Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add plearaj/code-flow-skill --skill code-flow-violationsgit clone --depth 1 https://github.com/plearaj/code-flow-skillWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/plearaj/code-flow-skill/code-flow-violations)<a href="https://agentmods.dev/skills/plearaj/code-flow-skill/code-flow-violations"><img src="https://agentmods.dev/badge/skills/plearaj/code-flow-skill/code-flow-violations/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/plearaj/code-flow-skill/code-flow-violations"><img src="https://agentmods.dev/badge/skills/plearaj/code-flow-skill/code-flow-violations.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00062 | $0.03899 |
| Opus 5.5 | $0.00025 | $0.01560 |
| Sonnet 5.5 | $0.00012 | $0.00780 |
| Haiku 4.5 | $0.00006 | $0.00390 |
Grade A, and why
code-flow-violations scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 302 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Code Flow — Violations
Check the map this project has already written under Code_Flows/ for violations of
a rule you name: something this codebase is supposed to do that is not one of
the five principles code-flow-quality already checks. You say what the rule is;
this reports every place the code contradicts it, quotes your rule beside the
evidence, and says plainly where it could not tell.
code-flow-quality --rules checks written-down rules as one detector among
thirteen, as part of a sweep. This command exists for the other case: one
violation, or a few, that you want answered properly right now. So it reads
source by default rather than reporting your rule unanswerable, it gives every
rule a row whether it was violated, clean or unsettled, and it never reports a
rule as clean that it could not actually enumerate.
This skill never edits source code. It writes documents and stops.
User Input
The user's request names the violations to check -- inline rules in quotes, paths
to rule documents, or auto -- and carries the optional --no-read-code and
--severity flags. Step 1 reads them.
Instructions
Follow these steps exactly.
1. Read the Arguments
The request names the violations to check, and carries two optional flags.
A violation is one of three things, and several may be given, separated by spaces or commas:
- A rule written inline, in quotes —
"Validation belongs in src/auth/ and nowhere else". This is the ordinary case: a thing this codebase is supposed to do that nobody has written down anywhere a tool can read. - A path to a document — every rule in it is loaded, the way
--rulesloads one. auto— look for these, in this order, and use every one that exists:CLAUDE.md,.claude/CLAUDE.md,AGENTS.md,GEMINI.md,.github/copilot-instructions.md,.specify/memory/constitution.md,memory/constitution.md,CONVENTIONS.md,.code-flow/rules.md.
If the request names no violation, stop and say what the command needs. Do not
fall back to auto, and do not pick a rule you think the project would want
checked. "Check the violation I care about" with no violation named is a request
that has not finished being made, and guessing at it produces a report about
something nobody asked for.
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 302 lines · 62 tokens per session scan A 98c4626945f6
code-flow-violations is a skill published in the GitHub repository plearaj/code-flow-skill (2 stars, last pushed 22d ago), licensed Apache-2.0. It adds 62 tokens to every session and 3,899 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-05.
Other skills, from other repositories
autofix
Review and repair current local changes until they converge, or run Qwen Code Autofix issue and review workflows from GitHub Actions.
smell
Detect software architecture bad smells, algorithmic complexity hotspots, and anti-patterns in a codebase. Produces a detailed markdown report identifying violations of architectural principles, design patterns, code quality, and performance complexity. Triggers on: smell, code smell, architecture smell, find…
correctness-reviewer
Always-on code-review persona. Reviews code for logic errors, edge cases, state management bugs, error propagation failures, and intent-vs-implementation mismatches. Spawned by the ce:review-beta skill as part of a reviewer ensemble.
performance-reviewer
Conditional code-review persona, selected when the diff touches database queries, loop-heavy data transforms, caching layers, or I/O-intensive paths. Reviews code for runtime performance and scalability issues. Spawned by the ce:review-beta skill as part of a reviewer ensemble.
reliability-reviewer
Conditional code-review persona, selected when the diff touches error handling, retries, circuit breakers, timeouts, health checks, background jobs, or async handlers. Reviews code for production reliability and failure modes. Spawned by the ce:review-beta skill as part of a reviewer ensemble.
flutter-squadron-concurrency-engineering
Design, implement, review, debug, test, migrate, and optimize production Flutter/Dart concurrency built with Squadron. Use this skill whenever work involves CPU-heavy processing, Dart isolates, Web Workers, Squadron workers or worker pools, squadronbuilder code generation, marshaling custom DTOs, cancellation, worker…