finish-flow

finish-flow is a skill for Claude Code from cookys/autopilot. It costs 162 tokens per session (4,797 once invoked), scanned B, original, MIT.

A closing workflow that turns the final steps of a development task into separate tracked tasks. It is used at the end of several development workflows.

In plain words
What is it for?
Tracking the individual wrap-up steps after implementing a feature, fixing a bug, applying a hotfix, or ending a work session.
Why use it?
It reduces the risk that release, cleanup, or verification steps are silently skipped at the end of a task.

Skill for Claude Code

Written for Claude Code: ${CLAUDE_PLUGIN_ROOT variable. Also seen: mentions Claude Code.

Runs only inside its plugin — its command needs a path that Claude Code sets for a plugin’s own hooks and for nothing else. Install the plugin, not this.

Part of the autopilot plugin — 33 skills, 3 agents, 7 hooks shipped together

Install

Getting it into your agent

This one installs as part of its plugin. Adding the marketplace and installing the plugin brings it with everything else the plugin ships.

Claude Code
/plugin marketplace add cookys/autopilot
Claude Code
/plugin install autopilot

Made for: Claude Code.

Or install autopilot, the plugin that ships this one along with the rest of its 33 skills, 3 agents, 7 hooks.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for finish-flow

README.md
[![agentmods](https://agentmods.dev/badge/skills/cookys/autopilot/finish-flow.svg)](https://agentmods.dev/skills/cookys/autopilot/finish-flow)
Your own site
<a href="https://agentmods.dev/skills/cookys/autopilot/finish-flow"><img src="https://agentmods.dev/badge/skills/cookys/autopilot/finish-flow.svg" alt="Measured on agentmods" height="20"></a>
Per session 162 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 4,797 The whole file, excluding the scripts and references it only reads on demand.
Security scan B 1 finding. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00162 $0.04797
Opus 5 $0.00081 $0.02398
Sonnet 5 $0.00032 $0.00959
Haiku 4.5 $0.00016 $0.00480

Measured 6d ago against content hash 1796285bac92, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-06, from the pricing page.

Security

Grade B, and why

finish-flow scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Reads agent configuration directoriesmediumAgent snooping

.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.

!`cat .claude/finish-flow-config.md 2>/dev/null || true`
evals/skill-onoff/packs/companions/finish-flow/SKILL.md · 190 lines

How it starts

The opening of the file, as written. The whole thing — 190 lines — stays where its author put it; the contents beside it link to each section on GitHub.

finish-flow — Closing Sequence Forcing Function

Purpose: Dev-flow's closing sequences (L-5, H step 9, Fix wrap-up, S session-end) are multi-step and easy to compress mentally into "one thing to do". This skill guarantees each step becomes an independent, verifiable TaskCreate item that system-reminder surfaces until it's individually completed.

Why this exists: On 2026-03-17 and 2026-04-11, the same L-5 completion sequence was silently skipped twice — despite the dev-flow SKILL.md being patched with bolder markdown and anti-patterns. Passive text cannot force behavior. Active TaskCreate reminders can.

Project Config (auto-injected)

!cat .claude/finish-flow-config.md 2>/dev/null || true !cat .claude/dispatch-config.md 2>/dev/null || true

Entry Protocol (MANDATORY)

Before doing anything else:

1. Identify the current workflow size from the active project / branch:
   - Look at TaskList for phase task prefix (P0/P1/... ⇒ L-size)
   - Check branch name: fix/* ⇒ Fix, hotfix/* ⇒ H, otherwise infer
   - If unclear, ASK the user (or CEO evaluates within DOA)

2. Look up the size in the size → sub-tasks table below.

3. TaskCreate every sub-task listed for that size, in order.
   - Each sub-task must have the listed subject AND description
     (not abbreviated — copy the verification output clause verbatim).

4. Mark the parent closing task (L-5 / H-9 / etc.) as in_progress.

5. Begin working through the sub-tasks in order, marking each completed
   as its verification output is produced.

Do not combine. Each sub-task must be its own TaskCreate call and its own TaskUpdate status=completed call. Combining steps into one tool call defeats the forcing function.

Size → Sub-tasks

L-size — L-5 Completion (7 sub-tasks)

# Subject Description + verification output
L-5.1 Final Goal Review Open the project README. For each success criterion, show (a) the criterion text and (b) the concrete evidence (command output, file contents, or diff) proving it's met. Verify EACH row of the dev-flow requirements ledger is DONE or explicitly deferred (named to the user in the report) — a silently dropped accepted requirement is a FAIL. Output: pass/fail list, zero unverified.
L-5.2 Pre-Merge Review (max 3 rounds) Invoke autopilot:quality-pipeline (project config will select per-size flags). Up to 3 fix-review rounds allowed. This is the homogeneous quality-pipeline repair loop; in /l5 / /l6 contexts the engine implement-review loop is governed separately by resolver loop_max_rounds. (If the gate's tests are CI-backed and you're on Claude Code, the test step may wait on CI via the Monitor tool instead of busy-polling — see quality-pipeline Tests step / portability §7. Degrades to manual gh run watch elsewhere.) Output: final review result = zero blocking issues.
L-5.3 Merge to develop (or main per project convention) For L5/L6, resolve autopilot_root with the package-root resolver below, set task_status_receipt to a new caller-owned path, then run node "$autopilot_root/bin/autopilot.js" status task --root-run-id "$root_run_id" --json >"$task_status_receipt" and assert the parsed JSON has can_merge === true (for example, node -e 'const v=JSON.parse(require("fs").readFileSync(process.argv[1],"utf8"));if(v.can_merge!==true)process.exit(1)' "$task_status_receipt"). Only after that assertion passes run git checkout develop && git merge --no-ff <feature-branch>. The merge commit message MUST carry the qc-evidence trailer QC-Verdict: PASS (reviewer <id>, <YYYY-MM-DD>) once L-5.2 passed — the .githooks/pre-push qc-gate (scripts/resolve-qc-gate.sh, strength per .claude/qc-gate-config.md) refuses to push a protected-path range without it. Same trailer requirement applies to F.4 and H-9.3. Verify merge commit landed. Output: the pre-merge receipt with can_merge=true, plus git log -1 --format="%H %s%n%(trailers:key=QC-Verdict)" showing merge commit + trailer.
L-5.4 Post-Merge Review Re-read critical files that were changed (pick 1–3 highest-risk) to verify merge didn't silently drop changes. Doc-sync (conditional): if the change touched user-facing behavior or 3+ modules, invoke autopilot:doc-sync in scoped mode (base = the merge-base) to confirm docs still match the merged code; OFFER full mode for large/user-facing ships. Triage confirmed findings per doc-sync's fix policy (user docs → reality; specs → STALE-fix or mark NOT-YET-IMPLEMENTED + BACKLOG). Output: grep/diff confirming each expected change is present on develop + doc-sync drift summary (or "doc-sync skipped: no user-facing/3+ module change").
L-5.5 Archive project Move docs/projects/<project>/docs/projects/_archive/<project>/ (or the project-configured projects path). Update docs/projects/INDEX.md (remove from 進行中, add to 已完成 with date). If .claude/mission-routing-config.json points inside the moved directory, update graph_path to the archived path in the same change and require mission-routing-admission.test.sh plus session-mode.test.sh to pass after the move. Stale-qualifier guard: grep -E '^|' docs/projects/INDEX.md | grep -Ei '\((pending|target|in progress|WIP|TBD|draft)\)' MUST be empty (scan table rows only — the ^| prefilter excludes section headers like ## 進行中 (In Progress) which would otherwise false-positive under -i; -i then catches lowercase (wip) in a row); on hit, emit matched lines + halt. Release-hygiene gate (if this ship bumped the version): run scripts/preflight-release.sh — verifies CHANGELOG entry + INDEX row + version mirrors are consistent with canonical .claude-plugin/plugin.json; must exit 0. Output: ls docs/projects/_archive/<project>/ + grep guard pass-confirmation + preflight-release pass line.
L-5.6 L Session End (full checklist) Run the dev-flow "Session End L-Full" checklist (verify completion, update project docs, knowledge extraction via autopilot:learn if warranted, episodic-distill evaluation (did this project produce a transferable methodology or a rework-tempered procedure? yes → suggest autopilot:distill episodic mode — learn records lesson-FACTS, distill produces executable PROCEDURES), deferred items to BACKLOG, triggered BACKLOG pickup, staging verify, escalation events exist for every triggered quality-floor emission point (or none fired), four-surface sweep (skill/doc/memory/knowledge) — for EACH of the four surfaces output either "updated: " or "not needed: "; the user must never have to ask 該補的都處理了嗎). Dispatch-branch gate: derive integration_target from project config; otherwise resolve the origin/HEAD symbolic ref and normalize only refs/remotes/origin/<name> or origin/<name> to the local <name>; if origin/HEAD is unavailable, use the unique local develop/main. In every case require refs/heads/<name> to exist (ambiguity, malformed remote target, or missing local ref ⇒ halt). Assign autopilot_root from the package-root resolver below and halt on nonzero. When CLAUDE_PLUGIN_ROOT or PLUGIN_ROOT is set, call autopilot_root="$(resolve_finish_flow_package_root)"; otherwise set active_finish_flow_skill to the one exact absolute active finish-flow/SKILL.md path shown by the harness catalog and call autopilot_root="$(resolve_finish_flow_package_root "$active_finish_flow_skill")". Never substitute the consumer git root or a newest-cache search. Then run bash "$autopilot_root/scripts/reap-dispatch-branches.sh" check --repo "$(git rev-parse --show-toplevel)" --into "$integration_target". Exit 1 blocks clean exit until every ahead candidate is integrated or preserved with exact-tip --ack + handoff rationale. Deliberate discard is manual human/depth-0 action only after verified preservation; the reaper never deletes an uncontained branch. Re-run until exit 0. LSM status gates (L5/L6 only): after merge and again immediately before marker clear, run node "$autopilot_root/bin/autopilot.js" status task --root-run-id "$root_run_id" --json >"$task_status_receipt"; preserve the final JSON receipt. Report product_merged, consumer_updated, pushed, and zero_residue independently. Never say “merged and clean” unless can_close=true. Session-mode marker: L5/L6 must run node "$autopilot_root/scripts/session-mode.js" clear --task-status-receipt "$task_status_receipt" --root-run-id "$root_run_id"; the command fails closed unless the fresh digest-valid receipt has the same root and can_close=true. L4 keeps node "$autopilot_root/scripts/session-mode.js" clear. S/Fix/H workflows retain their existing closing behavior. Output: pass/fail summary for each gate and four-surface per-surface lines.
L-5.7 Delete merged branch (local + remote) The ship is merged + archived — delete the feature branch so it doesn't accumulate. This step exists because L-5 historically had no branch-cleanup sub-task (unlike F.5/H-9.5), so every L-ship left its feat/* branch behind (local AND on origin). Verify it's merged first (git branch --merged develop lists it), then: git branch -d <feature-branch> (local) and git push origin --delete <feature-branch> if it was ever pushed. Skip remote delete only if the branch was never pushed. (Placed AFTER L-5.6 — unlike H's H-9.5-before-H-9.6 order — intentionally: L-5.6 Session End's first check verifies merged-status, so deleting last consumes that verification. Don't "fix" the asymmetry.) Output: git branch + git ls-remote --heads origin <branch> both confirming the branch is gone.

Read the full file on GitHub · 190 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 6d ago First seen · 190 lines · 162 tokens per session scan B 1796285bac92

Subscribe to this mod's changes

finish-flow is a skill published in the GitHub repository cookys/autopilot (11 stars, last pushed yesterday), licensed MIT. It adds 162 tokens to every session and 4,797 once invoked, about $0.0008 per session on Opus 5. A static security scan graded it B with 1 finding (reads agent configuration directories). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Related

Other skills, from other repositories

systematic-debugging

Use when encountering any bug, test failure, or unexpected behavior, before proposing fixes.

obra/superpowers · 21 tokens

local-ai-agents

Build local-first AI agents that run entirely on a developer workstation with Microsoft Foundry Local and Qwen function-calling models. Covers Small Language Models (SLMs), the OpenAI-compatible local endpoint, sandboxed local tools, local RAG with Chroma, local MCP servers, hybrid cloud/local routing, and the…

microsoft/ai-agents-for-beginners · 200 tokens

chronicle

Analyze Copilot session history for standup reports, usage tips, session search, and session reindexing. Use when the user asks for a standup, daily summary, usage tips, workflow recommendations, wants to search or find past sessions by keyword/file/PR, wants to reindex their session store, or asks about deleting…

microsoft/vscode · 72 tokens

chat-pet-sprite-creation

Use when creating or changing VS Code chat pet sprite art, sprite sheets, state animations, eye treatments, Stable/Insiders variants, or pet transitions under src/vs/workbench/contrib/chat/browser/widget/media/chatPet.

microsoft/vscode · 53 tokens

cpu-profile-analysis

Analyze V8/Chrome CPU profiles (.cpuprofile) and DevTools trace files (Trace-.json). Use when: profiling performance, investigating slow functions, comparing code paths, finding bottlenecks, analyzing timeToRequest, understanding call trees from sampling profiler data, analyzing layout/paint/rendering, investigating…

microsoft/vscode · 71 tokens

next-cache-components-adoption

Turn on Cache Components in a Next.js app and resolve the blocking routes it surfaces. Use when the user wants to enable, adopt, or migrate to Cache Components, flip the cacheComponents flag, work through a flood of blocking-prerender / instant validation errors, run the cache-components-instant-false codemod, or…

vercel/next.js · 95 tokens