Getting it into your agent
This one installs as part of its plugin. Adding the marketplace and installing the plugin brings it with everything else the plugin ships.
/plugin marketplace add mgallet92i/waterfall/plugin install waterfallWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/mgallet92i/waterfall/wf-quit)<a href="https://agentmods.dev/skills/mgallet92i/waterfall/wf-quit"><img src="https://agentmods.dev/badge/skills/mgallet92i/waterfall/wf-quit/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/mgallet92i/waterfall/wf-quit"><img src="https://agentmods.dev/badge/skills/mgallet92i/waterfall/wf-quit.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00023 | $0.01281 |
| Opus 5 | $0.00012 | $0.00641 |
| Sonnet 5 | $0.00005 | $0.00256 |
| Haiku 4.5 | $0.00002 | $0.00128 |
Grade B, and why
wf-quit scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Reads agent configuration directoriesmediumAgent snooping
.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.
need_name=$(cat ~/.claude/wf-session-active.<session_id>) How it starts
The opening of the file, as written. The whole thing — 114 lines — stays where its author put it; the contents beside it link to each section on GitHub.
wf-quit — Clean shutdown of the active workflow
This skill is invoked by /waterfall:quit. It stops the active team of the current session, cleans up session markers, and preserves the need's state for resumption via /waterfall:resume.
Step 1 — Detect the active session
Read the current session_id from the environment or the Claude Code session context.
Check whether the session marker exists:
~/.claude/wf-session-active.<session_id>
If the file does not exist: display the following message and stop (exit 0):
No active wf workflow in this session.
(EX-011 — no error, neutral behavior)
If the file exists: read its content to obtain the need_name:
need_name=$(cat ~/.claude/wf-session-active.<session_id>)
Step 2 — Load the team config (implicit team, session-derived)
The team name is session-derived (CLI v2.1.178+): session-<first 8 chars of sid>. Read the need's session_id and build the path:
sid=$(jq -r .session_id "wf/needs/$need_name/.wf-state.json" | tr -d '\r\n')
team_cfg="$HOME/.claude/teams/session-${sid:0:8}/config.json"
teammates=$(jq -r '.members[]?.name | select(. != "team-lead")' "$team_cfg" 2>/dev/null)
If the file is missing (subagent-light, or no team formed): continue with an empty list (R4 fallback — the platform cleans up teammates at session end anyway).
Step 3 — Send shutdown_request to each teammate
For each teammate from step 2, send a graceful shutdown_request via SendMessage, referencing the teammate by name:
SendMessage(to: <teammate_name>, message: { type: "shutdown_request", reason: "wf-quit" })
Best-effort: teammates are also cleaned up automatically at session end, so do not block waiting for shutdown_response.
Step 3.bis — Close the active segment (ADR-008)
Before deleting markers, close the current segment in .wf-state.json:
state_file="wf/needs/$need_name/.wf-state.json"
source "${CLAUDE_PLUGIN_ROOT}/scripts/lib/wf-segments.sh"
_seg_close "$state_file" || true
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 114 lines · 23 tokens per session scan B 53ed41b4653c
wf-quit is a skill published in the GitHub repository mgallet92i/waterfall (2 stars, last pushed 1mo ago), licensed MIT. It adds 23 tokens to every session and 1,281 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it B with 1 finding (reads agent configuration directories). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
plan
Use this skill at the START of every coding task — new builds, bug fixes, and change requests. Classifies the work item, validates it against project scope, produces a high-level estimate, proposes a technology stack, and checks stack compatibility. Writes a plan artifact to .claude/sdlc/plans/ that every downstream…
start
Use this skill when the user runs /start, says "start", "enable the SDLC workflow", "I want to build", "I want to fix", "set up", "get started", or otherwise signals they want to activate or re-enable the SDLC workflow. Handles three distinct paths based on marker state — fresh install (opt-in activation), re-enable…
domain-expert
Use this skill during /plan (between scope validation and writing the plan artifact) to inject domain-specific context, gap questions, and regulatory concerns into the plan. Triggers automatically when the plan skill evaluates the task and scope.md against the domain registry in domains/index.json using semantic…
configure
Use this skill when the user runs /configure, /configure --needs, or /configure --check. Also auto-invoked by env-detect.sh on fresh install (Layer 0) and by skills that find required config missing at runtime (Layer 2). Guides setup of config/tools.json and config/tools.local.json through a question bank; handles…
status
Use this skill when the user asks "where am I", "what's the current task", "what's blocking me", "show status", "what needs sign-off", or "what's next". Prints a snapshot of the active plan, gate, sign-off progress, and next action. Reads only — writes nothing.
analyze
Use this skill after Phase 1 Plan to create or intake requirements for a task. Produces requirements with stable IDs (REQ-001, REQ-002, ...), validates each requirement against the project's scope statement, and — critically — halts and asks for UX designs and brand guidelines whenever the work touches a frontend or…