Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add KhaledSaeed18/dotclaude --skill gitignoregit clone --depth 1 https://github.com/KhaledSaeed18/dotclaudeWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/khaledsaeed18/dotclaude/gitignore)<a href="https://agentmods.dev/skills/khaledsaeed18/dotclaude/gitignore"><img src="https://agentmods.dev/badge/skills/khaledsaeed18/dotclaude/gitignore/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/khaledsaeed18/dotclaude/gitignore"><img src="https://agentmods.dev/badge/skills/khaledsaeed18/dotclaude/gitignore.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00061 | $0.01420 |
| Opus 5.5 | $0.00024 | $0.00568 |
| Sonnet 5.5 | $0.00012 | $0.00284 |
| Haiku 4.5 | $0.00006 | $0.00142 |
Grade A, and why
gitignore scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 71 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Produce a .gitignore that fits this repo (driven by the stacks actually present, not a generic blob) and fix the common failure where a pattern is added but the file is already tracked, so Git keeps it anyway.
Hard rules: never break these
- Never ignore source. Ignore dependencies, build output, caches, logs, secrets, and local cruft, never the code or config the project needs to build.
- Adding a pattern does not untrack a tracked file.
.gitignoreonly affects untracked files. Already-committed files needgit rm --cached(Step 5) to stop being tracked. - Preserve existing intent. Don't wipe a hand-tuned
.gitignore; merge, dedupe, and organize. Keep custom and negation (!) rules unless they're clearly wrong. - Treat tracked secrets as an incident. A committed
.env, key, or credential is already in history; adding it to.gitignoreandrm --cachedstops future tracking but does not remove it from past commits. Flag it loudly and point to history-rewrite tooling (git filter-repo, BFG) and secret rotation. - Confirm before
git rm --cached. It changes what's tracked and lands in the next commit.
Step 1: Detect the stacks
Scan the repo for what's actually in use rather than guessing:
- Manifests → ecosystem:
package.json(Node),Cargo.toml(Rust),pyproject.toml/requirements.txt/Pipfile(Python),go.mod(Go),pom.xml/build.gradle(Java/Kotlin),Gemfile(Ruby),composer.json(PHP),*.csproj/*.sln(.NET),pubspec.yaml(Dart/Flutter),mix.exs(Elixir). - Frameworks (they add their own build/cache dirs): Next.js (
.next/), Nuxt (.nuxt/), Astro, SvelteKit, Vite (dist/), Angular, Django (*.sqlite3,staticfiles/), Rails, Terraform (.terraform/), etc. - OS files: macOS (
.DS_Store), Windows (Thumbs.db,Desktop.ini), Linux (*~). - Editors/IDEs:
.vscode/,.idea/,*.swp,.fleet/; these typically belong in a global gitignore, but include locally if the team standardizes there. - Tooling: test coverage (
coverage/,.nyc_output/), env files (.env*), local caches (.cache/,.turbo/,__pycache__/).
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 71 lines · 61 tokens per session scan A 31c01b91da87
gitignore is a skill published in the GitHub repository KhaledSaeed18/dotclaude (5 stars, last pushed yesterday), licensed MIT. It adds 61 tokens to every session and 1,420 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
publish
Publish oh-my-opencode to npm by triggering the GitHub Actions publish workflow and verifying its artifacts. Ship-only: never runs pre-publish-review or re-reviews merged code unless the user explicitly asks. Argument: . Triggers: publish, release, deploy, npm publish.
pre-publish-review
Nuclear-grade 12-agent pre-publish release gate. Runs /get-unpublished-changes to detect all changes since last npm release, spawns up to 10 ultrabrain agents for deep per-change analysis, invokes /review-work (orchestrator manual QA plus one gate reviewer) for holistic review, and 1 oracle for overall release…
work-with-pr
Full PR lifecycle in a fresh task-owned git worktree: implement via the ulw-loop skill with mandatory evidence-bound manual QA → reviewer-readable English PR → verification loop (CI + Cubic, where Cubic is skipped only when its quota is exhausted) → merge by default → worktree cleanup. Decomposes one task into the…
lcx-contribute-bug-fix
Contribute a verified bug fix for LazyCodex, lazycodex-ai, omo-codex, bundled Codex skills, or upstream Codex CLI bugs. Opens a fork PR only for upstream openai/codex; LazyCodex-owned defects become a verified-fix issue on code-yeongyu/lazycodex (never a PR — that repo is a generated distribution mirror). Use when the…
git-master
MUST USE for ANY git operations: atomic commits, rebase/squash/fixup, and history search (blame, bisect, log -S, reflog). Load it before running git yourself, or pass loadskills=['git-master'] to the task that commits. Triggers: 'commit', 'rebase', 'squash', 'who wrote', 'when was X added', 'find the commit that'.
oss-contribution-research
Research and prepare an outside contribution to an open-source repo, then stop at a queue item for a human to approve: policy check, intake, duplicate check, reproduction, patch, the repo's own checks, an independent critic rerun, and a disclosed, hashed draft of the exact text to post. Use this skill whenever the…