Borrowing it
Nothing to install: this file belongs to bablsoft/accessflow. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/bablsoft/accessflow/main/.claude/skills/dev-stack/SKILL.mdgit clone --depth 1 https://github.com/bablsoft/accessflowWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/bablsoft/accessflow/dev-stack)<a href="https://agentmods.dev/skills/bablsoft/accessflow/dev-stack"><img src="https://agentmods.dev/badge/skills/bablsoft/accessflow/dev-stack/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/bablsoft/accessflow/dev-stack"><img src="https://agentmods.dev/badge/skills/bablsoft/accessflow/dev-stack.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00114 | $0.01361 |
| Opus 5.5 | $0.00046 | $0.00544 |
| Sonnet 5.5 | $0.00023 | $0.00272 |
| Haiku 4.5 | $0.00011 | $0.00136 |
Grade A, and why
dev-stack scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
curl -fsS http://localhost:<api-port>/actuator/health How it starts
The opening of the file, as written. The whole thing — 93 lines — stays where its author put it; the contents beside it link to each section on GitHub.
dev-stack
Inputs
- target —
dev(default) |demo|e2e|e2e-setup|e2e-sso|website - action —
up(default) |status|logs|down
If the user says "start the app" with no qualifier, that is dev up. If they mention a spec or
Playwright, it is one of the e2e targets. If they want to look at the product with no setup, it
is demo.
The stacks
| Target | What runs | Ports |
|---|---|---|
dev |
backend/docker-compose-dev.yml (Postgres + Redis + Mailcrab) + mvn -f backend/pom.xml spring-boot:run + the frontend launch config |
API 8080 · SPA 5173 · Mailcrab UI 1080 · PG 5432 · Redis 6379 |
demo |
root docker-compose.yml — the whole product, zero config |
API 8080 · SPA 5173 |
e2e |
e2e/docker-compose.e2e.yml, images built from the working tree, admin seeded via bootstrap |
API 8080 · SPA 5173 |
e2e-setup |
e2e/docker-compose.e2e.setup.yml, no admin seeded (first-run wizard) |
API 8081 · SPA 5174 |
e2e-sso |
e2e/docker-compose.e2e.sso.yml + a mock SimpleSAMLphp IdP |
API 8082 · SPA 5175 · IdP 8085 |
website |
the website launch config (python3 -m http.server, no build step) |
8090 |
Workflow
1. Preflight
docker info >/dev/null || echo "Docker is not running"
lsof -i :5173 -i :8080 -sTCP:LISTEN
The 5173 collision is the single most common trap. The dev, demo and e2e targets all
bind host port 5173, and the user's own local app often already holds it. If it is taken, say so
and offer the choice — free the port, or set E2E_BASE_URL / E2E_API_BASE for the e2e targets.
Never silently kill the process holding it.
2. Bring it up
- Infra / compose:
docker compose -f <file> up -d --wait(the--waitis what makes the next step reliable). For the e2e targets prefer the packaged scripts, which already carry the right flags:cd e2e && npm run stack:up/stack:setup:up/stack:sso:up. - Frontend and website: always use
preview_startwith the.claude/launch.jsonname (frontend,website). Never runnpm run devthrough Bash — it holds the shell and the output is not surfaced. - Backend in
dev:mvn -f backend/pom.xml spring-boot:run, backgrounded. It needs env vars (DB_PASSWORD,ENCRYPTION_KEY,JWT_PRIVATE_KEY, …); the reference isdocs/09-deployment.md. If they are not set, say so rather than inventing values — or suggestdemo, which ships committed insecure keys for exactly this reason.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2mo ago First seen · 93 lines · 114 tokens per session scan A 7c52d66f0c2f
dev-stack is a skill published in the GitHub repository bablsoft/accessflow (11 stars, last pushed today), licensed Apache-2.0. It adds 114 tokens to every session and 1,361 once invoked, about $0.0005 per session on Opus 5.5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
data-retention-policies
Automate the lifecycle of order and customer data — archive old records, anonymize personal data on request, and purge expired data on schedule.
connect_polaris_catalog
Guides the agent to ask the user for their preferred authentication mode and credentials when they request to connect to the Polaris catalog, rather than using default credentials.
implementing-rbac-hardening-for-kubernetes
Harden Kubernetes Role-Based Access Control by implementing least-privilege policies, auditing role bindings, eliminating cluster-admin sprawl, and integrating external identity providers.
catalyst-center-readonly
Query Cisco Catalyst Center read-only — device inventory, site hierarchy, wireless, assurance health, compliance, software images, events. All 514 read-only API operations reachable through 8 grouped dispatchers. Use when asked what Catalyst Center manages, where a device sits, what its health or compliance state is…
huawei-cloud-ucs-policy-governor
Huawei Cloud UCS (Ubiquitous Cloud Native Service) policy governance and compliance management skill using hcloud CLI. Use this skill when the user wants to: (1) manage UCS policy instances - create/update/query/delete, (2) manage UCS policy definitions - query/list, (3) enable/disable policies on clusters or fleet…
legal-issue-research
A systematic research assistant for Chinese law. It searches laws, regulations, judicial interpretations, guiding cases, and typical cases, then organizes the legal sources and how they relate.