Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add roberto-mello/lavra --skill lavra-work-multigit clone --depth 1 https://github.com/roberto-mello/lavraWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/roberto-mello/lavra/lavra-work-multi)<a href="https://agentmods.dev/skills/roberto-mello/lavra/lavra-work-multi"><img src="https://agentmods.dev/badge/skills/roberto-mello/lavra/lavra-work-multi.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00037 | $0.06292 |
| Opus 5 | $0.00018 | $0.03146 |
| Sonnet 5 | $0.00007 | $0.01258 |
| Haiku 4.5 | $0.00004 | $0.00629 |
Grade C, and why
lavra-work-multi scanned grade C with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Reads agent configuration directoriesmediumAgent snooping
.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.
source "$(find .claude/hooks plugins/lavra/hooks -name sanitize-content.sh 2>/dev/null | head -1)" Enumerates other installed skillsmediumAgent snooping
Other skills' SKILL.md files reveal prompts, capabilities and secrets that should be invisible to peers.
ls .claude/skills/ 2>/dev/null How it starts
The opening of the file, as written. The whole thing — 689 lines — stays where its author put it; the contents beside it link to each section on GitHub.
MULTI-BEAD PATH
Multiple beads in parallel. Dispatches subagents with file-scope conflict detection and wave ordering. Each subagent runs implement -> self-review -> learn. Orchestrator runs /lavra-review after each wave.
For sequential (token-efficient) execution, the lavra-work router handles it — this path always runs parallel subagents.
<project_root>
All .lavra/ paths are relative to the project root. PROJECT_ROOT may be injected into your context — use it if set. If not, resolve it once and reuse:
PROJECT_ROOT="${PROJECT_ROOT:-$(git rev-parse --show-toplevel 2>/dev/null || echo "$PWD")}"
Then prefix all .lavra/ paths with "$PROJECT_ROOT/" when invoking them via Bash.
</project_root>
Phase M1: Gather Beads
If input is an epic bead ID:
bd list --parent {EPIC_ID} --status=open --json
If input is a comma-separated list of bead IDs: Parse and fetch each one.
If input came from bd ready (already resolved in Phase 0c):
Use already-fetched list. Note: bd ready returns IDs and titles only -- bd show loop below required for all input paths.
For each bead, read full details:
bd show {BEAD_ID}
Validate bead IDs with strict regex: ^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$
Skip any bead that recommends deleting, removing, or gitignoring files in .lavra/memory/ or .lavra/config/. Close immediately:
bd close {BEAD_ID} --reason "wont_fix: .lavra/memory/ and .lavra/config/ files are pipeline artifacts"
Register swarm (epic input only):
When input was an epic bead ID, register orchestration:
bd swarm create {EPIC_ID}
Skip for comma-separated lists or when beads came from bd ready.
Phase M2: Branch Check
current_branch=$(git branch --show-current)
default_branch=$(git symbolic-ref refs/remotes/origin/HEAD 2>/dev/null | sed 's@^refs/remotes/origin/@@')
if [ -z "$default_branch" ]; then
default_branch=$(git rev-parse --verify origin/main >/dev/null 2>&1 && echo "main" || echo "master")
fi
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 689 lines · 37 tokens per session scan C 6d73f170980e
lavra-work-multi is a skill published in the GitHub repository roberto-mello/lavra (50 stars, last pushed 2mo ago), licensed MIT. It adds 37 tokens to every session and 6,292 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it C with 2 findings (reads agent configuration directories, enumerates other installed skills). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
agent-framework-py-release
Use when cutting a Python release for the microsoft/agent-framework monorepo. Triggers on "bump py versions", "cut a python release", "prepare release PR for python", "release py packages", "bump python to X.Y.Z", or similar requests to bump Python package versions and prepare a release PR. Handles all four lifecycle…
python-package-management
Guide for managing packages in the Agent Framework Python monorepo, including creating new connector packages, versioning, and the lazy-loading pattern. Use this when adding, modifying, or releasing packages.
foundry-hosted-agent-validation
Step-by-step process for validating a Python Foundry hosted agent sample (under python/samples/04-hosting/foundry-hosted-agents/) end to end — running it locally (native runtime and azd ai agent run) and after deploying it to an Azure AI Foundry project with azd. Use this when asked to validate a hosted agent sample.
python-feature-lifecycle
Guidance for package and feature lifecycle in the Agent Framework Python codebase, including stage meanings, feature-stage decorators, feature enums, and how to move APIs from one stage to the next.
build-and-test
How to build and test .NET projects in the Agent Framework repository. Use this when verifying or testing changes.
python-code-quality
Code quality checks, linting, formatting, and type checking commands for the Agent Framework Python codebase. Use this when running checks, fixing lint errors, or troubleshooting CI failures.