Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/ffroliva/gflow-cli/scenarionpx skills add ffroliva/gflow-cli --skill scenariogit clone --depth 1 https://github.com/ffroliva/gflow-cliWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00084 | $0.02555 |
| Opus 5 | $0.00042 | $0.01277 |
| Sonnet 5 | $0.00017 | $0.00511 |
| Haiku 4.5 | $0.00008 | $0.00255 |
Grade A, and why
scenario scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 208 lines — stays where its author put it; the contents beside it link to each section on GitHub.
scenario — Edge Case & Scenario Explorer
Systematic pre-implementation scenario analysis. For a given feature or change,
produces a severity-ranked table of test scenarios across 12 dimensions tuned
to gflow-cli's known failure surfaces. Feed the output into PLAN.md tasks and
tests/features/ BDD scenarios before entering EXECUTE mode.
When to invoke
Use before implementing any of:
- A new generation path (T2V, I2V, R2V, batch manifest runner)
- Transport changes (any new HTTP call against
aisandbox-pa.googleapis.com) - Auth or session changes (new strategy, cookie extraction, SAPISIDHASH wiring)
- Selector cascade changes (
ONBOARDING_SELECTORS,NEW_PROJECT_SELECTORS,FRAME_SLOTS_STRUCT,IMAGE_MODEL_OPTION_SELECTORS) - Data layer changes (schema migration, new
OperationRecordercallsite, redaction change) - New CLI subcommand, flag, or exit code
Skip for: pure doc changes, CHANGELOG/version bumps, scripts/ tooling with no production callpath.
Invocation
/gflow:scenario <feature or change description>
<feature or change description> is a brief summary of what you're about to implement. Examples:
- "SAPISIDHASH auth header wired into
_post_jsonforaisandbox-paroutes" - "gflow video batch manifest ledger (skip already-completed rows)"
- "Image model picker converted from English has-text to structural anchor"
- "CDP-attach transport as opt-in alongside ui_automation"
The 12 dimensions
For each dimension, enumerate scenarios that are non-obvious — do not list things that a basic happy-path test already covers. Focus on things that break in production but pass in unit tests.
D1 — Auth & session lifecycle
The SAPISID cookie expires. The user re-runs gflow auth login mid-batch. A
profile is created but the Flow session was never verified. The session is valid
for labs.google tRPC but not for aisandbox-pa. Two profiles are in use
simultaneously (Chromium profile-lock).
D2 — WAF / reCAPTCHA scoring
A profile's WAF heat score is elevated from prior automation runs. reCAPTCHA
Enterprise detects navigator.webdriver=true despite the --disable-blink-features
stealth flag. The grecaptcha.execute() call times out or returns a challenge
that requires human interaction. The same token is submitted twice (single-use
token reuse). A batch run fires multiple rapid token mints within one session.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 208 lines · 84 tokens per session scan A 542c5574c6b8
scenario is a skill published in the GitHub repository ffroliva/gflow-cli (136 stars, last pushed 2d ago), licensed MIT. It adds 84 tokens to every session and 2,555 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
repomix
Pack and analyze codebases into AI-friendly single files using Repomix. Use when the user wants to explore repositories, analyze code structure, find patterns, check token counts, or prepare codebase context for AI analysis. Supports both local directories and remote GitHub repositories.
agent-carnet
Use this skill when the user asks to save, recall, find, or organize notes. Triggers on: 'remember this', 'save this', 'note this', 'what did we discuss about...', 'check the notebook', 'find in carnet'. Also use proactively when discovering findings worth preserving across sessions.
graph-mutation-plan
Cookbook for composing an applygraphmutations plan — stable entitykey patterns, the canonical label/edge vocabulary, evidence/invalidation/confidence discipline, and a worked example. Load this when building a non-trivial mutation plan.
muapi-media-editing
Edit and enhance images and videos with AI via muapi.ai — prompt-based editing, upscaling, background removal, face swap, lipsync, video effects, and more.
plano-agent-orchestration
Improve multi-agent orchestration in Plano. Use for agent registration, agent listener wiring, and capability-focused agent descriptions for accurate routing.
plano-filter-guardrails
Harden Plano filter chains and guardrails. Use for MCP filter setup, prompt guard responses, and safe filter ordering.