b3os-github-workflow

b3os-github-workflow is a skill for Claude Code, Codex from b3rys/b3rys-team-os. It costs 169 tokens per session (7,491 once invoked), scanned C, original, Apache-2.0.

A GitHub workflow for taking code changes from an isolated branch through a pull request, review, approval, merge, and post-merge check. A pull request is a proposal to merge changes into a shared repository.

In plain words
What is it for?
Use it for branch and worktree setup, commit and pull-request writing, tiered approvals, merge checks, and changes to b3os infrastructure when combined with its safety rules.
Why use it?
It reduces accidental changes to shared files and makes the reason for each change and its verification visible to reviewers. It also keeps personal discussion and unsupported claims out of repository records.

Skill for Claude CodeCodex

Written for no agent in particular: nothing here depends on one. Also seen: mentions Codex.

Good fit Use it for branch and worktree setup, commit and pull-request writing, tiered approvals, merge checks, and changes to b3os infrastructure when combined with its safety rules.

Compare 6 skills from other repositories ↓
Install with agentmods
npx agentmods add skills/b3rys/b3rys-team-os/b3os-github-workflow
Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent
npx skills add b3rys/b3rys-team-os --skill b3os-github-workflow
Clone the repo
git clone --depth 1 https://github.com/b3rys/b3rys-team-os

Made for: Claude Code, Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for b3os-github-workflow

README.md
[![agentmods](https://agentmods.dev/badge/skills/b3rys/b3rys-team-os/b3os-github-workflow/github.svg)](https://agentmods.dev/skills/b3rys/b3rys-team-os/b3os-github-workflow)
Your own site
<a href="https://agentmods.dev/skills/b3rys/b3rys-team-os/b3os-github-workflow"><img src="https://agentmods.dev/badge/skills/b3rys/b3rys-team-os/b3os-github-workflow/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for b3os-github-workflow

Your own site · 80×15
<a href="https://agentmods.dev/skills/b3rys/b3rys-team-os/b3os-github-workflow"><img src="https://agentmods.dev/badge/skills/b3rys/b3rys-team-os/b3os-github-workflow.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 169 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 7,491 The whole file, excluding the scripts and references it only reads on demand.
Security scan C 2 findings. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00169 $0.07491
Opus 5.5 $0.00068 $0.02996
Sonnet 5.5 $0.00034 $0.01498
Haiku 4.5 $0.00017 $0.00749

Measured 25d ago against content hash 129a5cb3cb6a, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade C, and why

b3os-github-workflow scanned grade C with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 25d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Downloads and executes remote codehighSupply chain

curl | sh runs whatever the server returns today, which is not necessarily what it returned when this was reviewed.

curl -fsS http://127.0.0.1:7878/team/api/settings | python3 -m json.tool | grep github

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

S=$(curl -fsS http://127.0.0.1:7878/team/api/settings)
skills/b3os-github-workflow/SKILL.md · 462 lines

How it starts

The opening of the file, as written. The whole thing — 462 lines — stays where its author put it; the contents beside it link to each section on GitHub.

GitHub 워크플로 — 변경을 PR로 올려 머지까지

코드·주석·커밋·PR·문서는 인과관계와 사실로 쓴다. 회고와 사람의 발언은 저장소 밖에서 다룬다. 간결하게, 짧은 문장으로.

b3os 인프라(소스·config·registry·릴리스)를 고치면 b3os-infra-safety 를 먼저 보고 이 절차를 얹는다.

무엇을 쓰나 — 저장소에 남는 글은 사실과 인과만

저장소에 들어가는 것은 전부 공개물이다. 용도가 정해져 있다.

어디 무엇을
README·가이드 하는 방법 + 확인 방법
PR 본문 무엇이 문제인가(사실) → 왜 그렇게 되나(인과) → 어떻게 고쳤나 → 검증 결과
커밋 메시지 무엇을 바꿨고 왜 그게 맞는가
코드 주석 이 코드가 무엇을 하는가, 왜 이 조건이 필요한가
메모리·SHARED.md 회고·리뷰는 전부 여기. 밖에 안 나간다

빼는 것은 회고성 서술이다 — 사고 경위, "오늘 우리가", 작업 과정의 날짜, 그 일에 관계없는 사람 이름.

이 규칙은 PR·문서만이 아니라 코드와 주석에도 적용된다. 저장소에 남거나 밖으로 나가는 글 전부가 대상이다 — 코드, 주석, 커밋 메시지, PR, 이슈, 외부 문서.

빼는 것 셋

① 팀 대화 인용. 팀장·팀원이 무슨 말을 했는지는 저장소에 남기지 않는다. 변경의 근거는 요구사항이나 측정값으로 적는다. 누가 요청했는지는 근거가 아니다 — 그게 근거라면 다음 사람은 그 말을 찾을 수 없어 판단을 재현하지 못한다.

대상은 팀 내부 대화다. 외부 출처는 인용한다 — 업스트림 이슈, 벤더 문서, 표준 문서의 문장이 우회 코드의 유일한 근거인 경우가 있다. 그건 링크와 함께 남긴다. 다음 사람이 실제로 찾아가 확인할 수 있기 때문이다.

② 자기비판·반성. "내가 놓쳤다", "이걸 몰라서 밟았다" 는 저장소 밖으로 간다. 남길 값은 후회가 아니라 무엇이 참인가다.

③ 사람에게 귀속된 리뷰 이력. "누구 리뷰에서 나왔다" 대신 무엇이 관측됐는지를 적는다.

이렇게 바꾼다

쓰지 않는다 대신
팀장님 지시 2026-07-30 요구사항:
GD 결정 · 팀 리드 결정 제품 결정:
팀장님 실측 · <팀원> 지적 실측: · 리뷰 지적:
codex 리뷰에서 나온 · dbak 지적 리뷰에서 관측된
오늘 4건이 조용히 사라졌다 이 경로에서 4건이 통보 없이 유실된다
내가 세 번째까지는 요청했다 (삭제)

남기는 것: 관측값, 재현 조건, 인과, 검증 방법, 그리고 그 판단이 왜 맞는가.

절차가 요구하는 신원은 그대로 쓴다 — 커밋 author, Co-authored-by 를 비롯한 git trailer, PR 본문의 Submitted-by, 리뷰 승인 계정, 코드에서 참조하는 버전·날짜. 이건 인용이 아니라 추적에 필요한 사실이다.

★그중 일부는 기계가 읽는 값이다.★ Approved-by: <이름> 은 산문이 아니라 머지 게이트가 merge_approvers_normal 과 대조하는 입력이다(skills/b3os-release-ops/scripts/release-preflight.sh). 이 규칙을 "사람 이름을 빼라" 로 읽고 지우면 게이트가 깨진다.

왜 이게 규칙인가

저장소는 공개물이고, 개인 이름·역할·대화는 코드와 함께 영구히 나간다. 그리고 회고성 서술은 다음 사람에게 쓸모가 없다 — 그가 필요한 것은 "누가 언제 무엇을 말했다" 가 아니라 "지금 이 조건이 왜 이래야 하는가" 다.

회고·리뷰·교훈은 메모리와 SHARED.md 로 간다. 없애는 게 아니라 자리를 옮기는 것이다.

설정에서 읽을 값

아래 값은 이 문서에 적지 않는다. 환경마다 다르고, 문서에 박히면 그 자체가 공격 지점 안내가 된다.

Read the full file on GitHub · 462 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 25d ago Changed 129a5cb3cb6a
  2. 1mo ago Changed · +14 lines 7bdb88408938
  3. 1mo ago First seen · 448 lines · 169 tokens per session scan C 9694c53bf3db

Subscribe to this mod's changes

b3os-github-workflow is a skill published in the GitHub repository b3rys/b3rys-team-os (14 stars, last pushed today), licensed Apache-2.0. It adds 169 tokens to every session and 7,491 once invoked, about $0.0007 per session on Opus 5.5. A static security scan graded it C with 2 findings (downloads and executes remote code, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Related

Other skills, from other repositories

harness-pr-reviewer

Checks a submitted PR against the environment's baseline assets (CLAUDE.md, memory, naming, asset classification) and attaches a review comment with a merge recommendation. 5 steps — diff read, 8-area consistency check, self-catch, comment, merge recommendation.

chrono-meta/forge-harness · 61 tokens

ai-driven-code-editor-cli

OpenCode AI - AI-driven code editor/IDE (CLI/TUI version of Cursor/Windsurf). Use when: (1) AI-assisted coding tasks, (2) Code refactoring with AI, (3) GitHub PR review/fixes, (4) Multi-file edits requiring context, (5) Running AI agents on codebases. NOT for: simple one-line ed…

rondoflow/rondoflow · 84 tokens

dos-verify-done-claims

Before accepting an agent's 'done / shipped / fixed' claim, verify it against ground truth (git ancestry + the commit's own diff) using the DOS kernel's dos verify and dos commit-audit — never the agent's own narration.

anthony-chaudhary/dos-kernel · 61 tokens

open-code-review

Performs AI-powered code review on Git changes using the ocr CLI from alibaba/open-code-review. Use when the user asks to review code, review a pull request, review staged/unstaged changes, review a commit, or compare branches for code quality issues. Produces line-level review comments and can automatically apply…

alibaba/open-code-review · 98 tokens

github-pr-workflow

Prepare a GitHub pull request from a feature branch — branch hygiene, commit shape, title/body, verification notes, screenshots for UI work, and replies to review comments.

paperclipai/paperclip · 39 tokens

gh-find-prs

Survey open Codewhale PRs and triage each for mergeability and disposition against the real landing branch.

Hmbown/CodeWhale · 27 tokens