Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/ffroliva/gflow-cli/issue-resolvenpx skills add ffroliva/gflow-cli --skill issue-resolvegit clone --depth 1 https://github.com/ffroliva/gflow-cliWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00097 | $0.01633 |
| Opus 5 | $0.00048 | $0.00816 |
| Sonnet 5 | $0.00019 | $0.00327 |
| Haiku 4.5 | $0.00010 | $0.00163 |
Grade A, and why
issue-resolve scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 137 lines — stays where its author put it; the contents beside it link to each section on GitHub.
issue-resolve — drive an assessed issue to a draft PR
Takes a verdict from issue-assessment and produces a reviewable fix. The
terminal state is a draft PR a human promotes — never an autonomous merge.
Core principle: the agent's job is to get the problem review-ready, not
to declare victory. A fix is "verified" only after it runs green on the
affected surface; when that surface can't be reached here (headed Flow
browser, macOS-only, credits), say so in the PR and stop. (Memory:
done-means-e2e-verified, pr-must-verify-on-affected-surface.)
Preconditions (all required before any code change)
- An
issue-assessmentverdict ofCONFIRMED-BUGorLIKELY-BUG. - Scope is single-surface / localized (not a cross-cutting redesign).
- The fix is verifiable in this environment (browser-free), OR the verification gap is explicitly carried into the PR as "needs human e2e."
If any fails → do not resolve; return to issue-assessment (reply-only).
Autonomy envelope (the action contract)
Allowed autonomously:
- ✅ Post one issue comment (status / reply to reporter).
- ✅ Open a draft PR (push a
bugfix/-prefixed branch offdevelop). - ✅ Run browser-free / credit-free verification (unit, lint, type, recording-verif, Gemini tool-path).
- ✅ Run the council review (
/gflow:pr-council-review//gflow:branch-review),/gflow:check,/gflow:sonar,/gflow:doc-review— without asking. These are mandated steps, not offers. A general "don't spawn subagents unless the user requested it" rule does not gate them: the user requested them by invoking this workflow. Stopping to ask makes the maintainer re-authorize the same step every issue, and it stalls the pipeline at exactly the point review is worth most.
Never (these require a human, regardless of pressure):
- ❌ Spend Veo credits (no live video generation to "verify").
- ❌ Mark a PR ready for review or merge it.
- ❌ Push to
mainordevelop. - ❌ State a fix is "verified" / "fixed" when it was not run on the affected surface.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 137 lines · 97 tokens per session scan A ae8d42ea8fcf
issue-resolve is a skill published in the GitHub repository ffroliva/gflow-cli (136 stars, last pushed 2d ago), licensed MIT. It adds 97 tokens to every session and 1,633 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
website-maintainer
Use this skill when working on the Repomix documentation website in website/ directory, including VitePress configuration, multi-language content, or translation workflows.
browser-extension-developer
Use this skill when developing or maintaining browser extension code in the browser/ directory, including Chrome/Firefox/Edge compatibility, content scripts, background scripts, or i18n updates.
muapi-cinema-director
Direct high-fidelity cinematic video with AI — translates creative intent into technical cinematographic directives for Veo3, Kling, and Luma video models via muapi.ai.
localization-design
Design for multiple languages, writing directions, and cultural contexts — text expansion, RTL mirroring, and locale formats. Use when shipping beyond one locale. For the words themselves, use ux-writing (designer-toolkit).
stage-edit
Intelligent editing of real user-supplied footage—understand it with transcript/OCR/scene/silence/quality/vision evidence, then choose deterministic timeline operations or a constrained semantic AI edit. Trigger for repurpose, montage, cleanup, localization, narration, or local content changes.
native-app-profiling
Profile native macOS/iOS apps using Time Profiler via CLI (xctrace). Use when asked to identify performance hotspots, profile CPU usage, or diagnose slow code paths without opening Instruments.