the server returns today, which is not necessarily what it returned when this was reviewed.
- Display lookup instruction: "To find your instance's status IDs, run: `curl -s -H 'X-Redmine-API-Key: YOUR_KEY' https://YOUR_INSTANCE/issue_statuses.json | python3 -m json.tool`" Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
- Display lookup instruction: "To find your instance's status IDs, run: `curl -s -H 'X-Redmine-API-Key: YOUR_KEY' https://YOUR_INSTANCE/issue_statuses.json | python3 -m json.tool`" How it starts
The opening of the file, as written. The whole thing — 329 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Onboard
Interactive wizard that collects parameters and generates the ## Automation Config block.
Input: $ARGUMENTS = (none) | --fresh | --update
- No arguments (default): auto-detect existing config and route accordingly
--fresh: force fresh mode, skip config detection--update: force update mode, error if no config exists
Scope
Target directory = git repository root (detect via git rev-parse --show-toplevel).
If not in a git repo → use CWD.
- Target file:
{target_dir}/CLAUDE.md - NEVER read or write CLAUDE.md outside of the target directory
- NEVER traverse parent directories to find CLAUDE.md
- Before any write operation, display:
Target: {absolute_path}/CLAUDE.md — Is this correct? [Y/n/custom path] - If CWD is NOT git root AND a CLAUDE.md exists in a parent directory: "You're in a subdirectory. CLAUDE.md exists at {parent}/CLAUDE.md. Write here ({CWD}) or there ({parent})? [here/THERE]"
Step 0: Detection and Routing
- Determine the target directory per ## Scope rules above
- Read
{target_dir}/CLAUDE.md - Look for
## Automation Configsection - If
--freshin $ARGUMENTS → skip detection, go to Fresh mode (step 1) - If
--updatein $ARGUMENTS and no config exists → error: "No Automation Config found. Run without --update to create one." - Route based on detection:
| State | Action |
|---|---|
| No config exists | Fresh mode (step 1) |
| Config exists, current version (has Pipeline Profiles or Metrics) | Offer: "[1] Update existing config [2] Start fresh (overwrites)" |
| Config exists, old version (no Pipeline Profiles and no Metrics) | "Detected older config format. Update it manually to match the current format in docs/reference/automation-config.md. Continue anyway? [y/N]" |
In update mode: parse entire existing config into key→value structure per section. This provides default values throughout the wizard.
Then proceed to:
- Fresh mode → step 1
- Update mode → step U0
Fresh Mode
Step 1: Template Offer
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 329 lines · 9 tokens per session scan C d1a98e7b8925
onboard is a skill published in the GitHub repository asysta-act/agent-flow (12 stars, last pushed 1mo ago), licensed MIT. It adds 9 tokens to every session and 3,763 once invoked, about $0.0000 per session on Opus 5. A static security scan graded it C with 2 findings (downloads and executes remote code, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
html-ppt-zhangzara-broadside
OpenDesign's product-launch announcement and press narrative — the headline, the proof points, and the call to action. Built as a decision-grade marketing & GTM deck for press, community, prospects.
geo-prospect
CRM-lite for managing GEO agency prospects and clients. Track leads through the full sales pipeline: Lead → Qualified → Proposal Sent → Won → Lost. Store audit history, notes, deal values, and generate pipeline summaries. Use when user says "prospect", "lead", "client", "pipeline", "crm", "nuovo prospect", "aggiungi…
drug-design
End-to-end drug discovery pipeline orchestration. Deterministic Python script that auto-chains structure prediction, pocket detection, de novo design, docking, scoring, and ADMET filtering into reproducible workflows.
workflow-creation
Create a new Stencila workflow. Use when asked to create, write, scaffold, or set up a workflow directory or WORKFLOW.md file. Covers workflow discovery, duplicate-name checks, ephemeral workflows, WORKFLOW.md frontmatter, DOT pipeline authoring, goals, agents, branching, composition, and validation.
bump-mthds
Move this repo's exact mthds dependency pin to the latest release on PyPI (or a version you name), re-lock, adapt the engine source to whatever the new release broke, run the checks, and write the CHANGELOG entry — stopping before the commit. Use whenever the user says "bump mthds", "update mthds", "upgrade mthds"…
add-migration
Write a migration ledger entry for a configuration schema change in pipelex, so that a user's existing file can be repaired instead of thrown away. Use when make check-migration-schemas (alias cmig) or make check-ledger (alias cl) refuses a change, when the user says "add a migration", "write the ledger entry", "the…