Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/lukedj78/dev-flow/shadscannpx skills add lukedj78/dev-flow --skill shadscangit clone --depth 1 https://github.com/lukedj78/dev-flowWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00215 | $0.05288 |
| Opus 5 | $0.00108 | $0.02644 |
| Sonnet 5 | $0.00043 | $0.01058 |
| Haiku 4.5 | $0.00021 | $0.00529 |
Grade A, and why
shadscan scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 288 lines — stays where its author put it; the contents beside it link to each section on GitHub.
shadscan — UI-quality & accessibility pre-deploy gate for React/shadcn apps
Runs on a web project that already exists and uses shadcn. It wraps the third-party shadscan CLI — a deterministic static audit of UI fundamentals — and turns its report into applied fixes, routing each finding to the skill that owns it.
This is the gate that covers what neither sibling can see. compliance-audit reads the legal surface,
vercel-doctor reads the cost surface; nothing in dev-flow mechanically verified that the UI we
prescribe actually got built — that the reduced-motion guard transitions mandates is really there,
that the form errors forms specifies are really rendered, that a route has a loading boundary at all.
Third-party tool. shadscan is not an official shadcn product — it's an independent open-source project by TheOrcDev, published to npm as
@shadscan/cli(binshadscan, MIT). Verified against the npm registry + repo README (at time of writing: 0.9.0, ruleset2026.07.41, reportschemaVersion 9— the report shape is versioned, re-check it). From the README, verbatim: "The default scan is deterministic and read-only. It does not start the app, edit files, call an AI model, upload source, or require application secrets." That makes it safe to run on a private codebase without the--offlinedancevercel-doctorneeds.
Verified invocation + flags
npx --yes @shadscan/cli # explore: latest, human output
npx --yes @shadscan/[email protected] --json --no-interactive \
> docs/ui/shadscan.json # audit: PINNED — the mode this skill uses
npx --yes @shadscan/[email protected] --fail-under 70 --no-interactive # CI gate: pinned + ratcheted
⚠️ Pin the version for anything you will compare. npx --yes @shadscan/cli resolves to latest on
every call — during a single session it went 0.9.0 → 0.10.0 (ruleset 2026.07.41 → 2026.07.42, 59
rules → 60), silently making a before/after diff a comparison across two different rulesets. shadscan
knows this: the verification.shadscanCommand it emits in its own acceptance criteria is already
pinned (pnpm dlx @shadscan/[email protected] --json). Follow it. Pin the baseline run, pin the re-run, and
only drop the pin when you deliberately want the newer ruleset — then re-baseline instead of diffing.
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 288 lines · 215 tokens per session scan A 05b36ac164c3
shadscan is a skill published in the GitHub repository lukedj78/dev-flow (5 stars, last pushed 5d ago), licensed MIT. It adds 215 tokens to every session and 5,288 once invoked, about $0.0011 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
moai-ref-react-patterns
React/Next.js component design patterns, state management strategies, and project structure reference for frontend development. Agent-extending skill that amplifies frontend domain work (spawned via Agent(general-purpose) with frontend instructions) with production-grade React patterns. NOT for: backend API design…
moai-domain-frontend
Frontend development specialist covering React 19, Next.js 16, Vue 3.5, and modern UI/UX patterns with component architecture. Use when building web UIs, implementing components, optimizing frontend performance, or integrating state management.
formkit
Use when working with FormKit forms, validation, schema, or custom inputs in React, Vue, or Nuxt projects.
writing-react-native-storybook-stories
Create and edit React Native Storybook stories using Component Story Format (CSF). Use when writing .stories.tsx files, adding stories to React Native components, configuring Storybook addons (controls, actions, backgrounds, notes), setting up argTypes, decorators, parameters, or working with portable stories for…
setup-react-native-storybook
Set up Storybook for React Native in Expo, React Native CLI, or Re.Pack projects. Use when adding Storybook to a project, configuring metro.config.js with withStorybook, creating .rnstorybook configuration files, setting up Storybook routes in Expo Router, configuring getStorybookUI, or adding the StorybookPlugin to a…
codegen-html
Scaffold and iterate on standalone Preact + HTM applications with zero build dependencies.