Getting it into your agent
There is no command for this one: it runs only inside a plugin, and the catalogue could not identify which plugin ships it. The source is linked below.
Wrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/vyuh-labs/dxkit/dxkit-flow)<a href="https://agentmods.dev/skills/vyuh-labs/dxkit/dxkit-flow"><img src="https://agentmods.dev/badge/skills/vyuh-labs/dxkit/dxkit-flow.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00112 | $0.03922 |
| Opus 5 | $0.00056 | $0.01961 |
| Sonnet 5 | $0.00022 | $0.00784 |
| Haiku 4.5 | $0.00011 | $0.00392 |
Grade A, and why
dxkit-flow scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 156 lines — stays where its author put it; the contents beside it link to each section on GitHub.
dxkit-flow
This skill owns the UI→API integration gate: dxkit statically reconstructs which client calls (METHOD url) bind to which server routes, and fails a PR that net-new breaks one — a frontend call to an endpoint no backend serves, or a removed route a consumer still calls.
It is thin orchestration over the deterministic CLI. It never re-implements extraction: it runs init / doctor / guardrail check / flow publish, reads their structured output, and supplies judgment + code edits. The determinism stays in the CLI; the agent supplies the reasoning.
Language coverage. Source extraction is per language pack: TypeScript/JavaScript (fetch/axios/wrappers; Express/LoopBack/NestJS/Next.js routes), Python (requests/httpx; FastAPI/Flask/Django routes — a Django path() route is method-agnostic and matches any verb; re_path() regex routes are out of scope), Go (http.Get/Post + http.NewRequest + client wrappers; stdlib HandleFunc/Handle incl. Go 1.22 "GET /x" patterns, chi/echo/gin/fiber verb methods on conventional receiver names — an unusually-named router falls back to flow.specs), Java (Spring MVC/WebFlux annotations with class-level @RequestMapping prefixes, JAX-RS @GET+@Path pairs; RestTemplate verbs, WebClient/java.net.http/OkHttp builder chains, Retrofit interfaces — exchange(...)'s enum verb is counted as a dynamic call, not extracted), Kotlin (the Ktor routing DSL incl. nested route(...) prefixes and Spring annotations; the Ktor client, Retrofit, builder chains — client.request { method = … } is deliberately not extracted), C# (ASP.NET attribute routing with the [controller] token substituted from the enclosing class, minimal APIs app.MapGet(...); HttpClient verb methods with interpolated $"…" URLs — MapGroup chains and HttpRequestMessage enum verbs are out of scope), Ruby (Rails routes.rb — explicit verbs qualify only in a routing context, so request-spec get '/x' calls never mint routes; resources/resource expand the RESTful set with only:/except:; nested resource blocks are skipped rather than mis-pathed; Sinatra verb+block; Net::HTTP/HTTParty/Faraday clients with #{…} interpolation), and Rust (actix-web/Rocket route attributes; axum .route(...) as method-agnostic ANY routes with .nest(...) argument-side prefixes — Rocket mount prefixes are opaque; reqwest clients, format! URLs count as dynamic). Any language also participates on the served side without pack coverage: point flow.specs at an OpenAPI document, or have the service publish its served.json as a workspace participant.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 6d ago First seen · 156 lines · 112 tokens per session scan A 8a2e448ccb36
dxkit-flow is a skill published in the GitHub repository vyuh-labs/dxkit (10 stars, last pushed 8d ago), licensed MIT. It adds 112 tokens to every session and 3,922 once invoked, about $0.0006 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
project-fix
Use when fixing bugs, review findings, regressions, failed tests, merge issues, contract drift, or behavior defects.
test-driven-development
Use when implementing any feature or bugfix, before writing implementation code.
systematic-debugging
Use when encountering any bug, test failure, or unexpected behavior, before proposing fixes.
debug-false-positive
Diagnose and fix a Fallow false positive or false negative through extraction, resolution, graph, analysis, reporting, and real-consumer verification.
triage-issue
Triage a GitHub issue against the current fallow codebase and determine validity, priority, scope, and likely implementation shape. Use when the user asks to triage an issue, assess a bug report, or evaluate an enhancement request.
lsp-review
Review fallow's LSP server behavior, diagnostics, code actions, code lens, and protocol-facing UX. Use when changes touch crates/lsp or LSP-visible behavior.