Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/go1c/workflow-plugin/workflow-feedbacknpx skills add Go1c/workflow-plugin --skill workflow-feedbackgit clone --depth 1 https://github.com/Go1c/workflow-pluginWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00156 | $0.02860 |
| Opus 5 | $0.00078 | $0.01430 |
| Sonnet 5 | $0.00031 | $0.00572 |
| Haiku 4.5 | $0.00016 | $0.00286 |
Grade A, and why
workflow-feedback scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 105 lines — stays where its author put it; the contents beside it link to each section on GitHub.
workflow-feedback — 向平台方反馈问题与建议
把用户遇到的 Workflow 平台或本插件自身的问题与建议报给平台方的客服收件箱：报错、API 行为与文档不符、体验不好、加载或操作明显卡慢、缺失功能、产品建议——不限于报错，体验项同样值得上报。
核心纪律一句话：先逐字确认，后匿名发送；全程不碰凭证。
硬闸门（命中即停）
以下 7 条是停止条件，不是风格建议；与正文其他要求冲突时以这里为准（出处 references/feedback-gates.md）。
| # | 触发条件 | 动作 |
|---|---|---|
| F1 | 想读取 WORKFLOW_TOKEN、config.toml、.workflow 里的凭证，或想在请求里携带 Authorization 头 / Cookie |
停止。反馈只走公开匿名端点——带上凭证等于把项目身份与密钥送进平台收件箱，服务端也会按敏感内容直接 422 |
| F2 | 想为「补全上下文」去扫仓库、读项目文件、读环境变量、翻历史会话 | 停止。素材只来自本轮对话里用户主动提供或点名的内容（包括本次会话刚发生、用户要求上报的报错与卡慢现象）；唯二例外是协议字段的本机读取——workflow-update/VERSION（pluginVersion）与宿主版本号 |
| F3 | 完整报告、目标 Host、每个附件的文件名与大小、不发送清单尚未逐字展示，或用户尚未针对这一版明确说发送 | 不得 POST。「行」「内容不错」不是发送确认；userConfirmed=true 只表示这道确认做完了，不构成任何授权 |
| F4 | 确认之后又改动了报告或附件的任何一处 | 旧确认与旧幂等键同时作废：重新展示、重新确认、重新生成 UUID——旧 key 配新内容必撞 409 |
| F5 | 报告或附件疑似命中不发送清单（token、Cookie、配置正文、邮箱、完整 HTTP 请求体等，全清单见 ticket-fields.md） | 停止，指出命中位置，让用户脱敏后重走确认；不「顺手删掉再发」——用户没看过的版本不算确认过 |
| F6 | 想附上用户没有在本次会话明确点名的文件，或附件超 5 个、单个超 25MiB | 停止。附件 = 用户点名 + 出现在已确认清单里，缺一不可；超限让用户取舍，不擅自截断或代选 |
| F7 | 拿到 202 后想说「已建单」「已创建 Bug」「平台已受理为正式单」，或想替用户查询收件进度 | 停止。sup_ 开头的是收件编号不是单号，状态是待人工审核；平台没有公开的收件进度查询端点，转正与否由运营决定 |
落单闸门 G1–G7 的前提（持凭证、写项目对象）在本技能不成立——G 表不适用，也不在此内联；G4 与 G3 的精神由 F1 / F5 / F7 承接，详见 feedback-gates.md。即使项目 Workflow 配置为 full，也不能绕过本技能的 F1–F7；匿名反馈永远不进入用户项目的 PM bundle。
边界：反馈做什么、不做什么
| 做 | 不做 |
|---|---|
| 把平台或插件的问题、体验、建议报给平台方收件箱 | 往用户自己的项目里建 bug / 需求（那是 workflow-ops） |
| 只组装用户主动提供的素材 | 为补全上下文扫仓库、读配置、读环境变量 |
| 发送前逐字展示并取得对这一版的确认 | 未经确认替用户发声，或确认后改了内容直接发 |
| 匿名调公开收件端点 | 读取 PAT、携带 Authorization 头或 Cookie |
| 如实转述 202 回执与 ProblemDetails | 把收件回执说成正式单，或替用户查审核进度 |
分流口诀：记到自己项目 = workflow-ops；报给平台方 = workflow-feedback。 用户说「Workflow 有个 bug」时先分清指哪边——拿不准就问一句，别猜。答疑用法转 workflow-docs；接入与连接问题转 workflow-setup。
前置（不需要任何凭证）
本技能不读 workflow-ops 的凭证与连接前置、不走凭证三级解析——那是持凭证技能的入口，反馈用不上，也不允许用（F1）。
What ships with it
3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 105 lines · 156 tokens per session scan A 18a7f0655077
workflow-feedback is a skill published in the GitHub repository Go1c/workflow-plugin (2 stars, last pushed 2d ago), licensed MIT. It adds 156 tokens to every session and 2,860 once invoked, about $0.0008 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
opencli-sitemap-author
Use when creating or maintaining OpenCLI site sitemaps: agent-facing navigation, page-state, action, workflow, API-reference, pitfall, and fallback knowledge for a website. Use after browser exploration discovers durable site context, when a sitemap is stale, or when promoting local site knowledge into the repo.
golden-rss
Use when testing the rss golden build.
omh-code-review
This is a Hermes-native code-review workflow skill.
hyperpod-version-checker
Check and compare software component versions on SageMaker HyperPod cluster nodes - NVIDIA drivers, CUDA toolkit, cuDNN, NCCL, EFA, AWS OFI NCCL, GDRCopy, MPI, Neuron SDK (Trainium/Inferentia), Python, and PyTorch. Use when checking component versions, verifying CUDA/driver compatibility, detecting version mismatches…
redteam-web-detail-pack
Routing and boundary guidance for authorized general web application security testing. Use as a web testing router when the attack surface should be dispatched to more specific web vulnerability skills.
android-pentest
安卓应用渗透测试 — APK分析、Hook、自动化测试、运行态驱动、签名恢复、抓包分析.