workflows

workflows is a skill for Claude Code, Codex from Smart-AI-Memory/attune-ai. It costs 7 tokens per session (519 once invoked), scanned A, original, Apache-2.0.

A set of analysis workflows for checking code security, likely bugs, performance, and general code quality.

In plain words
What is it for?
Running security audits, bug-prediction analysis, performance audits, or code reviews, and listing the available workflows.
Why use it?
It groups these reviews into repeatable commands so you can run the relevant analysis on a chosen project path.

Skill for Claude CodeCodex

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add skills/smart-ai-memory/attune-ai/workflows
Any agent
npx skills add Smart-AI-Memory/attune-ai --skill workflows
Clone the repo
git clone --depth 1 https://github.com/Smart-AI-Memory/attune-ai

Made for: Claude Code, Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for workflows

README.md
[![agentmods](https://agentmods.dev/badge/skills/smart-ai-memory/attune-ai/workflows.svg)](https://agentmods.dev/skills/smart-ai-memory/attune-ai/workflows)
Your own site
<a href="https://agentmods.dev/skills/smart-ai-memory/attune-ai/workflows"><img src="https://agentmods.dev/badge/skills/smart-ai-memory/attune-ai/workflows.svg" alt="Measured on agentmods" height="20"></a>
Per session 7 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 519 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00007 $0.00519
Opus 5 $0.00003 $0.00260
Sonnet 5 $0.00001 $0.00104
Haiku 4.5 $0.00001 $0.00052

Measured 5d ago against content hash b650f319b6aa, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

workflows scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.agents/skills/workflows/SKILL.md · 110 lines

How it starts

The opening of the file, as written. The whole thing — 110 lines — stays where its author put it; the contents beside it link to each section on GitHub.

workflows

AI-powered analysis workflows for security, bugs, and performance.

Routes

Subcommand Action
run security-audit Security vulnerability scan
run bug-predict Bug prediction analysis
run perf-audit Performance audit
run code-review Code review workflow

| list | List available workflows |

Usage

/workflows                       # Ask which workflow
/workflows run security-audit    # Security audit
/workflows run bug-predict       # Bug prediction
/workflows run perf-audit        # Performance audit
/workflows list                  # List all workflows

Fast-Path Detection

When the user provides a workflow name AND a path, skip AskUserQuestion and execute directly:

  • /workflows run security-audit ./src → execute
  • /workflows run bug-predict src/auth → execute
  • /workflows run security-audit → ask for path
  • /workflows → ask which workflow

Rule: If both workflow and target are provided, proceed to execution. If either is missing, use AskUserQuestion.

Behavior

run security-audit

If a path argument was provided (e.g., /workflows run security-audit ./src), skip AskUserQuestion and execute immediately.

Otherwise, use AskUserQuestion to scope:

  • Which path? src/, specific module, or full project?

Then run:

uv run attune workflow run security-audit --path <target>

run bug-predict

Use AskUserQuestion to scope:

  • Which path to scan?

Then run:

uv run attune workflow run bug-predict --path <target>

run perf-audit

Use AskUserQuestion to scope:

  • Which path to audit?

Then run:

uv run attune workflow run perf-audit --path <target>

run code-review

Use AskUserQuestion to scope:

  • Which path or files to review?
  • Focus area: quality, security, performance, or all?

Then run:

uv run attune workflow run code-review --path <target>

list

Run:

uv run attune workflow list

Read the full file on GitHub · 110 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 5d ago First seen · 110 lines · 7 tokens per session scan A b650f319b6aa

Subscribe to this mod's changes

workflows is a skill published in the GitHub repository Smart-AI-Memory/attune-ai (10 stars, last pushed yesterday), licensed Apache-2.0. It adds 7 tokens to every session and 519 once invoked, about $0.0000 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Related

Other skills, from other repositories

tmux

Manage long-running shell sessions with tmux — start a detached session, run a long task, reattach later, capture output. Use when a task takes longer than a single tool call (build, test, log tail).

Team-Commonly/commonly · 48 tokens

ship-and-babysit

End-to-end PR shipping workflow for tinyhumansai/openhuman: commit local changes, push to the user's fork, open or reuse a PR against main, then babysit CI and CodeRabbit feedback until the PR is green and clean. Use when the user asks to ship, open a PR, monitor CI, address review comments, or 'babysit' a branch.

tinyhumansai/openhuman · 83 tokens

lynkr

Universal LLM gateway with intelligent routing, Graphify code intelligence, Distill compression, routing telemetry, Code Mode, and 12+ provider support. 60-80% cost reduction for Claude Code, Cursor, and Codex.

Fast-Editor/Lynkr · 50 tokens

web-research

Use this skill for requests related to web research; it provides a structured approach to conducting comprehensive web research.

shibing624/agentica · 24 tokens

researchos-grow

Run one ResearchOS growth cycle: prime from L0/L1 → discover on user-trusted channels → capture → distill/corroborate by half-life → think → emit a lowest-burden user surface (act / hold / flip), audit behind. Use when the user wants to grow/deepen/research a topic.

lxinfei5/research-os · 71 tokens

officecli

Create, analyze, proofread, and modify Office documents (.docx, .xlsx, .pptx) using the officecli CLI tool. Use when the user wants to create, inspect, check formatting, find issues, add charts, or modify Office documents.

Team-Commonly/commonly · 56 tokens