Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/0x0w1/jig/github-syncnpx skills add 0x0w1/jig --skill github-syncgit clone --depth 1 https://github.com/0x0w1/jigWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00048 | $0.01990 |
| Opus 5 | $0.00024 | $0.00995 |
| Sonnet 5 | $0.00010 | $0.00398 |
| Haiku 4.5 | $0.00005 | $0.00199 |
Grade A, and why
github-sync scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
This is a copy
100% identical to jig-github-sync — 2 lines differ, which has more behind it and is treated as the original. This page carries a canonical link to it rather than competing with it.
How it starts
The opening of the file, as written. The whole thing — 123 lines — stays where its author put it; the contents beside it link to each section on GitHub.
GitHub Sync
Use this repository skill only for setup and synchronization of GitHub repository settings.
Scope
- Branches:
main,develop. - Branch protection for
mainanddevelop: optional, and only when the repository can have it. Direct pushes allowed, force pushes and deletion blocked. See Branch Protection Is Optional. - Local guard: a git
pre-pushhook installed fromassets/pre-pushbyscripts/manage-pre-push.sh. It blocks force pushes to and deletion ofmain/developand restricts directmainpushes to the release fast-forward (develop:main). Local defense only; server-side protection stays the final barrier. - No release-drafter files, no pull request template, no label sync; the release flow is CLI-driven (
github-release) and does not use pull requests. - Sync is convergent and idempotent: one run aligns the repository with the current model even when several jig versions were skipped.
jig-updateruns it after updating installed files.
Branch Protection Is Optional
GitHub gives branch protection to public repositories on every plan, but a private repository needs a paid plan (Pro, Team, or Enterprise). On a private repository on the free plan the API answers 403, and so does the rulesets API. That is the normal state for most personal projects, not a defect.
So protection is never applied silently. Probe first, ask second, and treat "not available" as a pass.
Probe (read-only, before touching anything):
gh api repos/<owner>/<repo> --jq '{private: .private, admin: .permissions.admin}'
| Probe result | Meaning | What to do |
|---|---|---|
admin: false |
The profile cannot change settings on this repository | Skip. Report it as a permission limit, not a failure |
private: false |
Public repository — protection is available on every plan | Ask |
private: true, protection API answers 403 |
Private repository without a plan that includes protection | Skip. Say so in one line and move on |
private: true, protection API answers 200 or 404 |
Paid plan — protection is available | Ask |
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 123 lines · 48 tokens per session scan A dffa1be562f5
github-sync is a skill published in the GitHub repository 0x0w1/jig (5 stars, last pushed 2d ago), licensed MIT. It adds 48 tokens to every session and 1,990 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. It is 100% identical to jig-github-sync, differing in 2 lines, and is treated as a copy.
Other skills, from other repositories
git-ship
自动化 Git 工作流一键发布助手，执行完整的「ship」流程： 基于最新 main 切新分支 → commit → 推送 → 创建 PR → squash merge → 回 main。 调用 ship 本身就是对完整流程的授权；自动推断分支名、commit message 和 PR 内容， 并主动解决 Git 冲突、测试、lint、类型检查、构建和 CI 失败，持续修复和重试， 直到改动成功合并。不要因可自行修复的失败暂停，只在认证、权限、仓库保护等 无法由当前环境解决的外部阻塞出现时请求用户介入。 仅在用户明确表达「ship」意图时触发，例如： 直接说「ship」「/ship」「git ship」 明确要求完整走完 git…
wu5-dev-flow
使用可审计的 SDD、严格 RED-GREEN-REFACTOR TDD 与安全 Git 门禁初始化、开发、修复、重构和交付 Python 项目。用于任何会修改项目源码、测试、规格、依赖或 Git 历史的任务，也用于继续跨 Session 的现有 spec/ 变更、审查代码、验证完成状态、创建提交或准备 GitHub PR。.
ascii-diagram-creator-skill
Create ASCII diagrams from workflow definitions and save them as image files (PNG, SVG, etc.).
watchfire
Operate Watchfire — the local orchestrator that runs coding agents (Claude Code, Codex, Gemini, opencode, Copilot) on tasks in sandboxed git worktrees and merges the results. Use when asked to run/queue/inspect Watchfire tasks or agents, drive the factory loop (create → run → wait → review), check why an agent is…
systematic-debugging
Use when encountering any bug, test failure, or unexpected behavior, before proposing fixes.
next-cache-components-adoption
Turn on Cache Components in a Next.js app and resolve the blocking routes it surfaces. Use when the user wants to enable, adopt, or migrate to Cache Components, flip the cacheComponents flag, work through a flood of blocking-prerender / instant validation errors, run the cache-components-instant-false codemod, or…