Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add QuintinShaw/pi-dynamic-workflows --skill workflow-authoringgit clone --depth 1 https://github.com/QuintinShaw/pi-dynamic-workflowsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/quintinshaw/pi-dynamic-workflows/workflow-authoring)<a href="https://agentmods.dev/skills/quintinshaw/pi-dynamic-workflows/workflow-authoring"><img src="https://agentmods.dev/badge/skills/quintinshaw/pi-dynamic-workflows/workflow-authoring.svg" alt="Measured on agentmods" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00043 | $0.00583 |
| Opus 5 | $0.00022 | $0.00292 |
| Sonnet 5 | $0.00009 | $0.00117 |
| Haiku 4.5 | $0.00004 | $0.00058 |
Grade A, and why
workflow-authoring scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 31 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Workflow authoring
Load this skill when workflow JavaScript changes. Running an existing workflow needs no authoring reference.
Choose a branch
Read only what the task needs:
- Write or edit: start with runtime. Add pattern selection for topology, lifecycle for limits or resume, and focused recipes for the matching concern.
- Helper task: read quality helpers only for
verifyorjudgePanel, the retry helper only forretry, and specialized helpers only forcompletenessCheck,loopUntilDry,gate, orcheckpoint. - Review: use the review checklist, plus only the matching quality or specialized helper contracts.
- Debug: use the debugging map.
- Routing: read registry ownership before using
model,tier, phase models, oragentType; use environment-specific names only when context supplies them. - Exact lookup or portability: start with the generated capability index. Follow its exhaustive-facts pointer only for constraints or support boundaries. Use versions when moving scripts between installations.
Invariants
- Start with literal
export const meta = { name, description }; declare phases as an array of used{ title }objects and enter each named phase. - Call
agent()at least once, give every call a short uniquelabel, and return plain JSON data explicitly. - Pair ordered results with stable work IDs before filtering. When one agent consumes another's selected result, include both its stable ID and actual data in the downstream prompt. Treat recoverable
nullas missing coverage and report it. - Bound fan-out, loops, retries, agents, and concurrency to the task. Treat invocation-level token and time caps as opt-in user constraints, not defaults.
- Use
log()for new code;consoleis compatibility-only. - Write plain JavaScript without imports or filesystem modules. Pass nondeterminism through
args;Date.now(),Math.random(), and no-argumentnew Date()are unavailable.
What ships with it
27 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- examples/adversarial-verification.js 2.2 KB runs code
- examples/bounded-semantic-retry.js 1.9 KB runs code
- examples/classify-and-act.js 2.4 KB runs code
- examples/defensive-json-parsing.js 2.6 KB runs code
- examples/fan-out-and-synthesize.js 1.7 KB runs code
- examples/generate-and-filter.js 2.5 KB runs code
- examples/loop-until-done.js 2.0 KB runs code
- examples/phased-budgets.js 2.6 KB runs code
- examples/saved-nested-workflows.js 1.9 KB runs code
- examples/structured-output.js 1.3 KB runs code
- examples/tournament.js 2.9 KB runs code
- examples/validated-gate.js 2.0 KB runs code
- references/capabilities.md 5.0 KB
- references/capability-details.md 17 KB
- references/common-helpers.md 160 B
- references/debugging.md 2.9 KB
- references/focused-recipes.md 1.7 KB
- references/helpers.md 577 B
- references/lifecycle.md 5.4 KB
- references/pattern-selection.md 1.8 KB
- references/quality-helpers.md 2.1 KB
- references/registry-ownership.md 1.8 KB
- references/retry-helper.md 614 B
- references/review.md 2.3 KB
- references/runtime.md 3.9 KB
- references/specialized-helpers.md 1.8 KB
- references/versions.md 1.1 KB
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago Changed da49f4c2e4ce
- 8d ago First seen · 31 lines · 43 tokens per session scan A 26d0eb7480de
workflow-authoring is a skill published in the GitHub repository QuintinShaw/pi-dynamic-workflows (493 stars, last pushed 4d ago), licensed MIT. It adds 43 tokens to every session and 583 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
mcp-scripting
Write mcpScript JavaScript for discovering, inspecting, and calling MCP tools.
tmux-manual-qa
Run a single manual tmux-based QA scenario for the todo continuation feature against the real CLI (./pi-test.sh) in an interactive TUI. Captures scrollback, asserts deterministic pass/fail count markers, and cleans up test fixtures. Use only for the manual-qa milestone features.
gpt-image-gen
MUST read before generating images. Detailed prompt-crafting guide for gpt-image models, covering tool routing (native imagegeneration server tool vs the generateimage tool), prompt structure from subject to background, verbatim text rendering, anti-patterns, and the revisedprompt feedback loop for iteration.
openclaw-github-dedupe
Investigate a cluster of GitHub issues and PRs, determine canonical candidates, post duplicate/related status, preserve contributor credit, and execute cleanup actions. Supports autonomous mode for provided-link-only closeout, merge/fix follow-through, changelog, and post-merge issue/PR cleanup.
tmux-lane-orchestrator
Manage one tmux agent lane from its matching ops pane, inspect live pane state and Codex logs on cold start, and produce concise manager summaries for OpenClaw and adjacent project work.
pi-package-sandbox-test
Use when verifying that published Pi packages install and load for normal users, including pi.dev package compatibility checks, release validation, Daytona sandbox tests, and package installability audits.