Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/asysta-act/agent-flow/sprint-plannpx skills add asysta-act/agent-flow --skill sprint-plangit clone --depth 1 https://github.com/asysta-act/agent-flowWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/asysta-act/agent-flow/sprint-plan)<a href="https://agentmods.dev/skills/asysta-act/agent-flow/sprint-plan"><img src="https://agentmods.dev/badge/skills/asysta-act/agent-flow/sprint-plan.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00016 | $0.04670 |
| Opus 5 | $0.00008 | $0.02335 |
| Sonnet 5 | $0.00003 | $0.00934 |
| Haiku 4.5 | $0.00002 | $0.00467 |
Grade C, and why
sprint-plan scanned grade C with 3 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks the agent to reveal its instructionsmediumSystem prompt leakage
Directions to print, repeat or translate the system prompt extract configuration the operator did not intend to expose.
Display prompt: Sends data to an external URLmediumData exfiltration
A POST to an outside endpoint may be telemetry or may be exfiltration; either way the mod talks to somewhere, and you should know where.
| YouTrack | `curl -X POST {instance}/api/issues/{ID} -H "Authorization: Bearer $YOUTRACK_TOKEN" -H "Content-Type: application/json" -d '{"customFields":[{"name":"{sprint_field}","$type":"SingleEnumIssueCustomField","val Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
| YouTrack | `curl -X POST {instance}/api/issues/{ID} -H "Authorization: Bearer $YOUTRACK_TOKEN" -H "Content-Type: application/json" -d '{"customFields":[{"name":"{sprint_field}","$type":"SingleEnumIssueCustomField","val How it starts
The opening of the file, as written. The whole thing — 345 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Sprint Plan
Input: $ARGUMENTS = optional flags (--all, --apply, --dry-run, --limit <N>, --yolo)
Flag Parsing
Parse $ARGUMENTS:
--all: Plan ALL sprints (release plan), not just the next one--apply: After planning, dispatch/agent-flow:implement-featureor/agent-flow:fix-bugsper selected issue--dry-run: Display plan only, no tracker writes, no execution dispatch--limit <N>: Override Max issues config value (valid range: 1–50; out of range → clamp with WARN)--yolo: Auto-approve Gate 1 and Gate 3 (Gate 2 ALWAYS blocks — even in--yolo)
--yolo does NOT imply --apply. Explicit --yolo --apply is required for full automation.
--dry-run overrides --apply (if both present, dry-run wins — no tracker writes, no execution).
Configuration
Read Automation Config from CLAUDE.md section ## Automation Config. Follow ../../core/config-reader.md.
Required:
- Issue Tracker: Type, Instance, Project, Bug query
Sprint Planning section (REQUIRED for sprint-plan — see Cold-start rules if absent):
- Sprint duration (default:
2 weeks) - Capacity unit (default:
story-points) - Team capacity (default: none)
- Velocity target (default: none)
- Sprint field (default: tracker-dependent)
- Mode (default:
suggest) - Max issues (default: 20)
- Epic template (default: none)
If ### Sprint Planning section is absent: run in suggest mode with cold-start warnings at every gate.
Do NOT block — planning still proceeds with effective_capacity = null (unconstrained).
Optional:
- Feature Workflow: Feature query (combined with Bug query for issue fetch)
- Metrics: Output (path to metrics report; default:
./reports/metrics.md) - Agent Overrides: Path (default:
customization/) - Build & Test: Build command, Test command (required only if
--apply)
Config validation rules:
Sprint duration: must be1 week,2 weeks,3 weeks, or4 weeks. Other values: WARN, use2 weeks.Capacity unit: must bestory-pointsorhours. Other values: WARN, usestory-points.Team capacity: must be positive integer. 0 treated as unconfigured.Velocity target: must be positive integer. IfVelocity target > Team capacity(both set): WARN "Velocity target ({V}) exceeds Team capacity ({C}). Using Team capacity." Use Team capacity.Mode: must besuggestorapply. Other values: WARN, usesuggest.Max issues: must be integer 1–50. Out of range: clamp to [1, 50] with WARN.Epic template: file path. If set but file not found: WARN, use built-in template.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 345 lines · 16 tokens per session scan C 5772fa0b5a37
sprint-plan is a skill published in the GitHub repository asysta-act/agent-flow (12 stars, last pushed 2mo ago), licensed MIT. It adds 16 tokens to every session and 4,670 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it C with 3 findings (asks the agent to reveal its instructions, sends data to an external url, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
cocosketch
Generate visual draw.io diagrams from CocoPlus artifacts via a deterministic seven-step pipeline.
fix-issue
Fixes GitHub issues using parallel analysis agents for root cause investigation, code exploration, and regression detection. Reads issue context from gh CLI, searches codebase and memory for related patterns, generates a fix with tests, and links the resolution back to the issue via PR. Includes prevention analysis to…
chain-patterns
Chain patterns for multi-phase pipelines: MCP detection, handoff files, checkpoint-resume, worktree agents, CronCreate monitoring. Use when building or debugging a pipeline skill.
bare-eval
Run isolated eval and grading calls using CC 2.1.81 --bare mode. Constructs claude -p --bare invocations for skill evaluation, trigger testing, and LLM grading without plugin/hook interference. Use when running eval pipelines, grading skill outputs, benchmarking prompt quality, or testing trigger accuracy in isolation.
stream-chain
Stream-JSON chaining for multi-agent pipelines, data transformation, and sequential workflows.
stream-chain
Stream-JSON chaining for multi-agent pipelines, data transformation, and sequential workflows.