ghsync

A GitHub repository synchronisation tool that discovers repositories you can access in an organisation or personal account, clones missing ones, and updates existing local copies.

In plain words
What is it for?
It is for setting up a local mirror of accessible GitHub repositories, fetching updates, creating worktrees, and reporting repositories that were not safely updated.
Why use it?
It removes the manual work of finding many repositories and helps keep local copies current without overwriting uncommitted work or work on another branch.

Skill for Claude CodeCodex

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add skills/bjcoombs/ai-native-toolkit/ghsync
Any agent
npx skills add bjcoombs/ai-native-toolkit --skill ghsync
Clone the repo
git clone --depth 1 https://github.com/bjcoombs/ai-native-toolkit

Made for: Claude Code, Codex.

Per session 187 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 1,603 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 0 findings. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.00187 $0.01603
Opus 5 $0.00093 $0.00801
Sonnet 5 $0.00037 $0.00321
Haiku 4.5 $0.00019 $0.00160

Measured 2d ago against content hash 11770ac2a983, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

ghsync scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

The scan reads SKILL.md. This mod also ships 1 executable file (scripts/ghsync.sh), listed below but not scanned — reading those needs a real analyzer, not pattern matching.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

skills/ghsync/SKILL.md · 122 lines

How it starts

The opening of the file, as written. The whole thing — 122 lines — stays where its author put it; the contents beside it link to each section on GitHub.

ghsync: mirror and sync every repo you can access

Onboarding into a new enterprise means finding and cloning dozens of repos by hand, then drifting out of date. This skill does both halves: it discovers everything you can reach and keeps it in sync.

  • First run — clones every accessible repo into a worktree-friendly layout.
  • Every run after — fast-forward updates repos already on their default branch, updates their worktrees, and clones anything new. It never clobbers local work: repos with uncommitted changes or on a non-default branch are fetched but not pulled, and reported in the summary.

It is org-agnostic — point it at any GitHub org, GitHub Enterprise host, or personal account. The script detects the account type itself: for an organization it unions the teams you belong to with the org's repo list (so direct-collaborator and public repos are included even with no team membership); for a personal account it uses the account's repo list (private repos included when it's your own account).

How to run it

The script lives next to this file. Resolve its directory the same way the other skills do (works whether installed as a plugin or hand-placed under ~/.claude/skills/):

SKILL_DIR="${CLAUDE_PLUGIN_ROOT:+$CLAUDE_PLUGIN_ROOT/skills/ghsync}"
SKILL_DIR="${SKILL_DIR:-$(dirname "$(realpath ~/.claude/skills/ghsync/SKILL.md)")}"

# Org is derived from the directory you run in. To mirror the "meridianhub"
# org, run from a directory named meridianhub:
cd ~/dev/github.com/meridianhub
bash "$SKILL_DIR/scripts/ghsync.sh"

The org defaults to the basename of the directory you launch from. So running inside ~/dev/github.com/meridianhub syncs the meridianhub org into that directory. Override the org name or target directory explicitly when they differ:

bash "$SKILL_DIR/scripts/ghsync.sh" --org meridianhub --root ~/dev/github.com/meridianhub

What to do when invoked

  1. Confirm the target. Run with --list-repos first (or --list-teams for an org) so the user sees which account and how many repos before any cloning. This doubles as a check that the derived account name is correct.
  2. Dry run on first use against a new org (--dry-run) to preview clones and updates without touching disk.
  3. Run the real sync. Stream the output; the run ends with a summary (up-to-date / updated / failed / uncommitted / branch issues / worktrees).
  4. Surface the exceptions. Call out anything under Failed, Uncommitted changes, or Not on default branch — these are the repos the user may need to deal with manually.

Read the full file on GitHub · 122 lines

Files

What ships with it

1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2d ago First seen · 122 lines · 187 tokens per session scan A 11770ac2a983

Subscribe to this mod's changes

ghsync is a skill published in the GitHub repository bjcoombs/ai-native-toolkit (30 stars, last pushed 1mo ago), licensed Apache-2.0. It adds 187 tokens to every session and 1,603 once invoked, about $0.0009 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.