oh-my-agent is a harness for checking whether coding agents actually completed their work by verifying tests, required artifacts, independent reviews, and recorded decisions. It is used across multiple agent runtimes to make workflow results auditable instead of relying on an agent's own report. The catalogue add-ons provide parts of its skills, agents, hooks, MCP integrations, instructions, and plugins.
Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add first-fluke/oh-my-agent --skill oma-dev-workflowgit clone --depth 1 https://github.com/first-fluke/oh-my-agentWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/first-fluke/oh-my-agent/oma-dev-workflow)<a href="https://agentmods.dev/skills/first-fluke/oh-my-agent/oma-dev-workflow"><img src="https://agentmods.dev/badge/skills/first-fluke/oh-my-agent/oma-dev-workflow/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/first-fluke/oh-my-agent/oma-dev-workflow"><img src="https://agentmods.dev/badge/skills/first-fluke/oh-my-agent/oma-dev-workflow.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 4 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Supply Chain · line 166 Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.Fix: Avoid downloading and executing remote scripts. Use trusted packages from PyPI/npm. If remote fetch is required, verify checksums and use HTTPS.
- high Tool Misuse · line 166 Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.Fix: Limit tool chaining depth and validate the output of each tool before passing it to the next. Require explicit user approval for multi-step chains.
- medium Excessive Agency · line 150 Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.Fix: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
- medium Excessive Agency · line 155 Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.Fix: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00029 | $0.03741 |
| Opus 5.5 | $0.00012 | $0.01496 |
| Sonnet 5.5 | $0.00006 | $0.00748 |
| Haiku 4.5 | $0.00003 | $0.00374 |
Grade C, and why
oma-dev-workflow scanned grade C with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Downloads and executes remote codehighSupply chain
curl | sh runs whatever the server returns today, which is not necessarily what it returned when this was reviewed.
curl https://mise.run | sh Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
curl https://mise.run | sh Copies of this mod
2 near-identical copies found in the catalogue:
- oma-dev-workflow — 100% identical, 0 lines differ
- oma-dev-workflow — 94% identical, 70 lines differ
How it starts
The opening of the file, as written. The whole thing — 366 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Dev Workflow - Monorepo Task Automation Specialist
Scheduling
Goal
Set up, run, optimize, and troubleshoot reproducible development workflows using mise, language-specific checks, commitlint, validation pipelines, CI/CD, migrations, i18n builds, and release coordination.
Intent signature
- User asks about dev servers, mise tasks, lint/format/typecheck/test/build, git hooks, CI/CD, migrations, generated clients, i18n builds, or release automation.
- User needs workflow execution or developer environment setup rather than product feature implementation.
- User asks to configure Ruff/pyrefly, Biome/TypeScript 7, Dart/Flutter checks, Hadolint, or commitlint.
When to use
- Running development servers for monorepo with multiple applications
- Executing lint, format, typecheck across multiple apps in parallel
- Managing database migrations and schema changes
- Generating API clients or code from schemas
- Building internationalization (i18n) files
- Executing production builds and deployment preparation
- Running parallel tasks in monorepo context
- Setting up pre-commit validation workflows
- Configuring language-specific lint, format, and typecheck tools, Dockerfile linting, and commit-message validation
- Troubleshooting mise task failures or configuration issues
- Optimizing CI/CD pipelines with mise
When NOT to use
- Database schema design or query tuning -> use DB Agent
- Backend API implementation -> use Backend Agent
- Frontend UI implementation -> use Frontend Agent
- Mobile development -> use Mobile Agent
Expected inputs
- Requested workflow operation, affected apps/packages, and current monorepo structure
- Project manifests, lockfiles, tool configs,
mise.toml, task definitions, CI files, hook manager, and failure logs when relevant - Desired validation, setup, or release outcome
Expected outputs
- Executed or documented mise task workflow
- Updated workflow config, CI/CD pipeline, hooks, env template, or release guidance when requested
- Project-local tool dependencies/configs and runnable
lint,format,format:check,typecheck, and commitlint tasks for the selected profiles - Status report with commands, outputs, failures, and next actions
What ships with it
8 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- resources/affected-checks.py 2.5 KB runs code
- resources/api-workflows.md 1.1 KB
- resources/database-patterns.md 2.3 KB
- resources/i18n-patterns.md 1.2 KB
- resources/release-coordination.md 5.9 KB
- resources/tooling-profiles.md 11 KB
- resources/troubleshooting.md 1.4 KB
- resources/validation-pipeline.md 9.6 KB
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago Changed · +1 lines 52cd90d68912
- 12d ago Changed · +7 lines 886109863559
- 1mo ago Changed · -3 lines · -24 tokens per session e92116763f1e
- 1mo ago Changed · -1 lines 7686bcd59fe7
- 1mo ago Changed f72ad273e15d
- 1mo ago First seen · 362 lines · 53 tokens per session scan C d9dd40a1f330
oma-dev-workflow is a skill published in the GitHub repository first-fluke/oh-my-agent (1,352 stars, last pushed today), licensed MIT. It adds 29 tokens to every session and 3,741 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it C with 2 findings (downloads and executes remote code, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
releasing-prod
A controlled process for deploying already tested changes to the production environment. Production is the live environment used by users, and this process includes owner approval, database migration checks, deployment, and smoke tests.
push-ci
Push to remote and monitor CI. Validates branch safety, executes git push WITH explicit user approval, then monitors CI run status via gh CLI. Use when: user says 'push', 'push and watch CI', 'ship it', 'push-ci'. Not for: committing (use /smart-commit), creating PRs (use /create-pr), merging (use /merge-prep).
npm-trusted-publishing
Use when setting up npm publishing with GitHub Actions - provides trusted publishing with OIDC, provenance attestations, and monorepo configuration.
lov-release-via-cicd
A release workflow for Node, Tauri, Vite, shell, and GitHub Release projects. It checks or configures automated versioning and publishing, including macOS signing and notarisation when relevant.
ci-cd-pipelines
Provides CI/CD pipeline structure, a GitHub Actions CI template, deployment gates, and an optimization checklist; use when designing GitHub Actions workflows, optimizing pipeline speed, or implementing deployment gates.
prime-silo-devops
DevOps, SDLC, Tagging, and Release management instructions for Prime-Silo. Use this when asked to tag a new release, check CI/CD build status, or manage the SDLC.