Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/friedbotstudio/baseline/commitnpx skills add friedbotstudio/baseline --skill commitgit clone --depth 1 https://github.com/friedbotstudio/baselineWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00059 | $0.02902 |
| Opus 5 | $0.00030 | $0.01451 |
| Sonnet 5 | $0.00012 | $0.00580 |
| Haiku 4.5 | $0.00006 | $0.00290 |
Grade A, and why
commit scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 40 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Prereq: ALL of archive AND memory-sync in completed (Phase 10.5 archives slug artifacts; Phase 10.6 curates _pending.md) AND a valid consent token at .claude/state/commit_consent (the Git Commit Guard hook enforces this independently). On any workflow where memory-sync is in exceptions (e.g. non-git projects auto-except it), this skill SHALL refuse to proceed unless that exception is explicit in workflow.json.
Applicability. This skill applies only when the project is a git repository. Non-git projects auto-except commit at /triage time (CLAUDE.md Article IV); the workflow ends after /archive.
Steps:
- Git-repo precheck. Run
git rev-parse --is-inside-work-tree 2>/dev/null. If exit non-zero, exit cleanly with: "Not a git repository —/commitis inapplicable. Per CLAUDE.md Article IV,commitis auto-excepted on non-git projects; the workflow ended at/archive. Persistence outside git is your responsibility." Do not run any subsequent step. - Archive
workflow.jsonitself. This is the final piece of the archival bundle, held back until now so phase-ordering checks worked up through this point. Read.claude/state/workflow.jsonto get the slug, then move the file into the already-existing archive bundle:docs/archive/<date>/<slug>/workflow.json. Use plainmv, notgit mv—.claude/state/is gitignored, so git has no index entry for the source andgit mvfails withnot under version control. (Step 2.8 and/archiveStep 4 both saygit mv; those move tracked paths, which is the difference.) Use the bundle's<date>directory (the one/archivecreated — inspectdocs/archive/to find the most recent bundle matching the slug). - Verify workflow prereq: memory-sync is the final non-commit entry in
completed;archiveis the entry immediately before it; no open consent gates remain. 2.5. Branch topology (Art. VII). Readgit.workflow_model. If it resolves to an enforced model (direct-to-main/github-flow), the commit SHALL land on a branch the model permits —git_commit_guardblocks anything else (underdirect-to-main, commit on arelease_branchesmember; do NOT reflexively create a feature branch). If it resolves toask(default), the guard passes on topology grounds and the branch decision is YOURS to surface: ask the user which branch this commit belongs on rather than improvising one. Never create/switch branches to satisfy a model the project did not declare. 2.7. Stamp closure pre-stage (only when populated). Readsource_backlog_keysfrom the archived copydocs/archive/<date>/<slug>/workflow.json(Step 1 moved the live file). If the array is absent OR empty, skip this step (back-compat — unchanged commit behavior). Otherwise runnode .claude/skills/memory-sync/sweep.mjs --mode stamp-closure --memory-dir .claude/memory --backlog-keys <comma-separated keys>. This writesstatus: picked-up+superseded-at: <today>to each named entry BEFORE staging, so the closure stamp rides THIS commit (atomic). The store is shape-aware: on a sharded store the stamp lands in the frontmatter of.claude/memory/backlog/<key>.md; on a flat store it lands in the## <key>block of.claude/memory/backlog.md.sweep.mjsis the sole writer to backlog entries — never edit them directly, and never add a commit-SHA provenance note (atomicity forbids a self-referential SHA). 2.8. Epic fold — close the epic when this commit finishes it (on theepic-childandpowertracks). Readworkflow.json → track_id; on any other track, skip this step. BEFORE staging, register the slices this commit closes in.claude/state/epic/<epic>.json → children[]via.claude/skills/commit/epic_close.mjs → registerClosedChildren({rootDir, epic, slices})— one slice on anepic-child(the child's own), every ticket id inworkflow.json → tickets[]on apowerbatch, which lands them all in one cycle and has no per-slice commit to hang the flip on. The helper leaves an already-closed slice alone, so a superseded slice keeps the reason it closed. A refusal (ok: false) names the offending slice; stop and fix it rather than committing an epic record that disagrees with its roadmap rows. This registration flips each child tostatus: "committed"(this is the pre-commit flip — it must precede the all-committed check so the close can ride THIS commit; the harness post-commit flip is now only an idempotent backstop). Then invokenode .claude/skills/commit/epic_close.mjs <epic>(where<epic>isworkflow.json → epic). The helper no-ops while any declared slice is still uncovered; once this registration covers them all, itgit mvs the epic's discovery bundle intodocs/archive/<date>/<epic>/(staged) and mergesclosed:true+closed_atinto the epic state file. The staged bundle move then rides the SAME commit produced below — no separate consent gate. (Run outside the harness, the same helper is the standalone recovery path: it stages the move and prints a/grant-commit+/commitprompt.) git status+git diff --statto confirm the change set. The diff now includes: production code changes + archive bundle additions + the workflow.json move + (when Step 2.7 stamped) thebacklog.mdclosure stamp + (when Step 2.8 closed an epic) the epic discovery-bundle move intodocs/archive/<date>/<epic>/. Stage named paths explicitly (nevergit add -A/git add .— seed.md forbids it). When Step 2.7 stamped, stage the entry paths it reported so the closure rides this commit —git add .claude/memory/backlog/<key>.mdper stamped key on a sharded store, orgit add .claude/memory/backlog.mdon a flat one. Staging a path that does not exist aborts the add and leaves the closure unstaged, whichgit_commit_guardthen hard-blocks.- Draft the commit message from the spec + diff. Conventional-style prefix (
feat:/fix:/refactor:/docs:/test:) followed by a 1-line summary and a short body explaining the WHY. The subject line is a fixed-register one-liner — leave it alone. The body is reviewer-facing prose — pass it throughSkill(humanizer)before step 5 so AI-writing tells (em-dash overuse, rule of three, inflated verbs, vague attributions) get scrubbed. Keep the brief tight: tell humanizer the register is "factual reviewer-facing commit body — describe the diff faithfully, do not invent rationale, preserve any spec quotes verbatim". 4.5. Closure preflight (only when Step 2.7 stamped). Write the staged path list withgit diff --cached --name-only > .claude/state/.closure-stagedand the drafted message to a temp file, then runnode .claude/skills/commit/closure-precommit-check.mjs --memory-dir .claude/memory --backlog-keys <comma-separated keys> --staged-file .claude/state/.closure-staged --message-file <message temp>. Exit 0 → proceed. Exit 1 → ABORT beforegit commit: the JSON report names what is unstamped/unstaged or whichCloses <key>line is unreconciled; fix it and retry. This is the friendly pre-guard check —git_commit_guardindependently re-verifies the same atomicity at commit time and will hard-block a split. 4.7. Power-track batch split (only whentrack_id == "power"). Readtrack_idfrom the archiveddocs/archive/<date>/<slug>/workflow.json(Step 1 moved the live file); if it is notpower, skip this step and continue to Step 5 (one commit). Otherwise do NOT write a single commit. Parse the dirty tree yourself —git status --porcelain, one entry per line as{path, status}— and pass that array toplanCommits(entries)from.claude/skills/power/commit-split.mjs:
What ships with it
3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday First seen · 40 lines · 59 tokens per session scan A 27c3c6e47026
commit is a skill published in the GitHub repository friedbotstudio/baseline (11 stars, last pushed 5d ago), licensed Apache-2.0. It adds 59 tokens to every session and 2,902 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
dev-standards
Enforces development workflows, quality gates, coding standards, and release processes for the deterministic-agent-control-protocol project. Use when implementing features, fixing bugs, refactoring architecture, adding integrations, updating policies, writing tests, updating documentation, or preparing releases.
code-review-with-lsp
Code review with LSP-powered code intelligence. Uses MCP tools (diagnostics, hover, references, definition, symbols) for semantic code understanding, not just text grep.
i18n-check
国际化完整性检查。检查翻译 key 是否缺失、硬编码文本、locale 文件一致性。.
vue-best-practices
Vue 2/3 代码规范检查。包括组件命名、Props 校验、Composition API 规范等。.
python-review
Python 遗留代码审查:bare except、SQL 注入、反序列化、密钥、调试输出.
rust-review
Rust 服务审查:panic、SQL 注入、密钥、错误吞没、遗留标记.