Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/data-wise/craft/gitnpx skills add Data-Wise/craft --skill gitgit clone --depth 1 https://github.com/Data-Wise/craftWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00151 | $0.08122 |
| Opus 5 | $0.00076 | $0.04061 |
| Sonnet 5 | $0.00030 | $0.01624 |
| Haiku 4.5 | $0.00015 | $0.00812 |
Grade B, and why
git-workflow scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Reads agent configuration directoriesmediumAgent snooping
.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.
Inspect, enable, disable, and profile the craft guard suite (`branch-guard.sh` + `no-switch-guard.sh`). Absorbs the former `git/guard.md` command, deleted entirely in the 2026-07 v4 consolidation (see Integration table). How it starts
The opening of the file, as written. The whole thing — 418 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Git Workflow
End-to-end git lifecycle for craft users: initialize a repo, manage branches and worktrees, sync with remotes, protect (or temporarily bypass) main/dev, check whether an open issue's premise still holds, and surface the learning/safety reference material when users ask "how do I undo X?". Consolidates the 9 commands/git/*.md commands and 4 commands/git/docs/*.md reference docs into one coherent skill.
When to Use
Activate when the user's prompt matches any of these concerns:
| User intent | Operation |
|---|---|
| "init repo", "set up git", "bootstrap repository" | Repo init |
| "show branches", "new branch", "switch branch", "delete branch" | Branch management |
| "git status", "what's the state of this repo" | Enhanced status |
| "clean merged branches", "delete merged" | Branch cleanup |
| "create a worktree", "list worktrees", "remove worktree", "finish worktree" | Worktree management |
| "sync with remote", "pull and push", "update from upstream" | Sync |
| "git activity", "git recap", "what did I commit today" | Activity summary |
| "protect main", "enable branch protection", "configure protection level" | Local protection |
| "apply baseline protection", "github-side protection", "PR-required setup" | GitHub-side protection |
| "bypass protection", "unprotect", "let me commit to main once" | Session bypass |
| "how do I undo X?", "fix a git mistake", "I messed up git" | Undo reference |
| "teach me git", "learn git workflow", "git refcard" | Learning material |
| "what are the safety rails?", "is this safe?" | Safety reference |
| "list guards", "enable/disable guard", "explain what this command would do", "guard profile" | Guard registry CLI |
| "check if this issue still applies", "is issue #N still valid", "premise check before I fix this" | Issue premise check |
If the prompt is ambiguous, default to enhanced status (cheapest) and offer follow-ups.
Prerequisites
- Git installed (
git --version) - For protection / GitHub-side operations:
ghCLI authenticated - For worktrees: shared
~/.git-worktrees/directory convention (created on first use) - For learning material: no prerequisites — pure reference
What ships with it
5 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 418 lines · 151 tokens per session scan B 25ea3858a1af
git-workflow is a skill published in the GitHub repository Data-Wise/craft (4 stars, last pushed 16d ago), licensed MIT. It adds 151 tokens to every session and 8,122 once invoked, about $0.0008 per session on Opus 5. A static security scan graded it B with 1 finding (reads agent configuration directories). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
github-actions-workflow
Scaffolds or audits a GitHub Actions CI/CD workflow for a project. Covers job structure, caching, secrets handling, concurrency groups, environment gates, and reusable workflows via workflowcall. Invoked when the user asks to set up CI, add a GitHub Actions workflow, improve pipeline performance, or share workflow…
specflow
Spec-driven development with executable contracts.
specflow-loop-selector
Selects the correct Specflow loop and forces a concrete run contract before work starts. Use when an agent is asked to start Specflow work, build a ticket, create/refine a PRD, investigate an existing product, run Gate D, choose between spec-build and feature-build, or "go find out about" Specflow loops. Compatible…
specflow-simulate
Simulates end-to-end usage of a Specflow story across multiple personas and divergent routes to discover gaps, edge cases, and unhandled branches BEFORE the story is built — then proposes each finding as a concrete story addition (new REQ, negative-path AC, Gherkin branch, or journey step). This is the high-value…
specflow-audit
Audits a Specflow story/ticket for spec-compliance and surgically uplifts it — adding only the missing executable contract sections (SQL/RLS, TypeScript interfaces, invariant codes, Gherkin, acceptance criteria, Definition of Done, data-testid coverage) — then runs a pre-flight gate that refuses to mark the ticket…
architecture-review
Conducts a comprehensive multi-perspective architecture review using ALL architecture team members. Use when the user requests "Start architecture review", "Full architecture review", "Review architecture for version X.Y.Z", "Conduct comprehensive review", or when they want assessment from multiple perspectives. Do…