Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add majiayu000/spellbook --skill flowguardgit clone --depth 1 https://github.com/majiayu000/spellbookWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/majiayu000/spellbook/flowguard)<a href="https://agentmods.dev/skills/majiayu000/spellbook/flowguard"><img src="https://agentmods.dev/badge/skills/majiayu000/spellbook/flowguard.svg" alt="Measured on agentmods" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 2 findings, up to medium
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- medium MCP Rug Pull · line 110 npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.Fix: Pin the version: npx @scope/[email protected]
- low Excessive Agency · line 19 Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.Fix: Limit the skill's scope to its documented purpose. Remove instructions that enable the agent to perform actions outside its stated functionality.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00078 | $0.01754 |
| Opus 5 | $0.00039 | $0.00877 |
| Sonnet 5 | $0.00016 | $0.00351 |
| Haiku 4.5 | $0.00008 | $0.00175 |
Grade A, and why
flowguard scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 165 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Flowguard
Overview
Use this skill as the single lifecycle entrypoint for agent work that can drift, lose context, or become expensive. It routes the task, verifies current state, runs bounded execution loops, and leaves a resumable handoff.
This skill coordinates other skills; it does not replace them. Use task-specific skills such as systematic-debugging, comprehensive-testing, codex-retrospective, or vibeguard only when their trigger is clearly met.
Operating Contract
- Do not start a long autonomous loop until route, scope, and stop conditions are explicit.
- Do not treat memory, summaries, or handoffs as current truth until repo, git, files, runtime, or remote state is verified.
- Do not claim completion without fresh verification evidence from the current session.
- Do not expand scope, touch destructive surfaces, or cross file-ownership lanes without stopping to re-route.
- Re-state the primary objective and a plan of no more than five steps before major phase changes.
- Prefer one controlling checkpoint over many specialized workflow fragments when the task risk is context loss, drift, or compounding errors.
- Before commit, push, PR, merge, or applying agent-generated changes outside the already-approved scope, call
review-gateor produce the same review pack and wait for explicit human approval.
Route First
Choose one route before editing files or running a long loop:
| Route | Use When | Action |
|---|---|---|
execute_direct |
Goal, context, constraints, and done-when are clear; scope is small or verification is cheap. | Work directly with short checkpoints. |
plan_first |
Work spans many files, sessions, agents, architecture decisions, migrations, or risky sequencing. | Create a brief execution plan or use the relevant planning skill before edits. |
clarify_first |
Goal, target files, constraints, done-when, destructive permission, production impact, or ownership is unclear. | Ask the smallest blocking question before continuing. |
What ships with it
3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 165 lines · 78 tokens per session scan A 0c38adfd1835
flowguard is a skill published in the GitHub repository majiayu000/spellbook (276 stars, last pushed 3d ago), licensed MIT. It adds 78 tokens to every session and 1,754 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
workflow
A workflow skill for embedded-device projects that plans and runs building, flashing, debugging, observing, and diagnosis tasks.
pneuma-session
Instructions for renaming an active Pneuma session and replacing its default preview with a useful title and summary. A Pneuma session is one work area inside a larger project.
cheese
Route an idea, path, pull request, issue, failure, question, or bare /cheese to the correct workflow skill. Use this skill for /cheese, routing requests, help requests, or opening messages without a named workflow skill.
joycraft-bugfix
Structured bug fix workflow — triage, diagnose, discuss with user, write a focused spec, hand off for implementation.
bug-fix
Regression-first workflow for fixing a defect whose cause is known. Reproduce the confirmed defect, fix the root cause minimally, protect it with a regression test, and verify. If the root cause is still unknown, use the debugging skill first.
shell-output-compaction
Reduce shell and tool-output token waste by preferring targeted commands, diff-only views, error-first logs, narrow slices, counts, and concise summaries instead of large raw stdout dumps. Use on coding, debugging, audits, CI triage, or repo exploration when command output is likely to dominate token usage.