Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/EliasOulkadi/shokuninnpx agentmods add skills/eliasoulkadi/shokunin/git-workflowWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/eliasoulkadi/shokunin/git-workflow)<a href="https://agentmods.dev/skills/eliasoulkadi/shokunin/git-workflow"><img src="https://agentmods.dev/badge/skills/eliasoulkadi/shokunin/git-workflow/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/eliasoulkadi/shokunin/git-workflow"><img src="https://agentmods.dev/badge/skills/eliasoulkadi/shokunin/git-workflow.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Tool Misuse · line 159 Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).Fix: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00107 | $0.02342 |
| Opus 5.5 | $0.00043 | $0.00937 |
| Sonnet 5.5 | $0.00021 | $0.00468 |
| Haiku 4.5 | $0.00011 | $0.00234 |
Grade A, and why
git-workflow scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 264 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Git Workflow
Automate the development cycle: branch, commit, PR, review, merge, cleanup. Follows conventional commits and trunk-based development.
Workflow
Step 1: Create a feature branch
scripts/create-feature-branch.ps1 -Name "add-user-auth" -Type feat
This:
- Detects default branch (main/master)
- Fetches and pulls latest
- Creates
feat/add-user-authfrom base - Pushes upstream with tracking
Branch naming:
| Type | Prefix | Example |
|---|---|---|
| Feature | feat/ |
feat/add-user-auth |
| Fix | fix/ |
fix/login-redirect |
| Docs | docs/ |
docs/api-readme |
| Refactor | refactor/ |
refactor/auth-middleware |
| Chore | chore/ |
chore/update-deps |
Step 2: Make atomic commits
scripts/auto-commit.ps1 -Scope "auth" -DryRun # Preview first
scripts/auto-commit.ps1 -Scope "auth" # Commit
The script analyses changed files, generates a conventional commit message, and stages+commits.
Conventional commit format:
<type>(<scope>): <description>
[optional body]
[optional footer]
Rules:
- One logical change per commit
- Description: imperative mood, lowercase, max 72 chars
- Scope: the module/area affected
- Footer:
BREAKING CHANGE:,Closes #123,Co-authored-by:
Step 3: Prepare for PR
# Interactive rebase (squash WIP commits)
git rebase -i main
# Generate PR body from commit history
scripts/pr-body.ps1 -Clipboard
The PR body script:
- Detects base branch
- Extracts commits since fork
- Groups by conventional commit type
- Generates ## Summary, ## Changes, ## Testing sections
- Copies to clipboard
Squash rules:
- Squash
fixup!andwipcommits - Keep meaningful commit history
- Never squash if commits have different scopes
- Use
git rebase -i mainwithfixup(f) for WIP commits
Step 4: Create PR
# Create PR with generated body
gh pr create --title "feat(auth): add user authentication" --body "$(Get-Clipboard)"
# Or use the file
gh pr create --title "feat(auth): add user authentication" --body-file .pr-body.md
What ships with it
6 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 264 lines · 107 tokens per session scan A 8186dcfc10cd
git-workflow is a skill published in the GitHub repository EliasOulkadi/shokunin (112 stars, last pushed 17d ago), licensed MIT. It adds 107 tokens to every session and 2,342 once invoked, about $0.0004 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
om-open-pr
Shared PR opener for the auto pipeline — commits the worktree, pushes, reuses an existing PR or opens a ready (non-draft) PR against the configured base branch with the unified body template, applies the full SDLC label set with rationale comments, and for issue-driven runs hands the issue back and releases the lock.…
memorix-git-memory
Use when the task depends on commit history, what changed, when a fix shipped, or linking engineering evidence to reasoning memory.
cmux-testing
Choose scoped cmux verification, add behavioral tests, and validate Swift test targets and wiring. Use when adding tests or deciding what local/CI evidence a change needs.
at-daily-log
Summarize each day's Git activity into a concise daily work log, for a single date or a range. Uses the current repository, optional configured work projects, or paths named in conversation; configuration is never required.
at-commit
Generate a Conventional Commits message from staged changes and wait for confirmation before committing. Use when the user asks to commit or generate a commit message.
om-check-and-commit
Verify that the current branch is ready to publish by running every configured validation command in order, fix straightforward failures (including locale-file drift when the repo checks it), and once everything passes commit and push the current branch. Use when the user asks to check the branch, make CI-style…