Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/koroqe/opos/sync-from-corenpx skills add Koroqe/OPOS --skill sync-from-coregit clone --depth 1 https://github.com/Koroqe/OPOSWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/koroqe/opos/sync-from-core)<a href="https://agentmods.dev/skills/koroqe/opos/sync-from-core"><img src="https://agentmods.dev/badge/skills/koroqe/opos/sync-from-core.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00026 | $0.01752 |
| Opus 5 | $0.00013 | $0.00876 |
| Sonnet 5 | $0.00005 | $0.00350 |
| Haiku 4.5 | $0.00003 | $0.00175 |
Grade A, and why
sync-from-core scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 74 lines — stays where its author put it; the contents beside it link to each section on GitHub.
sync-from-core
When to use
Manually, after check-for-updates reports a new version is available. Or unconditionally to pull the latest upstream changes.
Inputs
target_version(optional; default: latest non-prerelease release tag from upstream).branch(optional; default:opos-update-<tag>).check_only(optional bool; default false): if true, runscopier update --dry-runand prints the diff without creating a branch or modifying files. Useful for previewing changes.
Steps
- Resolve repo root via
git rev-parse --show-toplevel. Ensure the working tree is clean (git status --porcelainreturns empty). If not: ABORT with instruction to commit or stash first. Do NOT proceed with a dirty tree —copier updatewould mix consumer's in-progress edits with upstream changes. - Read
<repo-root>/.copier-answers.yml. Extract_src_path. Classify it with the same four-shape logic ascheck-for-updatesstep 4 (remote GitHub →<owner>/<repo>; existing local clone → warn "local path, non-portable" and resolve tags viagit -C <path> tag; missing local path or unparseable → ABORT with:_src_path '<value>' cannot be used for updates on this machine. Edit .copier-answers.yml and set _src_path to gh:<owner>/<repo> (leave _commit untouched), commit, and re-run.). If.copier-answers.ymlis missing: ABORT with instruction to scaffold viacopier copyfirst (this skill cannot bootstrap a repo). - Resolve
target_version:- If
--target_versionpassed: use it. - Else (remote shape):
gh api repos/<owner>/<repo>/releases --jq '[.[] | select(.prerelease == false)] | first | .tag_name'(no leading slash — MSYS/Git-Bash path-mangling on Windows). Local-clone shape:git -C <path> tag --sort=-v:refname | grep -v -- '-' | head -1.
- If
- If
--check_onlyis true (v0.8.1 rewrite — Copier has no--dry-run, and--pretendis ignored bycopier update's patch-apply step, so a real preview needs a throw-away branch):git checkout -b opos-preview-<tag>→copier update --vcs-ref <tag> --defaults --conflict rej→ printgit status --porcelain(flag.rejfiles) andgit diff --stat→git reset --hard && git clean -fd→git checkout -→git branch -D opos-preview-<tag>. Nothing is committed and the tree is left exactly as found. Skip steps 5–9. - Create the update branch:
git checkout -b <branch>(defaultopos-update-<tag>). - Run
copier update --vcs-ref <tag> --conflict rej --defaults. The--defaultsflag is safe becausecopier.yml's only question (COMPANY_NAME) was answered at initial scaffold and persists in.copier-answers.yml; updates reuse the stored answer without re-prompting.--trustis NOT used today becausecopier.ymlhas no_tasksor_migrations. If future versions add tasks, add--trustin all THREE sync drivers: here, theauto-syncskill, and the Actions workflow (.github/workflows/sync-opos.yml). 6b. Reconcile consumer-owned settings (the_skip_if_existsdelivery hole).copier updatecannot touch.claude/settings.json— it is_skip_if_exists, so every framework settings change is otherwise undeliverable to an existing consumer, permanently. Runpython3 shared/scripts/reconcile-settings.py --applyfrom the repo root. It applies only whatshared/templates/required-settings.json(CORE, and therefore freshly updated by step 6) declares:managedkeys are set to the framework value,additivekeys are added only when absent so a consumer's own value always wins. Anything underpermissionsis never written — never-automate invariant 1 — the script reports such gaps instead, and they are applied only on a Confirm-tier approval from the user. Include the script's change lines verbatim in the step-8 summary so the user reviews them alongside the file diff. A non-zero exit other than 2 (unparseable settings.json) is surfaced, not swallowed: the script refuses to rewrite a file it cannot parse.
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday Changed · +12 lines 77da975888ee
- 5d ago First seen · 62 lines · 26 tokens per session scan A 7e1abc3d0bfb
sync-from-core is a skill published in the GitHub repository Koroqe/OPOS (2 stars, last pushed 3d ago), licensed MIT. It adds 26 tokens to every session and 1,752 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
super-evolve
Ultimate self-evolution skill. Merges evolve + self-improve into one comprehensive meta-skill with external research, area focus, dry-run mode, and expanded memory mining.
pr-to-video
Turn a GitHub pull request (a PR URL, owner/repo#N, or 'this PR' in a checked-out repo) into a code-change explainer video — changelog, feature reveal, fix, or refactor walkthrough built from the diff, commits, and files: the input is a code change, not a website. Not a product promo (/product-launch-video) or a no-PR…
general-video
Author or edit a custom HyperFrames composition when no specialized workflow fits, or when BRIEF.md sets flow: companion. Use for longer or multi-scene pieces, brand and sizzle reels, montages, static loops, static title cards, footage remixes, and freeform builds. Use motion-graphics instead for a short unnarrated…
motion-graphics
A short, design-led motion graphic where motion is the message — kinetic typography, stat count-up, chart/data-viz hit, logo sting / brand lockup, lower-third / callout / social overlay, animated map (highlight regions, connect places, zoom to a location), animated tweet / news-article / headline, webpage / UI…
implementation-final-review
Perform the repository's risk-tiered independent final review before implementation completion. Use only when explicitly invoked or when repository instructions require it after behavior-impacting implementation work; audit the complete task diff, supported contracts, lifecycle and security boundaries, complexity, and…
torchforge-rl-training
Provides guidance for PyTorch-native agentic RL using torchforge, Meta's library separating infra from algorithms. Use when you want clean RL abstractions, easy algorithm experimentation, or scalable training with Monarch and TorchTitan.