Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add Giancarlos/guardrails --skill gur-workflowgit clone --depth 1 https://github.com/Giancarlos/guardrailsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/giancarlos/guardrails/gur-workflow)<a href="https://agentmods.dev/skills/giancarlos/guardrails/gur-workflow"><img src="https://agentmods.dev/badge/skills/giancarlos/guardrails/gur-workflow/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/giancarlos/guardrails/gur-workflow"><img src="https://agentmods.dev/badge/skills/giancarlos/guardrails/gur-workflow.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00011 | $0.02060 |
| Opus 5 | $0.00005 | $0.01030 |
| Sonnet 5 | $0.00002 | $0.00412 |
| Haiku 4.5 | $0.00001 | $0.00206 |
Grade A, and why
gur-workflow scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 381 lines — stays where its author put it; the contents beside it link to each section on GitHub.
gur Workflow Skill
This skill teaches effective use of gur, a task management CLI designed for AI agent workflows.
Core Concepts
Task Lifecycle
open -> in_progress -> closed -> archived
- open: Task is ready to be worked on
- in_progress: Actively being worked on
- closed: Completed with a close reason
- archived: Historical record, can be compacted to save context
Priority Levels
- P0 (Critical): Drop everything, fix now
- P1 (High): Important, address soon
- P2 (Medium): Normal priority (default)
- P3 (Low): Nice to have
- P4 (Lowest): Backlog
Task Types
- task: General work item (default)
- bug: Defect to fix
- feature: New functionality
- epic: Large initiative containing subtasks
Command Patterns
Creating Tasks
Basic task:
gur create "Implement user authentication"
With full context:
gur create "Fix login timeout bug" \
--type bug \
--priority 1 \
--label security \
--label auth \
--assignee agent
From template:
gur create "Add payment processing" --template feature-checklist
Working With Subtasks
Create parent epic:
gur create "User management system" --type epic
# Returns: gur-a1b2c3d4
Add subtasks:
gur create "Design user schema" --parent gur-a1b2c3d4
gur create "Implement CRUD endpoints" --parent gur-a1b2c3d4
gur create "Add validation" --parent gur-a1b2c3d4
Subtasks get hierarchical IDs: gur-a1b2c3d4.1, gur-a1b2c3d4.2, etc.
Managing Dependencies
Block a task until another completes:
# "auth" blocks "dashboard" (dashboard can't close until auth is done)
gur dep add gur-auth123 gur-dash456
Check what's blocking:
gur show gur-dash456 # Shows "Blocked by: gur-auth123"
Find unblocked tasks ready for work:
gur ready
Quality Gates
Gates enforce checks before task closure.
Create a gate:
gur gate create "Unit tests pass" --type test --command "go test ./..."
gur gate create "Code review approved" --type review
gur gate create "Security scan clean" --type approval --priority 0
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 381 lines · 11 tokens per session scan A 4fd688b90a3a
gur-workflow is a skill published in the GitHub repository Giancarlos/guardrails (24 stars, last pushed 4mo ago), licensed MIT. It adds 11 tokens to every session and 2,060 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
beads
Use when working in a repository that uses bd or Beads for durable project task tracking, issue dependencies, blocker management, multi-session handoff, or shared work memory. Trigger when the user asks to find ready work, claim or close tasks, create follow-up work, inspect blockers, recover project context, or…
work
Pick up ready leaf yaks and implement them — dispatch subagents in isolated worktrees, then merge back to main.
yak-worktree-workflow
Use when starting work on a yak - sets up an isolated git worktree, reads yak context, and guides the full cycle from claiming through merge and cleanup.
file-todos
Manage file-based todos in todos/ directory. Use when creating, triaging, or tracking todos and integrating them with code review.
lavra-work
Execute work on one or many beads -- auto-routes between single-bead, sequential, and multi-bead parallel paths based on input.
to-prd
Turn the current conversation context into a PRD and publish it to the project issue tracker. Use when user wants to create a PRD from the current context.