Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/bablsoft/accessflow/dev-stacknpx skills add bablsoft/accessflow --skill dev-stackgit clone --depth 1 https://github.com/bablsoft/accessflowWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00114 | $0.01361 |
| Opus 5 | $0.00057 | $0.00681 |
| Sonnet 5 | $0.00023 | $0.00272 |
| Haiku 4.5 | $0.00011 | $0.00136 |
Grade A, and why
dev-stack scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
curl -fsS http://localhost:<api-port>/actuator/health How it starts
The opening of the file, as written. The whole thing — 93 lines — stays where its author put it; the contents beside it link to each section on GitHub.
dev-stack
Inputs
- target —
dev(default) |demo|e2e|e2e-setup|e2e-sso|website - action —
up(default) |status|logs|down
If the user says "start the app" with no qualifier, that is dev up. If they mention a spec or
Playwright, it is one of the e2e targets. If they want to look at the product with no setup, it
is demo.
The stacks
| Target | What runs | Ports |
|---|---|---|
dev |
backend/docker-compose-dev.yml (Postgres + Redis + Mailcrab) + mvn -f backend/pom.xml spring-boot:run + the frontend launch config |
API 8080 · SPA 5173 · Mailcrab UI 1080 · PG 5432 · Redis 6379 |
demo |
root docker-compose.yml — the whole product, zero config |
API 8080 · SPA 5173 |
e2e |
e2e/docker-compose.e2e.yml, images built from the working tree, admin seeded via bootstrap |
API 8080 · SPA 5173 |
e2e-setup |
e2e/docker-compose.e2e.setup.yml, no admin seeded (first-run wizard) |
API 8081 · SPA 5174 |
e2e-sso |
e2e/docker-compose.e2e.sso.yml + a mock SimpleSAMLphp IdP |
API 8082 · SPA 5175 · IdP 8085 |
website |
the website launch config (python3 -m http.server, no build step) |
8090 |
Workflow
1. Preflight
docker info >/dev/null || echo "Docker is not running"
lsof -i :5173 -i :8080 -sTCP:LISTEN
The 5173 collision is the single most common trap. The dev, demo and e2e targets all
bind host port 5173, and the user's own local app often already holds it. If it is taken, say so
and offer the choice — free the port, or set E2E_BASE_URL / E2E_API_BASE for the e2e targets.
Never silently kill the process holding it.
2. Bring it up
- Infra / compose:
docker compose -f <file> up -d --wait(the--waitis what makes the next step reliable). For the e2e targets prefer the packaged scripts, which already carry the right flags:cd e2e && npm run stack:up/stack:setup:up/stack:sso:up. - Frontend and website: always use
preview_startwith the.claude/launch.jsonname (frontend,website). Never runnpm run devthrough Bash — it holds the shell and the output is not surfaced. - Backend in
dev:mvn -f backend/pom.xml spring-boot:run, backgrounded. It needs env vars (DB_PASSWORD,ENCRYPTION_KEY,JWT_PRIVATE_KEY, …); the reference isdocs/09-deployment.md. If they are not set, say so rather than inventing values — or suggestdemo, which ships committed insecure keys for exactly this reason.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 93 lines · 114 tokens per session scan A 7c52d66f0c2f
dev-stack is a skill published in the GitHub repository bablsoft/accessflow (4 stars, last pushed yesterday), licensed Apache-2.0. It adds 114 tokens to every session and 1,361 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
connect_polaris_catalog
Guides the agent to ask the user for their preferred authentication mode and credentials when they request to connect to the Polaris catalog, rather than using default credentials.
catalyst-center-readonly
Query Cisco Catalyst Center read-only — device inventory, site hierarchy, wireless, assurance health, compliance, software images, events. All 514 read-only API operations reachable through 8 grouped dispatchers. Use when asked what Catalyst Center manages, where a device sits, what its health or compliance state is…
aws-security-audit
AWS security auditing — IAM users/roles/policies, CloudTrail API events, security posture analysis. Use when auditing IAM permissions, investigating security incidents, checking MFA compliance, or tracing API activity in CloudTrail.
agt-policy-authoring
Create and validate a minimal AGT Copilot CLI policy tailored to the repository being inspected.
auditing-aws-s3-bucket-permissions
Systematically audit AWS S3 bucket permissions to identify publicly accessible buckets, overly permissive ACLs, misconfigured bucket policies, and missing encryption settings using AWS CLI, S3audit, and Prowler to enforce least-privilege data access controls.
github-awesome-copilot-git-commit
Generate high-quality, atomic Conventional Commits by analyzing Git changes, recommending logical commit boundaries, validating commit messages, and assisting with PRs, changelogs, and releases.