Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add matheusPavaneli/workbench --skill implement-changegit clone --depth 1 https://github.com/matheusPavaneli/workbenchWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/matheuspavaneli/workbench/implement-change)<a href="https://agentmods.dev/skills/matheuspavaneli/workbench/implement-change"><img src="https://agentmods.dev/badge/skills/matheuspavaneli/workbench/implement-change/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/matheuspavaneli/workbench/implement-change"><img src="https://agentmods.dev/badge/skills/matheuspavaneli/workbench/implement-change.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00051 | $0.01035 |
| Opus 5.5 | $0.00020 | $0.00414 |
| Sonnet 5.5 | $0.00010 | $0.00207 |
| Haiku 4.5 | $0.00005 | $0.00103 |
Grade A, and why
implement-change scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 81 lines — stays where its author put it; the contents beside it link to each section on GitHub.
implement-change
wb <args> # wb not on PATH: python <this skill's directory>/../../lib/wb.py <args>
Steps
-
Read the plan's own slices, not the whole document:
sdd get <KEY> --section stepsand--section files. Nosdd.json? Runplan-changefirst. A failed audit blocks every command here by design — fix the plan, do not work around it.Picking work back up mid-way?
status <KEY>says which planned files are already changed and what is left, without re-reading the plan. -
Check where you are.
flow showreports the branch this work starts from, whether the current branch is protected, and any validation branch the commits will later be carried onto.flow start <KEY> --title "..."prints the branch name and base to use. -
Implement one step at a time, in order, touching only the listed files. Follow the repo's existing patterns. Nothing tidied, renamed or upgraded along the way: the plan's file list is the scope, and it was reviewed.
-
Write the tests the plan named.
sdd get <KEY> --section tests. Each entry says what must hold — assert that, not that a function was called.impl verifyfails, naming it, on anytargetthe branch never changed. -
Check the scope.
impl check <KEY>after each step or two: planned filesok/pending,companion(a test, lockfile or generated file tied to a planned one),other(another plan's),overlap. It fails on a file nothing accounts for; with hooks on, that edit is refused before it lands. -
Verify.
impl verify <KEY>runs the plan'sverifycommands and writes.workflow/<KEY>/evidence.md. It refuses anything that is not a known test, build or lint runner — run those yourself and say so. The first time a command appears in a checkout nothing runs:approve <KEY>then shows the commands and a token. Show it to the user; never approve on their behalf. The evidence is bound to the tree it saw, so verify last, then commit. For a bug fix,impl verify <KEY> --regression: eachregressiontarget runs on the commit the branch left, with the new tests carried in, and must fail there, then pass here. Report the result either way.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago Changed 2eb34769dfdc
- 1mo ago Changed · +2 lines 19b0ccb0f486
- 1mo ago Changed · +7 lines 33e3d2d2bb69
- 2mo ago First seen · 72 lines · 51 tokens per session scan A 6fbf4e1341b2
implement-change is a skill published in the GitHub repository matheusPavaneli/workbench (1 stars, last pushed 1mo ago), licensed MIT. It adds 51 tokens to every session and 1,035 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
dev-kit-setup
First-use bootstrap for the dev kit. Detects the team's issue tracker, discovers what it can via MCP/CLI, asks only what cannot be discovered, and persists the result to .claude/dev-kit.json in the consuming repo. Use when that file is missing, when the user asks to set up or reconfigure the kit, or when issue-fetch…
plan-backlog
Turn an idea or description (in any format) into a well-formed backlog — epics, user stories with acceptance criteria, sub-tasks — and create it in the team's tracker after approval. Elaborates progressively (guided, the default) or in one shot (--quick). Supports Jira, Linear, GitHub Issues, and Azure DevOps via…
before-you-claim
Seven questions answered with evidence at the moment a change is written, one for each defect class this repo's fault register keeps recording — a sentence claiming what the code does not do, a check that cannot fail, a fix for the instance while the class stays open, a rule that lives in prose with no mechanism, a…
create-pr
Create a branch, commit the work, and open a pull request for a completed user story, after all quality gates pass. Use when the user asks to open/create a PR or as the final step of the story workflow.
issue-fetch
Fetch a work item (summary, status, description, acceptance criteria, comments) from the team's issue tracker and display a clean summary. Supports Jira, Linear, GitHub Issues, and Azure DevOps via adapters. Use whenever a prompt contains an issue reference (e.g. PROJ-1234, ENG-42.
issue-update
Update the work item after delivery - comment the PR link and a product-facing summary, and transition it to the team's review status. Supports Jira, Linear, GitHub Issues, and Azure DevOps via adapters. Use right after a PR is created for a story, or when the user asks to update/move a ticket.