Borrowing it
Nothing to install: this file belongs to geekfujiwara/CodeAppsDevelopmentStandard. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/geekfujiwara/CodeAppsDevelopmentStandard/main/.github/skills/alm/SKILL.mdgit clone --depth 1 https://github.com/geekfujiwara/CodeAppsDevelopmentStandardWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/geekfujiwara/codeappsdevelopmentstandard/alm)<a href="https://agentmods.dev/skills/geekfujiwara/codeappsdevelopmentstandard/alm"><img src="https://agentmods.dev/badge/skills/geekfujiwara/codeappsdevelopmentstandard/alm/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/geekfujiwara/codeappsdevelopmentstandard/alm"><img src="https://agentmods.dev/badge/skills/geekfujiwara/codeappsdevelopmentstandard/alm.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 5 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Privilege Escalation · line 111 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- high Privilege Escalation · line 113 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- high Privilege Escalation · line 123 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- high Privilege Escalation · line 124 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- high Privilege Escalation · line 125 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00154 | $0.04184 |
| Opus 5.5 | $0.00062 | $0.01674 |
| Sonnet 5.5 | $0.00031 | $0.00837 |
| Haiku 4.5 | $0.00015 | $0.00418 |
Grade A, and why
alm scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 28d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 232 lines — stays where its author put it; the contents beside it link to each section on GitHub.
ALM（秘匿化・汎用化・CI/CD）共通スキル
コードファースト資産を安全に Git へ載せ、機械判定だけでデプロイまで到達させるための共通基盤。
プロダクト非依存であり、foundry-autopilot（Foundry エージェント）、code-apps（Code Apps）など
どのスキルからも同じ仕組みで利用できる。デプロイの実処理だけを各プロダクトスキルへ委譲する。
| 原則 | 内容 |
|---|---|
| テンプレートのみコミット | 追跡するのは ${VAR} 入りテンプレートだけ。実値は .env とシークレットストアにのみ存在する |
| 二重の防御 | ローカルは pre-commit（sanitize.py → check_secrets.py）、CI は決定論ゲート（review_sanitization.py） |
| 機械判定 | レビューはルールベース。人手の承認（HITL）を前提にせず、判定を再現可能にする |
| ホスティング非依存 | Git ホスティングとシークレットストアは GIT_PROVIDER / SECRET_BACKEND で差し替える |
| 最小権限 | ワークフローは permissions: を明示。contents: write はリリースジョブだけに許可する |
| 記録はリリースに残す | デプロイ結果とレビュー結果は GitHub Releases（バージョンごと）に残す。Issue には残さない |
| 設定の外出し | パス・許可リスト等は alm.config.json。スクリプト本体はどのリポジトリでも無改変で使う |
前提ツール: Python 3.10+、Git、Azure CLI（
az）。 シークレットストアに応じて GitHub CLI（gh）またはaz extension add --name azure-devopsを追加する。
事前確認（会話の最初に 1 回だけ）
本スキルの利用が確定したら、standard の共通契約に加え、 1 回の AskUserQuestion で次をまとめて確認する。
| # | 質問 | 合格条件 |
|---|---|---|
| 1 | Git provider、repository、visibility、既定 branch は何か | GitHub / Azure DevOps / その他と private / public を確定している |
| 2 | branch protection と environment approval を変更できる担当者は誰か | repository / project の管理担当者と承認者を記録している |
| 3 | secret backend と CI identity は何か | GitHub Secrets / variable group / Key Vault、OIDC / workload identity、rotation owner を確定している |
| 4 | CI が各デプロイ先へ持つ最小権限は何か | 対象環境ごとの scope、期限、role assignment 担当者を記録している |
| 5 | release、rollback、監査ログの運用は何か | version 規則、成果物保持、失敗時の戻し方、通知先を承認済みである |
personal access token や長期 client secret を既定にせず、OIDC / workload identity を優先する。 repository 管理権限、secret backend、CI identity のいずれかが未確定ならパイプラインを有効化しない。
各プロダクトスキルとの責務分担
| 担当 | 内容 | 参照先 |
|---|---|---|
alm（本スキル） |
秘匿化・汎用化・pre-commit・レビューゲート・承認・リリース記録 | 本ファイル |
foundry-autopilot |
Foundry エージェント定義、ブループリント、Teams パッケージ、公開 | foundry-autopilot |
code-apps |
Code Apps の実装、npm run deploy などのデプロイ手順 |
code-apps |
standard |
ソリューション運用・環境戦略などの上位ルール | standard |
What ships with it
13 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- alm.config.example.json 756 B
- references/.env.example 1.7 KB
- references/ci-providers.md 9.6 KB
- references/repo-scaffold.md 5.1 KB
- references/review-gates.md 16 KB
- references/troubleshooting.md 4.2 KB
- scripts/alm_config.py 4.2 KB runs code
- scripts/check_secrets.py 3.2 KB runs code
- scripts/gate_rules.py 17 KB runs code
- scripts/render.py 3.1 KB runs code
- scripts/review_report.py 3.9 KB runs code
- scripts/review_sanitization.py 4.0 KB runs code
- scripts/sanitize.py 9.9 KB runs code
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 28d ago Changed ba3a2c38749e
- 1mo ago Changed · +16 lines 3d530214de75
- 2mo ago Changed cfcc9ac402a6
- 2mo ago First seen · 216 lines · 154 tokens per session scan A a06590ca567c
alm is a skill published in the GitHub repository geekfujiwara/CodeAppsDevelopmentStandard (78 stars, last pushed yesterday), licensed MIT. It adds 154 tokens to every session and 4,184 once invoked, about $0.0006 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
alm compared with skills from other repositories
| Mod | Type | Stars | Last push | Licence | Scan | Tokens | Works with |
|---|---|---|---|---|---|---|---|
| almgeekfujiwara/CodeAppsDevelopmentStandard | Skill | 78 | yesterday | MIT | A | 154 | Claude Code, Codex |
| chinese-git-workflowjnMetaCode/superpowers-zh | Skill | 8.5k | 11d ago | MIT | A | 69 | Claude Code |
| atmos-profilescloudposse/atmos | Skill | 1.4k | yesterday | Apache-2.0 | A | 35 | Claude Code |
| webhook-managementhoangsonww/Claude-Code-Agent-Monitor | Skill | 1.1k | yesterday | MIT | A | 56 | Claude Code, Codex |
| monorepo-managementwshobson/agents | Skill | 42k | yesterday | MIT | C | 54 | Claude Code |
| managing-github-actions-secretsPostHog/posthog-foss | Skill | 728 | yesterday | MIT | A | 67 | Claude Code, Codex |
| postman-newman-automationLambdaTest/agent-skills | Skill | 390 | yesterday | MIT | A | 156 | Claude Code, Codex |