Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/CES-Ltd/Luminpx agentmods add skills/ces-ltd/lumi/flow-developWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/ces-ltd/lumi/flow-develop)<a href="https://agentmods.dev/skills/ces-ltd/lumi/flow-develop"><img src="https://agentmods.dev/badge/skills/ces-ltd/lumi/flow-develop/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/ces-ltd/lumi/flow-develop"><img src="https://agentmods.dev/badge/skills/ces-ltd/lumi/flow-develop.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00057 | $0.07294 |
| Opus 5.5 | $0.00023 | $0.02918 |
| Sonnet 5.5 | $0.00011 | $0.01459 |
| Haiku 4.5 | $0.00006 | $0.00729 |
Grade A, and why
flow-develop scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 843 lines — stays where its author put it; the contents beside it link to each section on GitHub.
This file is generated from a template. Edit the
.tmplfile, not this file directly. Runscripts/gen-skill-docs.shto regenerate after changes.
Pre-Development: State Check
Before starting development:
- Read
.octo/STATE.mdto verify Define phase complete - Update STATE.md:
- current_phase: 3
- phase_position: "Development"
- status: "in_progress"
# Verify Define phase is complete
if [[ -f ".octo/STATE.md" ]]; then
define_status=$("${HOME}/.claude-octopus/plugin/scripts/octo-state.sh" get_phase_status 2)
if [[ "$define_status" != "complete" ]]; then
echo "⚠️ Warning: Define phase not marked complete. Consider running definition first."
fi
fi
# Update state for Development phase
"${HOME}/.claude-octopus/plugin/scripts/octo-state.sh" update_state \
--phase 3 \
--position "Development" \
--status "in_progress"
⚠️ EXECUTION CONTRACT (MANDATORY - CANNOT SKIP)
This skill uses ENFORCED execution mode. You MUST follow this exact sequence.
STEP 1: Detect Work Context (MANDATORY)
Analyze the user's prompt and project to determine context:
Knowledge Context Indicators:
- Deliverable terms: "PRD", "proposal", "presentation", "report", "strategy document", "business case"
- Business terms: "market entry", "competitive analysis", "stakeholder", "executive summary"
Dev Context Indicators:
- Technical terms: "API", "endpoint", "function", "module", "service", "component"
- Action terms: "implement", "code", "build", "create", "develop" + technical noun
Also check: Does project have package.json, Cargo.toml, etc.? (suggests Dev Context)
Capture context_type = "Dev" or "Knowledge"
Step 1b: Detect Dev Subtype (if Dev context)
When context_type is Dev, determine the subtype to inject domain-appropriate quality guidance into the prompt sent to providers. Append the matching supplement text after the user's prompt.
| Subtype | Trigger keywords | Quality supplement |
|---|---|---|
frontend-ui |
"page", "widget", "component", "UI", "HTML", "CSS", "form", "dashboard", "layout" | See frontend-ui enrichment below. |
cli-tool |
"CLI", "command-line", "terminal", "script", "flag", "argument" | Help text via --help flag. Meaningful exit codes (0 success, 1 user error, 2 system error). Stdin/stdout/stderr used correctly. Argument validation with clear error messages. |
api-service |
"API", "endpoint", "REST", "GraphQL", "gRPC", "server", "route" | Input validation at boundaries. Consistent error response format. Auth/authz on every endpoint. Rate limiting consideration. OpenAPI/schema documentation. |
infra |
"deploy", "terraform", "docker", "CI", "pipeline", "Kubernetes", "helm" | Idempotent operations. Secrets never hardcoded. Rollback path documented. Health checks included. |
data |
"ETL", "pipeline", "migration", "schema", "database", "SQL" | Idempotent migrations. Backup/rollback strategy. Data validation at ingestion. |
general |
Default if no subtype matches | No supplement — use base implementer persona only. |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 843 lines · 57 tokens per session scan A 65046542408e
flow-develop is a skill published in the GitHub repository CES-Ltd/Lumi (37 stars, last pushed 5mo ago), licensed MIT. It adds 57 tokens to every session and 7,294 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
vuln-scanner
Audit trending repos for real security vulnerabilities and disclose responsibly - scan and route findings (PVR / dependency PR), re-submit queued advisories, and send armed email disclosures.
token-movers
Crypto market scanner and single-token analyst - movers scans top winners/losers/trending or on-chain runners with pump-risk flags; single-token produces a verdict-first deep report for one token.
vuln-tracker
One lifecycle poll over everything vuln-scanner produces - PR and advisory status, PVR triage transitions, and pending-disclosure aging, with a stars-secured impact headline and one action queue.
aeon-update
Pull framework updates from the upstream Aeon repo into this instance - 3-way merges canon's new commits into a PR, never clobbering operator config.
article
Write a publication-ready article in one of three angles - a trending long-form piece, a watched-repo thesis, or a project-through-a-lens essay. Optional Replicate hero image with --visual.
distribute-tokens
Two-phase contributor rewards - plan builds a tier-priced payout from the repo's merged-PR ranking; send executes it on-chain via Bankr Wallet API with per-recipient idempotency and dry-run.