Borrowing it
Nothing to install: this file belongs to julien777z/agent-sync-action. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/julien777z/agent-sync-action/main/.agents/skills/coordinate-repositories/SKILL.mdgit clone --depth 1 https://github.com/julien777z/agent-sync-actionWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/julien777z/agent-sync-action/coordinate-repositories)<a href="https://agentmods.dev/skills/julien777z/agent-sync-action/coordinate-repositories"><img src="https://agentmods.dev/badge/skills/julien777z/agent-sync-action/coordinate-repositories/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/julien777z/agent-sync-action/coordinate-repositories"><img src="https://agentmods.dev/badge/skills/julien777z/agent-sync-action/coordinate-repositories.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00054 | $0.02273 |
| Opus 5 | $0.00027 | $0.01137 |
| Sonnet 5 | $0.00011 | $0.00455 |
| Haiku 4.5 | $0.00005 | $0.00227 |
Grade A, and why
coordinate-repositories scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
Copies of this mod
1 near-identical copy found in the catalogue:
- coordinate-repositories — 100% identical, 0 lines differ
How it starts
The opening of the file, as written. The whole thing — 41 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Coordinate Repositories
Carry out the caller's task consistently across the selected repository collection without treating matching names or layouts as proof of matching behavior.
Workflow
- Determine whether the workspace is local and sibling repositories can be safely coordinated. Use filesystem layout, remotes, environment markers, and accessible siblings as evidence. In a cloud, ephemeral, or ambiguous environment, do not search broadly or mutate other repositories; report the limitation or ask the user.
- Repair malformed local Git refs before bypassing a repository. When Git identifies an invalid ref, resolve its exact path under the repository's common Git directory, confirm that target is malformed, delete only that ref, verify it is gone, and retry the failed Git operation. Do not preserve a known-bad ref by routing the row through another checkout or clone. Use a fresh isolated clone only when the original repository remains unusable for a different reason after the ref repair.
- Determine the bounded repository collection from the current repository, accessible sibling repositories and worktrees, prior targets in the active coordination task, and the user's scope. A repository named in prose, shown in a screenshot, linked as an example, or currently checked out identifies evidence or an origin by default; it narrows the target collection only when the user explicitly limits scope to that repository. Discover Git repositories independently of task-specific files or configuration, search bounded collection roots first, normalize remote identities, and deduplicate multiple checkouts or worktrees of the same remote. Never crawl unrelated locations.
- Freeze a typed target manifest before mutation. Add one repository row per normalized remote and, when the caller requests local convergence, one local-installation row per matching existing editable installation after resolving its real path and ownership. Record the intended outcome and explicit expected and forbidden postconditions for every row. Track repository rows through
pending,changed,committed,pushed, andremote-verified; track local rows throughpending,snapshotted,changed,restore-failed, andlocal-verified. A local row'ssnapshottedstate includes the durable snapshot path, complete pre-change digest, and resolved target path.restore-failedis nonterminal; a terminalskippedorblockedrow always carries a concrete reason and must either be unchanged or have its pre-change digest restored. Interruption, context compaction, tool failure, or partial success never shrinks the manifest; resume from its first nonterminal row. - Fetch each candidate and inspect its current remote default branch. Use that authoritative tree to read complete relevant artifacts and enough nearby guidance to establish applicability and repository-specific behavior. Never let a stale, dirty, non-default, or detached local checkout exclude a repository or determine applicability.
- When the caller identifies or changes canonical artifacts, inspect every applicable repository before finalizing them. Never leave a reusable change only in the repository whose failure, screenshot, link, or checkout exposed the need. Fold repository-neutral consumer guidance into the canonical source and validate it first. Whenever a requested cross-repository change conflicts with a target repository's existing behavior, guidance, configuration, contract, or other relevant context, immediately pause the entire cross-repository operation. Present the exact target state and requested change, assess whether the target state is reusable as generic guidance, and use the platform's structured ask-question or input tool, when available, to ask whether to propagate the reusable guidance, leave the target unchanged, or choose another resolution. Recommend propagation when the target state is generic or can be expressed as useful generic guidance for other repositories; otherwise recommend removing the target-only state. If that tool is unavailable, times out, or returns no choice, ask the same question in chat and remain paused; never infer a resolution. Before the caller chooses, do not propagate any change to any repository or local installation, mutate or distribute the conflicting change, or commit, push, open or update pull requests, mark pull requests ready, merge, or otherwise advance any affected or unaffected repository row.
- Choose the task mode:
- For a read-only task, gather evidence from every applicable repository and merge it into one clearly attributed result.
- For a change or review-and-fix task, use an isolated worktree based on that repository's remote default branch. Leave original checkouts, branches, and unrelated dirty work untouched.
- For a caller-selected local-installation row, never create a missing installation. Confirm that the resolved target remains inside an exposed writable user-level skill root and is neither managed nor generated. Before changing canonical-managed files in place, create and verify a complete snapshot under
codex/coordination/<run-id>/local-installations/in the current repository's resolved common Git directory, then persist its real path and digest in the manifest. Never use an ephemeral temporary directory as the only recovery copy.
- Carry only user-authorized task artifacts into each isolated worktree or local installation. Never copy unrelated work, generated outputs, credentials, secrets, machine-specific configuration, or provider metadata such as
agents/openai.yaml. Do not automatically preserve, adapt, or remove a target's conflicting state; the explicit conflict decision in step 6 controls it. If the task manages generated files, resolve canonical sources first and use the owning generator rather than hand-editing generated outputs. - Validate every completed repository with its relevant native checks. When the complete diff is non-runtime — it does not change executable source, package or dependency definitions, tests, runtime configuration, CI workflows, generated runtime artifacts, or another executed-behavior contract — validate only the checks appropriate to its artifacts, exact contents, and
git diff --check; application tests and CI are irrelevant and must not be run or awaited. This is semantic rather than path-based: agent instructions, documentation, policies, static metadata, and non-executable configuration can live anywhere. When behavior changes, tests must exercise current functional outcomes through the normal interface. A test is invalid when its reason for existing depends on knowing the prior implementation or contract, even if it asserts only the replacement. Do not add rename, migration, compatibility, rejection, absence, source-text, AST, grep, count, or structural tests whose purpose is to distinguish the result from retired behavior. Update behavior-oriented tests to use the resulting contract and remove tests that exist only because something was replaced. A valid test must still make sense to a reader with no knowledge of what came before. - Before selecting a worktree or reusing a pull request, query the hosting service for the branch's current pull request and verify its state, branch, and task scope. Never infer active state from a local branch, remote-tracking branch, remembered URL, or prior output. Treat a merged, closed, missing, or branch-deleted pull request as absent: create a fresh isolated worktree and branch from the current remote default branch, then open a focused pull request. Reuse only a verified open pull request for the same active branch and task scope.
- Immediately before committing and again before pushing, fetch the current remote pull-request head and base with explicit refspecs, verify the fetched object IDs equal the hosting service's current head and base object IDs, and reconcile drift. Never assume a fetch updated a remote-tracking ref merely because it downloaded an object.
- Query current remote mergeability against the latest default-branch head. Treat
UNKNOWNor an equivalent pending state as nonterminal. When a pull request conflicts, merge its current fetched base into its current fetched head and resolve every file semantically. Preserve the authorized result and compatible newer base behavior; never select an entireoursortheirsside without inspecting both meanings. Regenerate owned outputs and lockfiles from resolved sources, remove every conflict marker, rungit diff --checkand native checks, commit and push the resolution, then re-query mergeability. Block only the affected row when safe resolution requires an unauthorized product or contract decision. - Write each commit from the receiving repository's perspective with generic, repository-independent wording. Never name an origin, destination, sibling, or comparison repository in another repository's commit history.
- After pushing changed repository rows and updating local rows, give an independent validation sub-agent the frozen manifest and exact expected and forbidden postconditions, including current mergeability and local-installation ownership. It must read every current remote pull-request head, or the current remote default branch when no open pull request exists, and every current local-installation path, returning every mismatch rather than samples. Reconcile mismatches and repeat the audit until every row is terminal. If a local mutation or verification fails, restore the complete installation from its recorded snapshot and verify the restored digest equals the pre-change digest before marking the row
blockedwith both paths and the failure evidence. A failed restore entersrestore-failed; it remains nonterminal, prevents overall completion, and must be retried or escalated until restoration succeeds. If a validation sub-agent is unavailable, perform the same full remote and local audit in a separate pass after discarding local assumptions. Immediately recheck remote head stability and local file digests after the audit. - Report every completed, skipped, or blocked repository and local installation; the applied or gathered result; validation; and a clickable Markdown link for every pull request created, updated, reviewed, or merged. Never substitute a count, repository name, pull-request number, or bare URL for a required link. Never report completion while any row is nonterminal, conflicting, mergeability-unknown, head-unstable, locally unverified, or otherwise unverified.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 11d ago First seen · 41 lines · 54 tokens per session scan A 547ba21e9705
coordinate-repositories is a skill published in the GitHub repository julien777z/agent-sync-action (5 stars, last pushed 4d ago), licensed MIT. It adds 54 tokens to every session and 2,273 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
mcore-split-pr
Split a PR into multiple PRs to reduce the number of required CODEOWNERS reviewer groups.
shiplog
Recap of everything shipped since the last run - cross-repo PRs, security fixes, star deltas, and X traction, synthesized into a digest article and a ready-to-post shiplog in your voice.
llxprt-issue-workflow
Use this skill when asked to address, fix, or work on a GitHub issue in the llxprt-code repository. Covers the complete issue lifecycle - branch setup, gh CLI usage, test-first planning, subagent delegation and review loops, the full verification cycle (including the stepfun-37 smoke test), open code review (ocr), PR…
cyrus-setup-repository
Add one or more Git repositories to Cyrus configuration so it can process issues from those repos.
github-sync
Bidirectional synchronization of epics and tasks with GitHub issues, labels, and relationships.
github-notification-triage
Triage GitHub notifications and issue/PR queues.