Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/lukedj78/dev-flownpx agentmods add skills/lukedj78/dev-flow/monorepo-add-shared-packageWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/lukedj78/dev-flow/monorepo-add-shared-package)<a href="https://agentmods.dev/skills/lukedj78/dev-flow/monorepo-add-shared-package"><img src="https://agentmods.dev/badge/skills/lukedj78/dev-flow/monorepo-add-shared-package.svg" alt="Measured on agentmods" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 2 findings, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium MCP Rug Pull · line 88 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- medium MCP Rug Pull · line 90 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00179 | $0.01585 |
| Opus 5 | $0.00089 | $0.00792 |
| Sonnet 5 | $0.00036 | $0.00317 |
| Haiku 4.5 | $0.00018 | $0.00159 |
Grade A, and why
monorepo-add-shared-package scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 131 lines — stays where its author put it; the contents beside it link to each section on GitHub.
monorepo-add-shared-package — factor shared logic into packages/
Contract
See references/contracts.md (vendored from dev-flow). Key facts:
- Reads
<project-root>/.workflow/meta.json#stack.framework— must be"monorepo". - Requires
meta.json#phase ≥ "scaffolded". - Adds entries to:
tsconfig.base.json#paths(new alias@<slug>/<pkg-name>/*)apps/web/package.json#dependenciesANDapps/mobile/package.json#dependencies(asworkspace:*)meta.json#stack_config.shared_packagesarray
- Does NOT modify
phase.
When this skill applies
- User says: "estrai questa logica in shared", "create a shared @/foo package", "spostala in packages/shared", "factor X out of the apps".
- Orchestrator does NOT route here automatically — invoked on demand.
Knowledge dependencies
monorepo-bootstrap/references/structure.md— for the canonical layout.monorepo-bootstrap/references/patterns.md— for the workspace protocol + import conventions.
Workflow
Step 1 — Verify preconditions
Read .workflow/meta.json. Abort with clear message if:
stack.framework != "monorepo"→ "This skill is monorepo-only. For non-monorepo projects use plain TS path aliases inside the app."phase < "scaffolded"→ "Need at least scaffolded — run monorepo-bootstrap first."
Read meta.json#project_slug for the namespace.
Step 2 — Determine the package name
Ask the user (one round-trip):
"Package name (without namespace)? E.g. 'shared', 'design', 'api', 'ui', 'config-eslint'. Or a topic-specific one like 'forms', 'analytics', 'payments-client'."
Validate:
- kebab-case only (lowercase a-z, 0-9, hyphens).
- Reject reserved names:
web,mobile,root(those are app names, not packages). - If the user picks
shared,design, orapiand the package already exists, route to that existing package (add files there instead of creating a new one).
Resulting package: @<slug>/<name> lives at packages/<name>/.
Step 3 — Decide the source mode
What ships with it
3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 7d ago First seen · 131 lines · 179 tokens per session scan A be1a8ec6d75d
monorepo-add-shared-package is a skill published in the GitHub repository lukedj78/dev-flow (6 stars, last pushed yesterday), licensed MIT. It adds 179 tokens to every session and 1,585 once invoked, about $0.0009 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
agent-code-analyzer
Agent skill for code-analyzer - invoke with $agent-code-analyzer.
worker-integration
Worker-Agent integration for intelligent task dispatch and performance tracking.
agui-dotnet-streaming-chat
Get started with the AG-UI .NET SDK: bootstrap and run your first streaming-chat app (client + server) with the AG-UI .NET NuGet packages (AGUI.Client, AGUI.Server, AGUI.Formatting, AGUI.Abstractions). USE FOR: which packages to install and how to wire them; constructing an AGUIChatClient against an endpoint and…
agui-dotnet-protobuf
Use the protobuf wire transport (instead of the default Server-Sent Events) for an AG-UI connection with the AG-UI .NET SDK — a compact binary event stream negotiated via the Accept header. USE FOR: making an AGUIChatClient prefer protobuf by wiring an AGUIEventStreamHandler with ProtobufEventStreamFormatter (then…
taiyi-ui-design
A design-planning guide for describing how an application's user interface should look and behave. It produces a UI-DESIGN.md document covering layouts, components, interactions, accessibility, and error states.
strict-tdd
Strict RED->GREEN->REFACTOR test-driven development with enforcement. Never write production code before a failing test. Atomic commits per TDD cycle.