cofin/flow-setup
skills/flow-setup/SKILL.md
Use when initializing Flow in a repo, configuring .agents, installing or checking Beads bd, setting local-only sync policy, or creating first project context files.
$ install --global
skillsauthnpx skillsauth add cofin/flow flow-setupInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Jun 7, 2026, 3:34 AM42.7s2 files scanned
SKILL.md
- name:
- flow-setup
- description:
- Use when initializing Flow in a repo, configuring .agents, installing or checking Beads bd, setting local-only sync policy, or creating first project context files.
Flow Setup
Use this lifecycle skill for project initialization, installation checks, setup validation, and first context files.
Beads mode: Skip every
bdinvocation when the SessionStart hook reportsBeads Backend: Missing (None)orDisabled via plugin config (useBeads=false). Treatspec.mdmarkers as fallback source of truth and skip/flow:sync. Never halt for missing Beads. See../flow/references/discipline.md.
Workflow
- Detect project root, existing
.agents/state, Beads availability, and repo-native commands. - If Beads is missing, offer official Beads (
bd) installation or no-Beads degraded mode. - Initialize Flow context files from templates and prefer local-only Beads settings.
- Store setup decisions in Beads notes when a backend exists.
- Re-run setup validation before handing off to planning.
Guardrails
- Prefer
.git/info/excludefor local-only ignores. - Do not edit
.gitignoreunless the user wants shared repository policy. - Do not run
bd dolt push, export, or auto-stage unless policy explicitly allows it. - Keep setup idempotent; preserve existing user context files and merge rather than overwrite.
Validation
- Confirm
.agents/root,workflow.md,patterns.md,knowledge/index.md, and Beads config existence when setup is expected. - Confirm Beads config defaults are local-only: no git ops, no auto export, and no auto git add.
- Run repository validation commands documented in
.agents/workflow.mdor hook context.
References Index
- Setup command details
- Validate command details
- Refresh command details
Example
User: "Use Flow to set up this repo."
Action: detect the repo root, initialize .agents/, configure local-only Beads, capture setup notes, validate files, then hand off to flow-planning for the first flow.
Related Skills
cofin/tracer
development
VerifiedTrustedCommunity
Use when tracing execution paths, mapping dependencies, understanding unfamiliar code, following data flow, investigating end-to-end behavior, debugging call chains, or deciding which files to read next.
12SKILL.mdUpdated Jun 7, 2026
cofin/security-auditor
development
VerifiedTrustedCommunity
Use when reviewing authentication, authorization, user input, secrets, API keys, database queries, file uploads, session management, external API calls, OWASP risks, or data handling attack surface.
12SKILL.mdUpdated Jun 7, 2026
cofin/perspectives
testing
VerifiedTrustedCommunity
Use when analyzing tradeoffs, comparing approaches, weighing options, assessing risks, stress-testing conclusions, identifying blind spots, or applying multiple viewpoints to a decision.
12SKILL.mdUpdated Jun 7, 2026
cofin/performance-analyst
development
VerifiedTrustedCommunity
Use when reviewing hot paths, slow code, database queries, N+1 risks, memory usage, loops, I/O, caching strategy, concurrency, latency-sensitive paths, or resource efficiency.
12SKILL.mdUpdated Jun 7, 2026