Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/innocent-children/dev-flow/dev-flownpx skills add Innocent-children/dev-flow --skill dev-flowgit clone --depth 1 https://github.com/Innocent-children/dev-flowWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00084 | $0.06251 |
| Opus 5 | $0.00042 | $0.03125 |
| Sonnet 5 | $0.00017 | $0.01250 |
| Haiku 4.5 | $0.00008 | $0.00625 |
Grade A, and why
dev-flow scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 477 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Dev Flow
This Skill is the current Core contract Codex adapter for the shared Dev Flow Core. Core owns task state, current node, legal transitions, destinations, recovery, blockers, and terminal outcomes. The Skill admits one implicit or explicit request, silently validates normal startup results, renders method work, and forwards one closed result without keeping adapter state.
Request routing
Route the current request before the single-Task admission gate.
An explicit parallel batch names two or more independent, bounded development tasks for the same logical Git repository and asks Codex to run them concurrently. Handle that batch as a Host coordination request, not as one Core Task:
- Use this route only when the current Host exposes a task/thread creation capability that can place every child in a distinct Git worktree. A generic sub-agent or child that shares the coordinator's working directory is not isolated and must not be used for this route.
- Create one worktree-backed Codex task for each bounded item. Give each child only its own request,
bounds and acceptance criteria, and include the exact
$dev-flow-codex:dev-flowselector so the child performs its own admission, handshake, Task discovery and Action loop. - Do not call any Dev Flow MCP tool from the coordinator and do not create a parent Core Task for the batch. Each child worktree owns one independent Core Task; Core remains unaware of the Host coordination layer.
- Do not create, switch, delete or clean a Git worktree through shell or Core. The Host-provided worktree task capability owns worktree setup under the user's current request and authorization.
- If the capability is absent, cannot guarantee a distinct worktree for every child, or cannot preserve the requested task boundaries, stop before dispatch. Tell the user to start each item in a separate Codex worktree-backed task; do not fall through to one combined Task or shared-directory parallel work.
- Host monitoring may report each child independently. It must not merge Task state, infer a shared outcome, or perform commit, merge, rebase, push or conflict resolution without separate authority.
What ships with it
3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 477 lines · 84 tokens per session scan A d7368fd07e5e
dev-flow is a skill published in the GitHub repository Innocent-children/dev-flow (4 stars, last pushed 3d ago), licensed Apache-2.0. It adds 84 tokens to every session and 6,251 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
prewalk
Use when the user wants a coding task executed with a strong planner model first and a faster/cheaper executor model after the first successful implementation edit.
find-skills
检索已安装技能并给出使用方法。.
building-edgespark-apps
Build and modify EdgeSpark apps. Use when a project has edgespark.toml, the user mentions EdgeSpark, or work involves the edgespark CLI, server SDK types, storage/auth/database workflows, deployment, or @edgespark/web.
pixel-office
Show Codex subagents working in a live Stardew-style pixel office web page. Use PROACTIVELY and implicitly whenever a task starts or observes subagents (spawnagent/collaboration or subagentactivity), even when the user never mentions this plugin; automatically open the Codex app right sidebar page. Also use when the…
edgespark-frontend-design
Design and redesign EdgeSpark frontends with distinctive, production-grade visual direction instead of generic AI-looking UI. Use when building or polishing landing pages, marketing sites, dashboards, auth flows, portfolios, product surfaces, or reusable frontend sections in EdgeSpark, especially when the task…
codex-usage-viewer
Render a terminal activity heatmap of local Codex token usage from /.codex/sessions. Use when the user asks for Codex usage visualization, token usage, usage activity, contribution-style heatmap, usagevis, /usagevis, or recent-days Codex usage.