Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add muyen/vibe-to-prod --skill dev-workflowgit clone --depth 1 https://github.com/muyen/vibe-to-prodWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/muyen/vibe-to-prod/dev-workflow)<a href="https://agentmods.dev/skills/muyen/vibe-to-prod/dev-workflow"><img src="https://agentmods.dev/badge/skills/muyen/vibe-to-prod/dev-workflow/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/muyen/vibe-to-prod/dev-workflow"><img src="https://agentmods.dev/badge/skills/muyen/vibe-to-prod/dev-workflow.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00028 | $0.00543 |
| Opus 5.5 | $0.00011 | $0.00217 |
| Sonnet 5.5 | $0.00006 | $0.00109 |
| Haiku 4.5 | $0.00003 | $0.00054 |
Grade A, and why
dev-workflow scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
SDLC: Intake → Triage → Explore → Plan → Code → Test → Review → Commit → Deploy → Improve
MCP Tools by Phase
| Phase | Tools |
|---|---|
| Intake | mcp__linear__get_issue, mcp__notion__notion-search |
| Explore | mcp__memory__search_nodes, mcp__github__search_code, mcp__context7__query-docs |
| Plan | mcp__linear__create_issue (subtasks), mcp__notion__notion-create-pages, mcp__github__create_branch |
| Code | mcp__context7__query-docs, Read, Write, Edit |
| Test | Bash (make test, npm test), /quick-test |
| Deploy | mcp__github__create_pull_request, /smoke-test |
| Improve | mcp__memory__create_entities, mcp__linear__create_issue |
Triage Decision
| Change Type | Path |
|---|---|
| New feature, breaking change, architecture | OpenSpec → /openspec:proposal |
| Bug fix, config, tests, typo | Quick → TodoWrite |
Phase Actions
Intake: Fetch Linear issue, search Notion for context
Explore: Search Memory for learnings, explore codebase, check related PRs
Plan: OpenSpec proposal OR TodoWrite, create branch
Code: Follow tasks, use platform rules, mark todos complete
Test: /quick-test, add tests for new logic
Review: /code-review, /security-scan if auth/data
Commit: /commit with type: description
Deploy: Create PR, run smoke tests after merge
Improve: Store learnings in Memory, create improvement tasks if needed
Quick Reference
# Backend
cd backend && make test
cd backend && make build
# Web
cd web && npm test
cd web && npm run build
# iOS
cd mobile/ios && make test
# Android
cd mobile/android && ./gradlew test
Anti-Patterns
- Coding without exploring → miss patterns
- Skipping Linear context → untracked work
- No Memory capture → repeat learnings
- Big commits → hard to review
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 12d ago First seen · 63 lines · 28 tokens per session scan A 80326c369024
dev-workflow is a skill published in the GitHub repository muyen/vibe-to-prod (34 stars, last pushed 6mo ago), licensed MIT. It adds 28 tokens to every session and 543 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-04.
Other skills, from other repositories
team-release
Orchestrate the release team — release-manager, qa-lead, devops-engineer, producer — to execute a release from candidate to deployment.
finalize-phase
Completes feature/epic workflows after deployment with comprehensive walkthrough generation for epics (v5.0+), roadmap updates, artifact archival, documentation, and branch cleanup. Use after /ship-prod, /deploy-prod, or /build-local completes, or when user asks to finalize. (project).
workflow-detection
Provides centralized workflow type detection for all phase and deployment commands.
status
Show a comprehensive project status dashboard: task queue, blocked items, session state, verification, and git status.
work-beads
Use for /work-beads, a requested Beads backlog batch, or implementation of named bead IDs.
atlas-crew-tasks
Use when filing, updating, sequencing, or querying tasks in any atlas-crew repo (Facet + the Atlas Crew Security repos: Apparatus, Chimera, Crucible, Synapse, Bridge). These repos track work in GitHub Issues on Projects v2 boards, NOT backlog.md. Covers the two boards, the Type/Area/Status field model, cross-repo…