Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add Kevin-Liu-01/Agent-Machines --skill state-machine-dfagit clone --depth 1 https://github.com/Kevin-Liu-01/Agent-MachinesWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/kevin-liu-01/agent-machines/state-machine-dfa)<a href="https://agentmods.dev/skills/kevin-liu-01/agent-machines/state-machine-dfa"><img src="https://agentmods.dev/badge/skills/kevin-liu-01/agent-machines/state-machine-dfa/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/kevin-liu-01/agent-machines/state-machine-dfa"><img src="https://agentmods.dev/badge/skills/kevin-liu-01/agent-machines/state-machine-dfa.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00045 | $0.01181 |
| Opus 5 | $0.00023 | $0.00590 |
| Sonnet 5 | $0.00009 | $0.00236 |
| Haiku 4.5 | $0.00005 | $0.00118 |
Grade A, and why
state-machine-dfa scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 155 lines — stays where its author put it; the contents beside it link to each section on GitHub.
State Machine DFA Documentation
The Rule
Every module with sequential state transitions gets two artifacts:
- README.md with a colored mermaid state diagram showing the happy path and every error edge.
- dfa.rs (or
dfa.go,dfa.py) with the states, inputs, and transition table as code. This file is the source of truth. The diagram visualizes it.
Why
State machines have a specific failure mode: implicit transitions. Code that
calls resume() after wait_ready() is assuming a transition that the
underlying system does not guarantee. The socket being connectable does not
mean the VM is paused. The HTTP 200 does not mean the resource is ready.
A DFA file makes every transition explicit. If a transition is not in the table, it does not exist. If a state is not observed before acting, the code is wrong.
The pattern: each state is a function that reads the current input (an API response, a socket probe, a file on disk), matches on it, and returns the next state. No state is assumed. No transition is implicit. Invalid transitions return an error, not a fallback.
What Goes in the README
A mermaid stateDiagram-v2 with:
- Named states as nodes
- Labeled transitions as edges (what triggers the transition)
- Error states in red (
classDef error) - Happy path in green or blue
- Every error edge drawn explicitly (no implicit "otherwise fail")
## Restore State Machine
` ` `mermaid
stateDiagram-v2
classDef happy fill:#2d6a4f,color:#fff
classDef error fill:#d00000,color:#fff
[*] --> TemplateLookup
TemplateLookup --> Materialize : snapshot compatible
Materialize --> Spawned : DHV process started
Spawned --> SocketReady : socket accepts connection
SocketReady --> Paused : info().state == Paused
Paused --> Running : vm.resume ok
Running --> Resized : hotplug ok (or no-op)
Resized --> Specialized : guest specialize ok
Specialized --> Published : fence token valid
Published --> [*]
TemplateLookup --> Error : snapshot missing/incompatible
Materialize --> Error : artifact copy failed
Spawned --> Error : socket timeout
SocketReady --> Error : restore did not reach Paused
Paused --> Error : resume rejected
Running --> Error : hotplug rejected
Resized --> Error : guest rejected
Specialized --> Error : fence CAS failed
class Published happy
class Error error
` ` `
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 155 lines · 45 tokens per session scan A f3e0db4e1214
state-machine-dfa is a skill published in the GitHub repository Kevin-Liu-01/Agent-Machines (29 stars, last pushed yesterday), licensed MIT. It adds 45 tokens to every session and 1,181 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
app-debug-workflow
⚠️ TRIGGER: when auditing an unfamiliar full-stack codebase for bugs — security, performance, reliability, dev tooling. Multi-session workflow: discover → duck-verify → plan → handoff → fix → validate. 90-min timebox. Designed for time-pressure coding/debug tasks.
code-simplifier
Review substantial mcp-reporter changes for unnecessary complexity while preserving tested behavior and public contracts.
vicious-mockery
The bard's cantrip that deals psychic damage through insults. In practice this is adversarial review — the art of finding and articulating exactly what is wrong with something in a way that is impossible to ignore. Unlike polite feedback that gets filed and forgotten, vicious mockery lands. It is the red-team report…
grill-with-docs
Cross-examine codebase architecture against official library documentation and API specs. Identifies deprecations, anti-patterns, and suboptimal library usage.
code
Use BEFORE generating, refactoring, reviewing, or debugging code. Trigger phrases include "write a function/script/class for X", "review this code/diff/PR", "refactor this", "debug this error", "is this implementation correct", "what's wrong with this code", "improve this code", "translate from X to Y", or any prompt…
engineering-incident-response-commander
An incident-response guide for managing production failures, coordinating responders, reviewing what happened afterward, and tracking service targets. SLOs and SLIs are measures used to define and monitor service reliability.