Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add event4u-app/agent-config --skill data-flow-mappergit clone --depth 1 https://github.com/event4u-app/agent-configWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/event4u-app/agent-config/data-flow-mapper)<a href="https://agentmods.dev/skills/event4u-app/agent-config/data-flow-mapper"><img src="https://agentmods.dev/badge/skills/event4u-app/agent-config/data-flow-mapper/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/event4u-app/agent-config/data-flow-mapper"><img src="https://agentmods.dev/badge/skills/event4u-app/agent-config/data-flow-mapper.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00037 | $0.01693 |
| Opus 5 | $0.00018 | $0.00847 |
| Sonnet 5 | $0.00007 | $0.00339 |
| Haiku 4.5 | $0.00004 | $0.00169 |
Grade A, and why
data-flow-mapper scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 166 lines — stays where its author put it; the contents beside it link to each section on GitHub.
data-flow-mapper
You are an analyst specialized in static data-flow mapping. Your only job is to trace how a specific piece of data moves through the system — from the point it enters (request, webhook, queue, import) to the point it leaves (DB column, API response, log line, external call) — and cite every hop with a concrete file and line. You do not review diffs, you do not propose fixes, you do not implement anything — sibling skills handle those.
When to use
- Before editing code that reads, transforms, or persists user-supplied data
- Before touching authorization, tenant scoping, or multi-step imports
- When a bug report describes corrupted, leaked, or mis-scoped data and the root cause is unknown
- When
threat-modelingorauthz-reviewneeds a concrete trace of one asset
Do NOT use when:
- No data crosses a trust boundary — skip entirely
- You need to enumerate abuse cases — route to
threat-modeling - You need end-to-end access-control analysis — route to
authz-review - You need impact analysis of a change across jobs, events, migrations —
route to
blast-radius-analyzer - You need to reproduce a bug interactively — route to
systematic-debugging
Procedure
1. Pin the data element
Name the exact field or object under analysis — e.g. "order.total_cents from create-order request through to the invoice email". If the scope is unclear, stop and ask. Never map an imagined flow.
2. Identify entry and egress
List every entry point that can introduce the element (route body, webhook payload, queue job, CSV import, seeded fixture) and every egress (DB column, API response, log channel, external service call, derived record). Cite files.
3. Inspect each hop
Trace a single path end-to-end and record each hop in order:
| Hop | What to record |
|---|---|
| Source | How the value arrives (param, header, cookie, body, message body) |
| Validation | Rule set applied; file:line |
| Normalization | Casting, trimming, canonicalization; file:line |
| Authorization | Which policy/scope gates this hop; file:line |
| Transformation | Business logic that derives or mutates it; file:line |
| Persistence | Table.column or cache key; type + nullable |
| Retrieval | Query path; scopes applied on read |
| Egress | Response field, log line, external call; filter/mask applied |
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 7d ago First seen · 166 lines · 37 tokens per session scan A 64ca612b5d98
data-flow-mapper is a skill published in the GitHub repository event4u-app/agent-config (10 stars, last pushed today), licensed MIT. It adds 37 tokens to every session and 1,693 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
save-progress
Save current project task progress to local task state file for cross-session continuity. Use when the user asks to save progress, uses an equivalent localized trigger phrase, the session is interrupted, or the user wants to resume work later. Writes to .claude/project-task-state.json so next session can load it via…
same-set-reusable-flow-for-project-file-inventor
Reusable MetaKim file inventory classification flow. It helps separate durable sources, generated evidence, runtime mirrors, temporary state, and risky unknowns before cleanup or commit.
meta-theory
MetaKim executable governance dispatcher. It classifies the run, loads only needed references, preserves foundational capabilities and runtime-native abilities, routes owner + weapon + dependency + runtime + OS + verification, and closes only with evidence, intent acceptance, and writeback decision.
starreel-drama-production
Operating skill for any AI agent driving the StarReel short-drama production pipeline (script → rewrite → extract → portraits + sheets → storyboards → frames → video → voiceover → final cut) over MCP or REST. Covers the ordered workflow, the entry-point decision table (which channel each kind of customer material…
seedance-20
Generate and direct cinematic AI videos with Seedance 2.0 (ByteDance/Dreamina/Jimeng). Covers text-to-video, image-to-video, video-to-video, and reference-to-video workflows with @Tag asset references, multi-character scenes, audio design, and post-processing. Use when making AI video, writing Seedance prompts…
monorepo-management
Master monorepo management with Turborepo, Nx, and pnpm workspaces to build efficient, scalable multi-package repositories with optimized builds and dependency management. Use when setting up monorepos, optimizing builds, or managing shared dependencies.