agentmods.dev

zuora-workflow-build

zuora-workflow-build is a skill for Claude Code, Codex from zuora/zuora-coding-agent. It costs 19 tokens per session (14,002 once invoked), scanned B, original, MIT.

A tool that turns a workflow design or requirement into a complete JSON file that Zuora Workflow can import. Zuora Workflow is a system for automating billing and subscription-related business processes.

In plain words
What is it for?
Use it to create an importable Zuora Workflow JSON artifact from a workflow design or written requirement.
Why use it?
It reduces import failures by building from standard structures, checking the JSON format, and reviewing the workflow before delivery. The result is a complete workflow file rather than a partial outline.

Skill for Claude CodeCodex

Installs and runs on its own, but its text points at files inside its plugin — anything it tells you to read at a ${CLAUDE_PLUGIN_ROOT} path is only there once the plugin is installed. Installing the plugin gets both.

Part of the zuora-coding-agent plugin — 40 skills, 10 commands shipped together

not rated 2 changed yesterday B scan 19 tokens original MIT
View the source file zuora/zuora-coding-agent
Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add skills/zuora/zuora-coding-agent/zuora-workflow-build
Any agent
npx skills add zuora/zuora-coding-agent --skill zuora-workflow-build
Clone the repo
git clone --depth 1 https://github.com/zuora/zuora-coding-agent

Made for: Claude Code, Codex.

Or install zuora-coding-agent, the plugin that ships this one along with the rest of its 40 skills, 10 commands.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for zuora-workflow-build

README.md
[![agentmods](https://agentmods.dev/badge/skills/zuora/zuora-coding-agent/zuora-workflow-build.svg)](https://agentmods.dev/skills/zuora/zuora-coding-agent/zuora-workflow-build)
Your own site
<a href="https://agentmods.dev/skills/zuora/zuora-coding-agent/zuora-workflow-build"><img src="https://agentmods.dev/badge/skills/zuora/zuora-coding-agent/zuora-workflow-build.svg" alt="Measured on agentmods" height="20"></a>
Per session 19 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 14,002 The whole file, excluding the scripts and references it only reads on demand.
Security scan B 2 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00019 $0.14002
Opus 5 $0.00010 $0.07001
Sonnet 5 $0.00004 $0.02800
Haiku 4.5 $0.00002 $0.01400

Measured yesterday against content hash 12a4fa5e013c, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade B, and why

zuora-workflow-build scanned grade B with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Reads agent configuration directoriesmediumAgent snooping

.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.

Claude Code injects the Zuora credentials from `~/.claude/settings.json -> env` into every `Bash` invocation (keys: `ZUORA_BASE_URL`, `ZUORA_CLIENT_ID`, `ZUORA_CLIENT_SECRET`). That means the **direct HTTP path with `cur

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

Claude Code injects the Zuora credentials from `~/.claude/settings.json -> env` into every `Bash` invocation (keys: `ZUORA_BASE_URL`, `ZUORA_CLIENT_ID`, `ZUORA_CLIENT_SECRET`). That means the **direct HTTP path with `cur
skills/zuora-workflow-build/SKILL.md · 503 lines

How it starts

The opening of the file, as written. The whole thing — 503 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Codex-only path resolution: When an instruction refers to ${CLAUDE_PLUGIN_ROOT}, treat it as the root of this installed plugin. In Codex, resolve that root as the ancestor directory containing skills/, references/, and .codex-plugin/.

You are building an importable Zuora Workflow JSON from a design (produced by /zuora-workflow-design or provided directly).

Input

The user's workflow design or requirement: $ARGUMENTS

Correctness strategy

Format correctness is non-negotiable. A slightly malformed JSON fails import_workflow. Defense is layered:

  1. Compose from a canonical skeleton + per-action_type templates. Never hand-write structure.
  2. Lint with scripts/lint-workflow-json.js — the client-side enforcement layer, since Task.import runs with validate: false and skips each task's task_setup_validation.
  3. Self-check against the checklist below before writing the file.
  4. Optional dry-run in a sandbox: import_workflow activate=false, then delete_workflow to clean up. Rails has no validate_only flag.

Output contract

The deliverable is a complete, importable Workflow JSON artifact, not a partial transcript:

  • Always write the full workflow JSON to a .workflow.json file before finalizing. The file must contain exactly the four import envelope keys: workflow_definition, workflow, tasks, and linkages.
  • Run the linter against the exact file you will hand to the user. If the workflow cannot be linted or dry-run because prerequisites are missing (credentials, tenant access, unresolved fields, unsupported objects, missing user inputs), do not emit hopeful or partial JSON; explain the missing prerequisite and keep the artifact clearly marked as not ready for import.
  • In Codex, do not paste a shortened JSON block, excerpt, ellipsis, or "rest omitted" version as the workflow deliverable. If the JSON is too large for the final response, point to the saved .workflow.json path and summarize validation status.
  • If you include JSON in the final response at all, it must be the same complete linted object from the artifact. Otherwise, provide the file path plus the validation commands/results.

Read the full file on GitHub · 503 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. yesterday Changed · +2 lines 12a4fa5e013c
  2. 4d ago First seen · 501 lines · 19 tokens per session scan B 616414c2c4ce

Subscribe to this mod's changes

zuora-workflow-build is a skill published in the GitHub repository zuora/zuora-coding-agent (2 stars, last pushed 4d ago), licensed MIT. It adds 19 tokens to every session and 14,002 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it B with 2 findings (reads agent configuration directories, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Productivity
Related

Other skills, from other repositories

systematic-debugging

Use when encountering any bug, test failure, or unexpected behavior, before proposing fixes.

obra/superpowers · 21 tokens

brainstorming

You MUST use this before any creative work - creating features, building components, adding functionality, or modifying behavior. Explores user intent, requirements and design before implementation.

obra/superpowers · 37 tokens

auto-perf-optimize

Run agent-driven VS Code performance or memory investigations. Use when asked to launch Code OSS, automate a VS Code scenario, run the Chat memory smoke runner, capture renderer heap snapshots, take workflow screenshots, compare run summaries, or drive a repeatable scenario before heap-snapshot analysis.

microsoft/vscode · 62 tokens

chat-perf

Run chat perf benchmarks and memory leak checks against the local dev build or any published VS Code version. Use when investigating chat rendering regressions, validating perf-sensitive changes to chat UI, or checking for memory leaks in the chat response pipeline.

microsoft/vscode · 51 tokens

chat-pet-sprite-creation

Use when creating or changing VS Code chat pet sprite art, sprite sheets, state animations, eye treatments, Stable/Insiders variants, or pet transitions under src/vs/workbench/contrib/chat/browser/widget/media/chatPet.

microsoft/vscode · 53 tokens

cpu-profile-analysis

Analyze V8/Chrome CPU profiles (.cpuprofile) and DevTools trace files (Trace-.json). Use when: profiling performance, investigating slow functions, comparing code paths, finding bottlenecks, analyzing timeToRequest, understanding call trees from sampling profiler data, analyzing layout/paint/rendering, investigating…

microsoft/vscode · 71 tokens