What is resync-vendored-skills?

A workflow for bringing changed skills from an upstream Git repository into a Workshop checkout. It uses a separate Git worktree, merges changes, refreshes tracking files, runs tests, and updates the main branch or opens a pull request.

Use it when resynchronising vendored skills, checking upstream changes, merging them safely, and verifying the result.

It reduces the risk of overwriting local changes or losing the record of which upstream version was imported.

How autonomous-ai/autonomous-workshop configures Claude Code

Reuse

Borrowing it

Nothing to install: this file belongs to autonomous-ai/autonomous-workshop. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.

Copy the file

curl -O https://raw.githubusercontent.com/autonomous-ai/autonomous-workshop/main/.claude/skills/resync-vendored-skills/SKILL.md

Clone the repo

git clone --depth 1 https://github.com/autonomous-ai/autonomous-workshop

Made for: Claude Code.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/autonomous-ai/autonomous-workshop/resync-vendored-skills/github.svg)](https://agentmods.dev/skills/autonomous-ai/autonomous-workshop/resync-vendored-skills)

Your own site

<a href="https://agentmods.dev/skills/autonomous-ai/autonomous-workshop/resync-vendored-skills"><img src="https://agentmods.dev/badge/skills/autonomous-ai/autonomous-workshop/resync-vendored-skills/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/skills/autonomous-ai/autonomous-workshop/resync-vendored-skills"><img src="https://agentmods.dev/badge/skills/autonomous-ai/autonomous-workshop/resync-vendored-skills.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 105 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 1,078 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00105	$0.01078
Opus 5.5	$0.00042	$0.00431
Sonnet 5.5	$0.00021	$0.00216
Haiku 4.5	$0.00011	$0.00108

Measured 22d ago against content hash e665ce80a206, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

resync-vendored-skills scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 22d ago.

The scan reads SKILL.md. This mod also ships 1 executable file (scripts/check.sh), listed below but not scanned — reading those needs a real analyzer, not pattern matching.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.claude/skills/resync-vendored-skills/SKILL.md · 86 lines

How it starts

The opening of the file, as written. The whole thing — 86 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Resync the vendored Make skills

Upstream autonomous-product-to-cad writes Wiki Rules and tool fixes every day, Workshop's own write-backs included (build-a-toy pushes them there). Runs only read them once this skill brings them into src/workshop/make/skills/. Run it from a Workshop checkout.

Upstream is read through GitHub only. Never read or write the owner's local checkout of autonomous-product-to-cad: sessions run there, and its hooks merge every commit into its main.

1. Check

.claude/skills/resync-vendored-skills/scripts/check.sh

up-to-date ... ends the skill: say so in one line. `changed

2. Worktree

Work in a fresh worktree from Workshop origin/main, never in the owner's checkout:

git fetch origin && git worktree add -b vendor-sync/<head8> <dir> origin/main

3. Merge each changed tree

Do it exactly as every earlier section of PROVENANCE.md did: a three-way merge per file, where the base is upstream at <locked>, one side is the Workshop tree and the other is upstream at <head>.

List what upstream changed with git -C <cache> log --oneline <locked>..<head> -- skills/<name> and git -C <cache> diff --stat.
Merge with git merge-file <workshop> <base> <upstream> per file. A new upstream file is copied in, and a file upstream deleted is deleted.
Only the skills LOCK.json attributes to autonomous-product-to-cad move. make-round and print-details are Workshop's own. Upstream's toy-archive, step-to-source and stl-to-step stay out.
Resolve a conflict so that both the Workshop adaptation and the upstream change survive. The usual Workshop adaptations are workshop skills path and $CAD_SKILL_ROOT script paths, the restricted-run cache rule, the consult-only wiki preamble and the ADR-driven gate rules. After the merge, read each file's residual diff against upstream <head>. It must be exactly the Workshop adaptation.
A page that cites upstream-only tooling or a bare skills/<name>/ path stays as written; the wiki preamble already explains both.

Read the full file on GitHub · 86 lines

Files

What ships with it

1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

scripts/check.sh 1.6 KB runs code

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

22d ago First seen · 86 lines · 105 tokens per session scan A e665ce80a206

Subscribe to this mod's changes

resync-vendored-skills is a skill published in the GitHub repository autonomous-ai/autonomous-workshop (24 stars, last pushed yesterday), licensed Apache-2.0. It adds 105 tokens to every session and 1,078 once invoked, about $0.0004 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-15.

3d-printing Git and workflow Python ai ai-agents generative-design toys

resync-vendored-skills next to 6 skills from other repositories
Mod	Type	Stars	Last push	Licence	Scan	Tokens	Works with
resync-vendored-skillsautonomous-ai/autonomous-workshop	Skill	24	yesterday	Apache-2.0	A	105	Claude Code
mem0-test-integrationmem0ai/mem0	Skill	68k	2d ago	Apache-2.0	A	207	Claude Code, Codex
create-releasecocoindex-io/cocoindex	Skill	12k	yesterday	Apache-2.0	A	155	Claude Code, Codex
cli-releaseComposioHQ/composio	Skill	31k	yesterday	MIT	A	95	Claude Code, Codex
config-loading-precedencexberg-io/xberg	Skill	9.5k	yesterday	MIT	A	18	Claude Code
python-releaseComposioHQ/composio	Skill	31k	yesterday	MIT	A	53	Claude Code, Codex
xberg-releasexberg-io/xberg	Skill	9.5k	yesterday	MIT	A	16	Claude Code, Codex

autonomous-workshop: Skill for Claude Code