Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/ffroliva/gflow-cli/llm-councilnpx skills add ffroliva/gflow-cli --skill llm-councilgit clone --depth 1 https://github.com/ffroliva/gflow-cliWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/ffroliva/gflow-cli/llm-council)<a href="https://agentmods.dev/skills/ffroliva/gflow-cli/llm-council"><img src="https://agentmods.dev/badge/skills/ffroliva/gflow-cli/llm-council.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00101 | $0.01836 |
| Opus 5 | $0.00051 | $0.00918 |
| Sonnet 5 | $0.00020 | $0.00367 |
| Haiku 4.5 | $0.00010 | $0.00184 |
Grade A, and why
llm-council scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 72 lines — stays where its author put it; the contents beside it link to each section on GitHub.
llm-council — external-tools review layer
Overview
Wraps pr-council-review (unchanged) and adds a layer of external CLI coding agents (codex, plus Antigravity — the agy harness) as additional independent reviewers, then folds their verdicts into the same synthesis. Internal Claude subagents are independent per-dimension but share one model family's blind spots — a phrasing choice, a Windows-vs-POSIX nuance, or a syntax error that reads fine to one Claude reviewer reads fine to all of them. A different model family catches a different error distribution. Confirmed live: on one review, external tools caught 6 real, distinct issues (a wording-accuracy bug, a wrong test count, a Windows-only test-triviality nuance, a test-isolation gap, a missing test, a malformed markdown fence) that 12 internal Claude-subagent dispatches (6 dimensions × 2 rounds) had all missed.
When to Use
- Any
pr-council-reviewrun (PR# mode or branch mode) where the artifact is high-stakes enough to want a second, differently-biased opinion before calling it GREEN. - Not needed for a quick spot-check or draft iteration — use
/review(single-agent) for that;pr-council-reviewalone for a normal-stakes PR.
Quick Reference — Tiers
| Tier | Internal (pr-council-review) | External tools |
|---|---|---|
small (default) |
✅ full dimension council | none — identical to running pr-council-review directly |
medium |
✅ | codex |
high |
✅ | codex + Antigravity (agy) |
Tier controls tool breadth, not review rounds. Fix → re-verify → repeat until GREEN (or a round cap) happens at every tier — that's how council review works, not a tier knob.
Tool Registry
Fixed, tested invocation recipes. Do not improvise a command for a listed tool — the "obvious" invocation is often a trap (see codex below).
codex
- NEVER
codex review. Its built-in prompt has gotten stuck in a self-inflicted loop reading skill files via a malformed PowerShell command, then retrying the identical broken command for 20+ minutes with zero progress. Confirmed reproducible on a clean retry. - Use:
codex exec -s read-only -C <absolute-repo-dir> --skip-git-repo-check "<direct, fully self-contained prompt>". - Probe:
codex --version(near-instant; confirms binary health only, not auth/quota). - Timeout budget: real calls run 10-20 min at default (
xhigh) reasoning effort. Always background it — never block synchronously. - Orphan risk: a killed/timed-out
codex execcan leavecodex.exe/codex-code-mode-host.exe/ sandbox-helper processes running on Windows. After any kill, verify viatasklist/psthat the named PIDs are actually gone before retrying — a retry racing an orphan still writing the same output path silently corrupts the result.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 72 lines · 101 tokens per session scan A cb25ddec3ea1
llm-council is a skill published in the GitHub repository ffroliva/gflow-cli (156 stars, last pushed today), licensed MIT. It adds 101 tokens to every session and 1,836 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
repomix
Pack and analyze codebases into AI-friendly single files using Repomix. Use when the user wants to explore repositories, analyze code structure, find patterns, check token counts, or prepare codebase context for AI analysis. Supports both local directories and remote GitHub repositories.
graph-mutation-plan
Cookbook for composing an applygraphmutations plan — stable entitykey patterns, the canonical label/edge vocabulary, evidence/invalidation/confidence discipline, and a worked example. Load this when building a non-trivial mutation plan.
signature-replay
Signature replay attacks — missing nonces, missing chain ID, ecrecover zero address, signature malleability, cross-chain replay.
aatmf-t10-confidentiality-breach
AATMF T10 — Integrity & Confidentiality Breach. System prompt extraction, training-data extraction, model-weight leakage, private-key recovery.
sidewinder-rattlesnake
Adversary-emulation profile for SideWinder (G0121 / Rattlesnake / T-APT-04 / Razor Tiger), India's suspected state-sponsored cyber-espionage actor.
lazarus-group
Adversary-emulation profile for Lazarus Group (G0032, aka Hidden Cobra / Diamond Sleet / Labyrinth Chollima), a North Korean RGB-linked actor conducting espionage, destructive, and financially motivated operations.