devflow-flow-attachment

devflow-flow-attachment is a skill for Claude Code, Codex from KlausFreiberufler/devflow-mcp. It costs 82 tokens per session (927 once invoked), scanned A, original, MIT.

A set of instructions for attaching text or files to a DevFlow flow, which is a record used to track work. It chooses between uploading text and uploading a file, and assigns a category such as plan, summary, decision, design, or notes.

In plain words
What is it for?
Use it when someone asks to attach notes, plans, images, PDFs, screenshots, or other files to a flow. It also helps classify common Markdown attachments.
Why use it?
It prevents the agent from using the wrong upload method or silently shortening content. This keeps saved context complete and linked to the right part of the flow.

Skill for Claude CodeCodex

Part of the devflow plugin — 24 skills, 8 commands, 2 MCP servers shipped together

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add skills/klausfreiberufler/devflow-mcp/devflow-flow-attachment
Any agent
npx skills add KlausFreiberufler/devflow-mcp --skill devflow-flow-attachment
Clone the repo
git clone --depth 1 https://github.com/KlausFreiberufler/devflow-mcp

Made for: Claude Code, Codex.

Or install devflow, the plugin that ships this one along with the rest of its 24 skills, 8 commands, 2 MCP servers.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for devflow-flow-attachment

README.md
[![agentmods](https://agentmods.dev/badge/skills/klausfreiberufler/devflow-mcp/devflow-flow-attachment.svg)](https://agentmods.dev/skills/klausfreiberufler/devflow-mcp/devflow-flow-attachment)
Your own site
<a href="https://agentmods.dev/skills/klausfreiberufler/devflow-mcp/devflow-flow-attachment"><img src="https://agentmods.dev/badge/skills/klausfreiberufler/devflow-mcp/devflow-flow-attachment.svg" alt="Measured on agentmods" height="20"></a>
Per session 82 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 927 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00082 $0.00927
Opus 5 $0.00041 $0.00464
Sonnet 5 $0.00016 $0.00185
Haiku 4.5 $0.00008 $0.00093

Measured 3d ago against content hash c2465ff7b005, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

devflow-flow-attachment scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

packages/skills/skills/devflow-flow-attachment/SKILL.md · 105 lines

How it starts

The opening of the file, as written. The whole thing — 105 lines — stays where its author put it; the contents beside it link to each section on GitHub.

DevFlow — Flow Attachment

You attach files to a flow when the user wants to persist context on a flow record. Two MCP tools, one decision tree.

Trigger phrases (DE + EN)

  • "häng X an [DF-…]" / "attach this to flow"
  • "merk dir [Datei] auf dem Flow"
  • "save this image as attachment"
  • "upload das Bild zum Flow"
  • "leg das als Attachment ab"
  • "speichere das im Flow"

Decision tree

Is the content already a string in your context (markdown/text/JSON you wrote yourself)?
  → flow_upload({ filename, content, kind? })

Is it a file on disk (image, PDF, large export, screenshot)?
  → flow_upload_file({ filePath, kind? })

When in doubt: text-content the agent created → flow_upload. File at a path → flow_upload_file.

Kind auto-detection

Filename / extension Suggested kind Why
*plan*.md plan Backend links it as implementation_plan_attachment_id
*summary*.md summary Code-review summary or post-flow report
*decision*.md, ADR-style decision Promotable to ADR via adr_accept
*design*.md, options/chosen design Architecture sketches
screenshots, photos, PDFs, generic notes notes Default for visual / reference content

If the user is explicit about kind, use that. Otherwise pick from the table.

Examples

User: „häng /tmp/cover.png an DF-361 als notes" You:

flow_upload_file({
  flowId: "DF-361",
  filePath: "/tmp/cover.png",
  kind: "notes",
})

User: „save the LinkedIn post text as attachment on the current flow" You:

flow_upload({
  filename: "linkedin-post.md",
  content: "<the markdown you generated>",
  kind: "notes",
})

User: „attach this implementation plan I wrote in /Users/klaus/Documents/plan.md" You:

flow_upload_file({
  filePath: "/Users/klaus/Documents/plan.md",
  kind: "plan",
})

(Backend validates the YAML frontmatter against the plan-schema. If it fails, surface the error to the user — don't silently strip frontmatter.)

Read the full file on GitHub · 105 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 3d ago First seen · 105 lines · 82 tokens per session scan A c2465ff7b005

Subscribe to this mod's changes

devflow-flow-attachment is a skill published in the GitHub repository KlausFreiberufler/devflow-mcp (1 stars, last pushed 5d ago), licensed MIT. It adds 82 tokens to every session and 927 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Related

Other skills, from other repositories

wayfinder

Plan a huge chunk of work (more than one agent session can hold) as a shared map of decision tickets on your issue tracker, and resolve them one at a time until the way to the destination is clear.

mattpocock/skills · 46 tokens

sap-transport-overview

System-wide inventory of open transport requests — every visible modifiable request, who owns it, how big it is, and supported risk signals such as empty/local requests, explicit locks, and confirmed manifest overlaps. Headers-only and cheap; NO source diffs. Use when asked "what transports are open in the system"…

arc-mcp/arc-1 · 106 tokens

timeline-creator

Create HTML timelines and project roadmaps with Gantt charts, milestones, phase groupings, and progress indicators. Use when users request timelines, roadmaps, Gantt charts, project schedules, or milestone visualizations.

mhattingpete/claude-skills-marketplace · 47 tokens

okx-task-watch

监听任务进展 / 帮我盯着任务 / 任务有动静告诉我 / 历史消息 / 未读消息 / 未决策 / 待决策 / 继续监听 / task watch / user watch / monitor task progress / catch me up on tasks / outstanding decisions — OKX A2A user-session task-notification monitor: live long-poll via okx-a2a user watch (also drains backlog of past/missed/unread events on entry) plus…

nirholas/three.ws · 138 tokens

pm-all

Skill "pm-all" from wei63w/pm-manager, covering user input, outline and shared workflow (all /pm- commands).

wei63w/pm-manager · 8 tokens

bootstrap-prd

Set up PRD-driven development infrastructure for a new project, including directory structure, templates, and roadmap.

joshukraine/dotfiles · 25 tokens