Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/tandnguyendev/dev-workflow/initnpx skills add tandnguyendev/dev-workflow --skill initgit clone --depth 1 https://github.com/tandnguyendev/dev-workflowWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00067 | $0.02268 |
| Opus 5 | $0.00034 | $0.01134 |
| Sonnet 5 | $0.00013 | $0.00454 |
| Haiku 4.5 | $0.00007 | $0.00227 |
Grade A, and why
init scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 145 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Init — learn this project, draft conventions.md + project-map.md
Your job is to produce TWO files at the project root for /dev-workflow:feature
to rely on. They split by kind of knowledge, and the split is what keeps the
workflow affordable:
| File | Holds | Read by |
|---|---|---|
conventions.md |
the RULES — domain, stack, conventions, correctness rules, security focus | every subagent, in full, every phase — so it stays under ~50 lines |
project-map.md |
what EXISTS and WHERE — module map, existing features, shared building blocks, extension points, gotchas | lazily: the orchestrator when researching/planning, the coder for the modules it touches |
When you learn something, ask which it is: a rule to follow goes in
conventions.md, a location or a capability that already exists goes in
project-map.md. Never put the module table or the feature list in
conventions.md — it is re-read on every phase by every agent, and that is what
the lean budget is protecting.
Steps
- Inspect the project (read-only first):
- Detect the tech stack from manifests (
package.json,go.mod,pyproject.toml/requirements.txt,Cargo.toml,pom.xml,Gemfile, etc.), framework imports, and the directory layout. - Infer the DOMAIN from names, models/entities, routes, and any existing docs (README, docs/). Examples: fintech, healthcare, e-commerce, dev tooling.
- Note existing coding conventions and architecture/module boundaries. In
particular, detect the linter/formatter and record the EXACT command to run
them (e.g.
ruff check,npm run lint,gofmt -l,cargo fmt) plus the test command, and any naming/error-handling patterns the code already follows. These are what the coder runs and the reviewer enforces. - Detect the testing setup, including what is installed but unused. The
runner and its exact command; how existing tests build a subject (a testing
module, a factory, positional constructor calls); and — the part that gets
missed — whether a harness for proving store/external behaviour FOR REAL is
already a dependency (an in-memory server such as
mongodb-memory-server, Testcontainers, a fixture DB, a fake HTTP server). Grep the manifest, not just the test files: these are routinely installed and then used in one file out of fifty, and an agent that cannot see the harness mocks the database instead and writes a test that cannot fail. Record it by name inconventions.mdeven when nothing currently uses it. If there is none, say that too — "no real-store harness; add one before claiming store behaviour in a test" is a useful line. - Survey what the project already DOES, not just how it is written — this is the part agents are missing today, and it is why they propose rebuilding something that exists. Enumerate the capabilities from the surfaces that declare them: routes/endpoints, CLI commands, event/queue handlers, scheduled jobs, exported modules, UI screens, public API. For each, note what it does and the file that owns it. Then find the SHARED building blocks a new feature is expected to reuse (base classes, middleware, validators, error types, HTTP/DB clients, auth helpers, config access, test fixtures) and the EXTENSION POINTS ("to add a route, touch X"; "migrations live in Y").
- If a
CLAUDE.mdalready exists, read it and reuse its content — do not duplicate or overwrite it; complement it.
- Detect the tech stack from manifests (
- Draft
conventions.mdusing the section structure from the plugin template (Domain / Tech stack / Architecture / Coding conventions / Testing / Testing contract / Simplicity contract / Domain-specific correctness rules / Security focus / Workflow files). Fill each section from what you observed; mark anything uncertain as an assumption. Copy the Simplicity contract and Testing contract sections verbatim from the template in BOTH paths (observed project conventions and greenfield default) — they are standing constraints, not fallback baselines. Never rephrase, soften, or drop them. - Draft
project-map.mdusing the plugin template's sections (Module map / Existing features / Shared building blocks / Extension points / Known gotchas / Glossary). Fill it from the survey in step 1.- Entries are POINTERS: path, what it owns, entry point. Do not restate what the code says or paste signatures — one to three lines per entry.
- Only write what you actually verified by reading the code. An invented or guessed entry is worse than a missing one, because agents trust this file and will build against it. Mark anything inferred as an assumption for the user to confirm.
- For
Existing features, leave theShippedcolumn blank for pre-existing work you can't date — the feature workflow fills it for features it ships. - If the project is small enough that the map would just re-list five files, say so and keep it to the Module map + Extension points; don't pad it.
- CHECKPOINT: show BOTH drafts to the user and ask them to confirm or correct them before writing. Call out your assumptions explicitly — the map is the thing later agents will treat as fact. Only write the files after they approve.
- Make both files visible to ordinary chat, not just this plugin. The plugin's own
skills and subagents Read them directly, but a plain Claude Code session only
auto-loads
CLAUDE.mdand the files it@-imports — so without a line inCLAUDE.md, everything you wrote is invisible outside/dev-workflow:*. The two files get DIFFERENT treatment, and the difference is deliberate:
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 145 lines · 67 tokens per session scan A c123722f3e94
init is a skill published in the GitHub repository tandnguyendev/dev-workflow (2 stars, last pushed 7d ago), licensed MIT. It adds 67 tokens to every session and 2,268 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
systematic-debugging
Use when encountering any bug, test failure, or unexpected behavior, before proposing fixes.
brainstorming
You MUST use this before any creative work - creating features, building components, adding functionality, or modifying behavior. Explores user intent, requirements and design before implementation.
chat-pet-sprite-creation
Use when creating or changing VS Code chat pet sprite art, sprite sheets, state animations, eye treatments, Stable/Insiders variants, or pet transitions under src/vs/workbench/contrib/chat/browser/widget/media/chatPet.
cpu-profile-analysis
Analyze V8/Chrome CPU profiles (.cpuprofile) and DevTools trace files (Trace-.json). Use when: profiling performance, investigating slow functions, comparing code paths, finding bottlenecks, analyzing timeToRequest, understanding call trees from sampling profiler data, analyzing layout/paint/rendering, investigating…
babysit-pr
Babysit a GitHub pull request after creation by continuously polling review comments, CI checks/workflow runs, and mergeability state until the PR is merged/closed or user help is required. Diagnose failures, retry likely flaky failures up to 3 times, auto-fix/push branch-related issues when appropriate, and keep…
imagegen
Generate or edit raster images when the task benefits from AI-created bitmap visuals such as photos, illustrations, textures, sprites, mockups, or transparent-background cutouts. Use when Codex should create a brand-new image, transform an existing image, or derive visual variants from references, and the output…