Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add ethanaubuchon/dossier-tradecraft --skill repo-setupgit clone --depth 1 https://github.com/ethanaubuchon/dossier-tradecraftWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/ethanaubuchon/dossier-tradecraft/repo-setup)<a href="https://agentmods.dev/skills/ethanaubuchon/dossier-tradecraft/repo-setup"><img src="https://agentmods.dev/badge/skills/ethanaubuchon/dossier-tradecraft/repo-setup/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/ethanaubuchon/dossier-tradecraft/repo-setup"><img src="https://agentmods.dev/badge/skills/ethanaubuchon/dossier-tradecraft/repo-setup.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00066 | $0.03446 |
| Opus 5.5 | $0.00026 | $0.01378 |
| Sonnet 5.5 | $0.00013 | $0.00689 |
| Haiku 4.5 | $0.00007 | $0.00345 |
Grade A, and why
repo-setup scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 25d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 86 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Repo Setup
First step of /implement's repo path. Takes the repo from whatever state it's in to a fresh feature branch + worktree cut off an up-to-date main — with the session standing in that worktree — clearing the debris of previously-merged work on the way. Assumes a git repo — the recipe's repo-vs-vault context branch runs before this.
Input
- branch — the feature branch to create, as
<type>/<desc>(feat/,fix/,chore/,story/S-<id>-<desc>). The recipe derives it from the ticket. A bare description is acceptable — default the type tofeat/. - (implicit) the current repo and its
originremote.
Steps
- Start from the main checkout. Steps 1–5 resolve relative paths and "current branch" against the main checkout, so get there first — a session may still be standing in a previous run's worktree (a second
/implementin the same session), have been launched inside one, or sit in a subdirectory.- Resolve the root:
git worktree list --porcelain | sed -n '1s/^worktree //p'— the first entry is the main checkout, call it<root>. If that entry is followed by abareline, the repo is a bare-repo layout with no main working tree: stop — that layout needs a project override. - Record where you started: the starting worktree (
git rev-parse --show-toplevel) and its branch (git branch --show-current), before moving. Step 4 must not prune them — they may be a worktree the user owns and the session was launched in. - Move: if
pwd -Pisn't<root>, first tryExitWorktree(action: "keep")(load viaToolSearchselect:ExitWorktreeif deferred; neverremove— that's a prior branch's work). Don't rely on remembering whether you entered one — after/clearor compaction you may not; the tool reports when no worktree session is active. Then, ifpwd -Pstill isn't<root>,cd <root>— and re-checkpwd -P: the harness may reset acdthat leaves the launch directory, so if it didn't take, stop and surface it. No-op on a normal first run. Steps 4–5 anchor their file paths to<root>anyway, so they hold even if cwd drifts. - Ensure local ignores: make sure
.worktrees/and.claude/plans/are in the repo-local exclude file — append each if missing, no-op if present — so the.worktrees/dir never shows as untracked in the main checkout. Two plain commands — resolve the common git dir with a baregit rev-parse --git-common-dir(if the output is relative — typically.git— prefix it with<root>/; if absolute, use it as-is), then run the append with that absolute path substituted as a literal:
The exclude file lives in the common git dir, so it applies to the main checkout and every linked worktree, and it isn't tracked — so ignoring never dirties the tree. That's why this runs before the step 1 guard: it clears an untrackedc='<absolute common dir>'; x="$c/info/exclude" if [ -d "$c" ]; then mkdir -p "$c/info" [ -s "$x" ] && [ -n "$(tail -c1 "$x")" ] && printf '\n' >> "$x" for p in '.worktrees/' '.claude/plans/'; do grep -qxF "$p" "$x" 2>/dev/null || printf '%s\n' "$p" >> "$x"; done else echo "no git common dir at $c" >&2; false; fi.worktrees/instead of tripping on it — and before step 6, because a worktree-isolated session refuses writes into<root>/.git. If the harness refuses the append anyway (e.g. an isolation guard still active after/clear), stop and give the user the literal command to run themselves (! <command>). The append runs nogitand embeds no$(git …), so command-shape hooks can verify it; it fails loudly (without exiting a persistent shell) if the path isn't a directory; the newline guard keeps an entry from being glued onto a last line with no trailing newline. This snippet is canonical —plan-filereuses it for.claude/plans/alone. repo-setup never edits the tracked.gitignore— a project that wants these entries there adds them through a normal PR. A project that tracks plan files under.claude/plans/must override this step (andplan-file) to skip that entry, or new plans are silently ignored. (plan-filere-checks.claude/plans/independently, so it holds when invoked standalone.)
- Resolve the root:
- Guard a dirty tree. If
git status --porcelainis non-empty, stop and surface the changes — don't fetch/prune over dirty state. (A project override may stash-and-restore instead.) A.gitignorewhose only change is adding.worktrees//.claude/plans/is left over from an older repo-setup that wrote there; surface it like any other change — reverting a modified one (or deleting an untracked one holding only those lines) is safe, step 0's exclude entries now cover it. - Fetch.
git fetch --prune origin— updates remote-tracking refs and drops refs for branches deleted on the remote. - Fast-forward
main. Bring localmaintoorigin/main, never a merge commit:- on
main→git merge --ff-only origin/main - not on
main→git fetch origin main:main(fast-forward-only update of the local ref; refuses if it would diverge).
- on
- Prune merged work. Enumerate merged branches with
git branch --merged origin/main, add the squash-merged ones (see caveat), then dropmain, the current branch, the starting branch/worktree recorded in step 0, and the in-use candidates below.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 25d ago Changed · +3 lines b8a494cf8f7f
- 28d ago Changed · +6 lines c54f0a39b4ca
- 1mo ago Changed · +14 lines · +6 tokens per session 86f443c3b788
- 1mo ago First seen · 63 lines · 60 tokens per session scan A 170f51059f2b
repo-setup is a skill published in the GitHub repository ethanaubuchon/dossier-tradecraft (3 stars, last pushed 8d ago), licensed MIT. It adds 66 tokens to every session and 3,446 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
hyalo-changelog
Maintain Keep a Changelog files with Hyalo's changelog profile and add/release commands.
secrets-scan
Pre-commit secrets detection with pattern-based scanning for API keys, tokens, passwords, private keys, and connection strings. Self-contained — no external tools required.
github-sync
Sync local Obsidian vault to GitHub — auto-update README.md and push. Triggers: /github-sync, "sync to github", "push to github", "update repo".
datalad
Retrieves, versions, and publishes scientific datasets with DataLad and git-annex, and captures computational provenance with datalad run, rerun, and containers-run. Use when cloning or fetching data from OpenNeuro, DANDI, datasets.datalad.org, or any DataLad dataset; when a file in a dataset reads as a broken symlink…
ship
Pre-release gate. Run the full gate, responsive + render checks, then produce the release checklist (README badge/current/changelog). Use before tagging a release.
git-workflow
A guide for handling Git repository work safely, including status checks, branches, commits, pushes, pull requests, and rebasing. Git is a version-control system that records code changes and coordinates work between developers.