Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/ffroliva/gflow-cli/checknpx skills add ffroliva/gflow-cli --skill checkgit clone --depth 1 https://github.com/ffroliva/gflow-cliWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00020 | $0.01564 |
| Opus 5 | $0.00010 | $0.00782 |
| Sonnet 5 | $0.00004 | $0.00313 |
| Haiku 4.5 | $0.00002 | $0.00156 |
Grade A, and why
check scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 118 lines — stays where its author put it; the contents beside it link to each section on GitHub.
/gflow:check — Quality gates
Run in order. Stop and report if a step fails after the fix pass.
Steps
These steps mirror the CI test job in .github/workflows/ci.yml in the same order. Any command that CI runs as a verify (--check) is run here as a verify too — see step 4.
1. Repo hygiene + doc links + website-docs PII guard (read-only — CI runs all three; a broken doc link or a private identifier in the published website/docs/ mirror fails CI)
PYTHONUTF8=1 uv run python scripts/ci/check_repo_hygiene.py
PYTHONUTF8=1 uv run python scripts/ci/check_doc_links.py
PYTHONUTF8=1 uv run python scripts/ci/check_website_docs_pii.py
PYTHONUTF8=1 uv run python scripts/ci/generate_website_docs.py --check
The last check fails on either half of the published-site contract:
DRIFT:— canonicaldocs/changed but thewebsite/docs/mirror was not regenerated. Fix withuv run python scripts/ci/generate_website_docs.pyand stagewebsite/docs/.NAV-ORPHAN:— a page is published but nonav:entry inwebsite/mkdocs.ymlpoints at it, so it is live but unreachable. Add the entry under the right nav section.
2. Auto-fix lint and formatting (rewrites files in place)
uv run ruff check --fix src tests
uv run ruff format src tests
Report which files were modified. If this rewrote anything, those files are part of the change — stage them. CI does not run the auto-fix; it runs the --check verify in step 4 against the committed tree, so an uncommitted reformat is a red CI build.
3. Repeat lint/format ONLY on the files you touched? No — always run repo-wide. The whole-tree src tests scope in step 2/4 is deliberate: a latent format failure in a file your change merely imports (e.g. a BDD step module) will fail CI even if your own edits are clean. Never narrow the scope to "just my files."
4. Verify — the EXACT CI gate (non-mutating; must be clean before you commit/push)
uv run ruff check src tests
uv run ruff format --check src tests
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 118 lines · 20 tokens per session scan A e4fd0444c62f
check is a skill published in the GitHub repository ffroliva/gflow-cli (136 stars, last pushed yesterday), licensed MIT. It adds 20 tokens to every session and 1,564 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
repomix
Pack and analyze codebases into AI-friendly single files using Repomix. Use when the user wants to explore repositories, analyze code structure, find patterns, check token counts, or prepare codebase context for AI analysis. Supports both local directories and remote GitHub repositories.
agent-carnet
Use this skill when the user asks to save, recall, find, or organize notes. Triggers on: 'remember this', 'save this', 'note this', 'what did we discuss about...', 'check the notebook', 'find in carnet'. Also use proactively when discovering findings worth preserving across sessions.
graph-mutation-plan
Cookbook for composing an applygraphmutations plan — stable entitykey patterns, the canonical label/edge vocabulary, evidence/invalidation/confidence discipline, and a worked example. Load this when building a non-trivial mutation plan.
muapi-media-editing
Edit and enhance images and videos with AI via muapi.ai — prompt-based editing, upscaling, background removal, face swap, lipsync, video effects, and more.
oracle
Best practices for using the oracle CLI (prompt + file bundling, engines, sessions, and file attachment patterns).
plano-filter-guardrails
Harden Plano filter chains and guardrails. Use for MCP filter setup, prompt guard responses, and safe filter ordering.