Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/jnzader/repoforge/github_oauthnpx skills add JNZader/repoforge --skill github_oauthgit clone --depth 1 https://github.com/JNZader/repoforgeWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00031 | $0.00438 |
| Opus 5 | $0.00015 | $0.00219 |
| Sonnet 5 | $0.00006 | $0.00088 |
| Haiku 4.5 | $0.00003 | $0.00044 |
Grade A, and why
exchange-github-oauth-code scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
exchange-github-oauth-code
This skill covers the implementation of GitHub OAuth helper functions.
Trigger: Load this skill when handling GitHub OAuth processes.
Quick Reference
| Task | Pattern |
|---|---|
| Generate OAuth state | generate_state() |
| Validate OAuth state | validate_state() |
Critical Patterns (Summary)
- Generate OAuth state: Create a unique state parameter for OAuth flow.
- Validate OAuth state: Ensure the state parameter matches the expected value.
Critical Patterns (Detailed)
Generate OAuth state
This function creates a unique state parameter to prevent CSRF attacks during the OAuth flow.
from apps.server.app.services.github_oauth import generate_state
state = generate_state()
Validate OAuth state
This function checks if the provided state matches the expected value to ensure the integrity of the OAuth process.
from apps.server.app.services.github_oauth import validate_state
is_valid = validate_state(received_state, expected_state)
When to Use
- When initiating the GitHub OAuth flow to generate a state parameter.
- When validating the state parameter after the user is redirected back from GitHub.
Commands
docker-compose up
python repoforge/cli.py
Anti-Patterns
Don't: Use hardcoded state values
Hardcoding state values can lead to security vulnerabilities and CSRF attacks.
# BAD
state = "fixed_state_value"
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 83 lines · 31 tokens per session scan A 855a2ab8f5ef
exchange-github-oauth-code is a skill published in the GitHub repository JNZader/repoforge (5 stars, last pushed 8d ago), licensed MIT. It adds 31 tokens to every session and 438 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
html-ppt-zhangzara-neo-grid-bold
A designer's portfolio narrative for a senior interview — three case studies, the craft, and the judgment behind each. Built as a decision-grade career deck for hiring panel.
html-ppt-zhangzara-capsule
A year-end self-review for a product manager — the role, the outcomes, the learning, and the ask, all evidence-backed. Built as a decision-grade career deck for manager, review committee.
html-ppt-xhs-white-editorial
A staff-engineer promotion packet — scope, the proof moments, the artifacts, and the impact that clears the bar. Built as a decision-grade career deck for manager, calibration committee.
multi-program-manager
Manage and compare multiple affiliate programs as a portfolio. Triggers on: "manage my affiliate programs", "compare my programs", "portfolio overview", "which program should I focus on", "diversify my affiliate income", "program switching", "affiliate portfolio", "program comparison", "revenue allocation", "which…
tailwind-css-patterns
Provides comprehensive Tailwind CSS utility-first styling patterns including responsive design, layout utilities, flexbox, grid, spacing, typography, colors, and modern CSS best practices. Use when styling React/Vue/Svelte components, building responsive layouts, implementing design systems, or optimizing CSS workflow.
criador-de-portfolio
Construção de portfólio profissional digital: seleção e apresentação de projetos, estrutura de cases com problema-solução-resultado, showcase de habilidades e estratégia de distribuição para atrair clientes e recrutadores.