Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/evoelsewhere/evoflux/easd-specifynpx skills add evoelsewhere/evoflux --skill easd-specifygit clone --depth 1 https://github.com/evoelsewhere/evofluxWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00048 | $0.01073 |
| Opus 5 | $0.00024 | $0.00536 |
| Sonnet 5 | $0.00010 | $0.00215 |
| Haiku 4.5 | $0.00005 | $0.00107 |
Grade A, and why
easd-specify scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 100 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Specify an EASD run
Repository contract
Read .evoflux/easd/config.json and its rules_file before phase work. Treat
the injected EASD context as the authoritative current Run; when the owning
runtime is accessible, corroborate it under runtime_directory. An isolated
worktree intentionally has no checkout-local runtime copy. Read the tracked
knowledge-base index.yaml,
specs/, features/, architecture/, and reference/ plus any existing
project documentation named by repository instructions. Do not copy or move
existing docs into EASD implicitly. Repository documents are the shared source
of truth. Stop on a missing tracked contract, stale hash, generation conflict,
or unavailable injected runtime; never reconstruct authority from chat memory
or a stale database-only projection.
Turn persisted Intent into a grounded contract that the user can review. This skill supplies procedure, not lifecycle authority: repository authorization, run state, submission, and acceptance remain enforced by EvoFlux.
State gate
Re-read the persisted run state and latest visible revision from current EASD
context on every invocation; do not continue from chat memory alone. intent
may be explored but must enter authoring before submission. authoring permits
one typed draft submission. In draft, show proposed changes against the current
revision and leave replacement/new-revision control to the user. An accepted or
active run belongs to planning or execution, not this Skill.
Work from evidence
- Read the run Intent and every applicable
AGENTS.mdin the authorized repository scope. - Inspect current feature, architecture, and reference docs, then the owning
source, configuration, migrations, and focused tests. Treat plans as
proposals and code/tests as current-state evidence when reverse-engineering.
Keep multi-repository provenance explicit as
repository:pathand never infer a path from conversation shorthand. - Scan for high-impact ambiguity in scope, actors/permissions, state and data, critical journeys, loading/error/recovery, concurrency, security/privacy, integration, compatibility, observability, and completion signals. Ask a concise clarifying question before selecting an option that can change product behavior; do not interrogate the user about low-impact details.
- Produce a provider-neutral specification with outcome, goals, non-goals,
source references, repository-qualified impact targets, constraints,
compatibility/security boundaries, risk tier, planned verification commands,
and stable observable ACs with per-AC evidence policies. Recommend
directonly for a low-risk single-boundary change; otherwise recommendplannedand cite the conditions requiring Plan. The user reviews this choice with the Spec. - Make provenance and uncertainty visible. Do not invent files, commands, behavior, or confidence unsupported by the inspected repository.
- Self-review the draft for contradictions, placeholders, untestable language, uncovered critical flows, scope drift, and ACs without concrete evidence. For every applicable flow, cover happy behavior plus relevant error, authorization, domain-invariant, recovery/concurrency, and cross-context behavior. Fix those gaps before submission or expose them as unresolved questions; do not add irrelevant scenarios merely to fill a checklist.
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 100 lines · 48 tokens per session scan A 2fdb333ba86b
easd-specify is a skill published in the GitHub repository evoelsewhere/evoflux (5 stars, last pushed 6d ago), licensed Apache-2.0. It adds 48 tokens to every session and 1,073 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
kane-cli
Browser automation + AI test authoring via kane-cli - run browser objectives, generate & refine test scenarios/cases from a description, design requirement-linked test suites from a PRD/spec (assurance), parse NDJSON output, inspect logs, save runnable test.md. Use for any task requiring a real browser (navigate…
rove
Use when controlling Rove tasks, parallel coding attempts, hosted agent sessions, task lifecycle, or the daemon-owned issue tracker from a shell. Also the ONLY channel for messaging another agent session on this machine — rove api send, never a peer/MCP side channel.
E2E Testing Nori Skillsets Subcommands
Use when you need to interactively test a nori-skillsets CLI subcommand end-to-end via tmux, with full filesystem isolation.
release
Autonomously cut a Rove (@sma1lboy/rove) release end-to-end — detect the semver bump from pending changesets (flagging an upstream minor you didn't intend), run the release gates, bump/tag/push via scripts/release.sh, then poll the GitHub Actions Release workflow with gh until npm publish completes, diagnosing CI…
hyperframes-cli
HyperFrames CLI dev loop. Use when running npx hyperframes init, add, catalog, capture, lint, validate, inspect, layout, snapshot, preview, play, render, publish, lambda, doctor, browser, info, upgrade, skills, compositions, docs, benchmark, telemetry, transcribe, or remove-background, or when troubleshooting the…
changelog-generator
Draft Rove release notes as Changesets. Writes user-facing entries as .changeset/.md files for @sma1lboy/rove (consumed into packages/kobe/CHANGELOG.md at release time). Use when the user asks for "changelog", "release notes", "what changed", "add a changeset", or before cutting a version. Enforces Rove's no-soft-wrap…