What is syncing-agent-skills?

A guide for keeping agent-skill definitions aligned between Claude Code and Codex, two AI coding tools.

Use it when creating, renaming, migrating, updating, or auditing skills, especially when a shared definition must be projected to multiple coding tools.

It prevents the two tools from using different or outdated copies of the same skill instructions.

syncing-agent-skills — Skill for Claude Code by dork-labs

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent

npx skills add dork-labs/dorkos --skill syncing-agent-skills

Clone the repo

git clone --depth 1 https://github.com/dork-labs/dorkos

Made for: Claude Code.

Or install flow, the plugin that ships this one along with the rest of its 32 skills, 43 commands, 5 agents, 4 hooks.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/dork-labs/dorkos/syncing-agent-skills/github.svg)](https://agentmods.dev/skills/dork-labs/dorkos/syncing-agent-skills)

Your own site

<a href="https://agentmods.dev/skills/dork-labs/dorkos/syncing-agent-skills"><img src="https://agentmods.dev/badge/skills/dork-labs/dorkos/syncing-agent-skills/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/skills/dork-labs/dorkos/syncing-agent-skills"><img src="https://agentmods.dev/badge/skills/dork-labs/dorkos/syncing-agent-skills.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 55 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 1,842 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 1 finding. A grade says what 26 rules found in the file — not that it is safe. Third-party audits

NVIDIA SkillSpector warn 7 Sept 2026

SkillSpector: 4 findings, up to medium

These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →

medium Agent Snooping · line 2
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Fix: Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation.
medium Agent Snooping · line 15
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Fix: Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation.
medium Rogue Agent · line 31
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Fix: Remove any persistence mechanisms (cron jobs, startup scripts, state files). Skills should not maintain state across sessions without explicit user consent.
medium Agent Snooping · line 107
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Fix: Remove all code or instructions that list or read other skills' files or directories. Skills should operate independently; cross-skill access is a privilege escalation.

How audits are shown

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00055	$0.01842
Opus 5	$0.00028	$0.00921
Sonnet 5	$0.00011	$0.00368
Haiku 4.5	$0.00006	$0.00184

Measured today against content hash 581e52e752a2, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-09, from the pricing page.

Security

Grade A, and why

syncing-agent-skills scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured today.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Enumerates other installed skillslowAgent snooping

Other skills' SKILL.md files reveal prompts, capabilities and secrets that should be invisible to peers.

- Verify with `ls -la .claude/skills/` (links must not dangle) and reconcile against `harness.manifest.json`

Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.

.agents/skills/syncing-agent-skills/SKILL.md · 144 lines

How it starts

The opening of the file, as written. The whole thing — 144 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Syncing Agent Skills

Overview

This skill maintains the repo's dual-harness skill strategy:

Shared skills live canonically in .agents/skills/
The projection engine (@dorkos/harness, driven by dorkos harness sync) projects the canonical layer to every enabled harness — Claude Code, Codex, Cursor, Gemini, Copilot, OpenCode
.agents/harness.manifest.json declares the exceptions: Claude-only skills, tool-specific wrappers, command mappings, and instruction/hook projections
Claude Code consumes shared skills through per-skill symlinks in .claude/skills/; Codex discovers them directly from .agents/skills/

The goal is to keep shared expertise in one place and let the engine, not by-hand symlinking, keep every harness's view aligned.

Primary Workflow: the Sync Engine

The engine is the source of truth for projection mechanics. Run it from the repo root:

dorkos harness sync                      # report drift, write nothing (same as --check)
dorkos harness sync --fix                # realize the plan on disk (symlinks, scaffolds, generated files)
dorkos harness sync --check --harness codex   # narrow to one harness (claude-code|codex|cursor|gemini|copilot|opencode)

--check (the default) prints the per-harness projection plan and exits 1 on drift. It writes nothing, ever — safe to run any time, ideal after creating/renaming/moving a skill
--fix applies the plan: creates missing symlinks, scaffolds wrappers, regenerates projected files, and reports anything it dropped
Sync acts on the directory you run it in, so run it from the repo root. Both modes need .agents/harness.manifest.json there. Without one, --check exits 1 and names the directory it searched; --fix creates a default manifest in that directory — which is a real write into wherever you happened to be standing, so check where you are before reaching for it
The engine runs fully offline (no server, no ~/.dork needed for repo-scope work); it lives in packages/harness, with the CLI entry in packages/cli/src/harness-sync-command.ts

Read the full file on GitHub · 144 lines

Files

What ships with it

1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

references/sync-harnesses-spec.md 14 KB

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

today Changed · +4 lines 581e52e752a2
9d ago First seen · 140 lines · 55 tokens per session scan A f8c8cc4b6c3d

Subscribe to this mod's changes

syncing-agent-skills is a skill published in the GitHub repository dork-labs/dorkos (9 stars, last pushed today), licensed MIT. It adds 55 tokens to every session and 1,842 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 1 finding (enumerates other installed skills). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Autonomous Agents Building agents Claude Code agent-sdk ai-agents anthropic claude

hive.slack-notifications-setup

Set up a Slack notification channel (Sentinel) for a colony by driving the browser — reuse or create the "Hive Sentinel" Slack app from a JSON manifest, install it, capture the bot + app tokens, create/select the channel via the Slack API, and turn Sentinel on so the colony can ping the user on Slack and accept…

aden-hive/hive · 136 tokens

hive.pdf

Read, write, merge, split, rotate, watermark, encrypt, and OCR PDF files using Python (pypdf, pdfplumber, reportlab, pypdfium2) and command-line tools (poppler-utils, qpdf). Use when the user asks to extract text/tables/images from a PDF, create or modify a PDF, combine or split PDFs, OCR a scanned PDF…

aden-hive/hive · 98 tokens

syncing-agent-skills