Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add gg-mo/repo-hygiene --skill gating-commitsgit clone --depth 1 https://github.com/gg-mo/repo-hygieneWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/gg-mo/repo-hygiene/gating-commits)<a href="https://agentmods.dev/skills/gg-mo/repo-hygiene/gating-commits"><img src="https://agentmods.dev/badge/skills/gg-mo/repo-hygiene/gating-commits/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/gg-mo/repo-hygiene/gating-commits"><img src="https://agentmods.dev/badge/skills/gg-mo/repo-hygiene/gating-commits.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00056 | $0.00934 |
| Opus 5 | $0.00028 | $0.00467 |
| Sonnet 5 | $0.00011 | $0.00187 |
| Haiku 4.5 | $0.00006 | $0.00093 |
Grade A, and why
gating-commits scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 81 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Gating Commits
Overview
"User said commit" is not authorization to skip verification. The honest baseline from agents is: do git triage, draft a message, stage, commit — no test/typecheck/lint in between. This skill changes the default to verify first, commit second.
Core principle: A commit is a promise that what's in it works. Don't ship that promise on faith.
When To Use
- User says "commit" / "ship" / "land" / "merge" / "push"
- Just finished a multi-file change
- About to call
git commitfor any reason
The Gate
Run these BEFORE staging or committing. Stop at the first failure.
- Identify the verification commands. Read
package.json,pyproject.toml,Makefile,.github/workflows/, orCLAUDE.md. Typical targets:- Tests:
npm test,pytest,go test ./...,cargo test - Types:
tsc --noEmit,mypy,pyright - Lint:
npm run lint,ruff check,golangci-lint run
- Tests:
- Run them. Read the full output. Check exit codes.
- If anything fails: Fix or revert. Do NOT commit failing code with intent to fix in the next commit.
- Sibling-skill checks:
- Changed a public API surface? Did
repo-hygiene:keeping-docs-freshrun? - Added business logic? Did
repo-hygiene:testing-new-coderun? - Added new functions/classes/files? Did
repo-hygiene:writing-docstringsapply?
- Changed a public API surface? Did
- Focus check —
git diff --stat HEAD. Are all changes related to the stated commit purpose? If unrelated changes snuck in, split them. - Then stage specific files (no blanket
git add .) and commit with a clear message.
What Counts as "Verified"
| Check | Sufficient evidence |
|---|---|
| Tests pass | Test command output: 0 failures, exit 0 |
| Types clean | Type-checker output: 0 errors |
| Lint clean | Linter output: 0 errors (warnings: use judgment) |
| Build succeeds | Build command exits 0 |
"Looks fine," "should pass," and "I'm confident" do not count.
What if the Repo Has No Verification Setup?
Tell the user explicitly:
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 11d ago First seen · 81 lines · 56 tokens per session scan A 41a22de86cc9
gating-commits is a skill published in the GitHub repository gg-mo/repo-hygiene (3 stars, last pushed 4mo ago), licensed MIT. It adds 56 tokens to every session and 934 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
branch-and-worktree-workflow
Isolates feature work in its own branch or worktree and integrates it cleanly when done. Use this when starting work that should not disturb the current workspace, when several efforts must proceed in parallel on one repository, or when implementation is finished and the change needs merging, rebasing, or splitting…
precommit
Pre-commit checks — lint:fix -> build -> test.
precommit-fast
Quick pre-commit checks — lint:fix -> test.
workflow
Run the complete 5-step development workflow: focus problem → prevent over-development → test-first (TDD) → document → smart commit. Use when starting a new feature, or when the user runs /workflow or asks for the full development flow.
incremental-implementation
Use when implementing a multi-file change, building a feature from a breakdown, or writing a large amount of code. Not for a single settled ticket: use work.
quick
/quick — Lightweight Feature Workflow.