Borrowing it
Nothing to install: this file belongs to Koroqe/OPOS. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/Koroqe/OPOS/main/.claude/skills/sync-from-core/SKILL.mdgit clone --depth 1 https://github.com/Koroqe/OPOSWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/koroqe/opos/sync-from-core)<a href="https://agentmods.dev/skills/koroqe/opos/sync-from-core"><img src="https://agentmods.dev/badge/skills/koroqe/opos/sync-from-core/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/koroqe/opos/sync-from-core"><img src="https://agentmods.dev/badge/skills/koroqe/opos/sync-from-core.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00026 | $0.02515 |
| Opus 5.5 | $0.00010 | $0.01006 |
| Sonnet 5.5 | $0.00005 | $0.00503 |
| Haiku 4.5 | $0.00003 | $0.00251 |
Grade C, and why
sync-from-core scanned grade C with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 27d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Recursive force deletehighDestructive command
rm -rf with a variable or a broad path is one typo away from removing the wrong tree.
wsl -- bash -lc 'rm -rf ~/opos-sync && git clone -q /mnt/<drive>/<path-to-repo> ~/opos-sync && cd ~/opos-sync \ How it starts
The opening of the file, as written. The whole thing — 101 lines — stays where its author put it; the contents beside it link to each section on GitHub.
sync-from-core
When to use
Manually, after check-for-updates reports a new version is available. Or unconditionally to pull the latest upstream changes.
Run it in a subagent, never in the interactive main thread (v0.21.0). A sync reads and diffs many files; done inline, all of that output stays in the conversation, and every later request re-reads it. Measured at a consumer: a sync run inside a 450k–900k-token session was the bulk of the 183M tokens its usage dashboard attributed to check-for-updates. Routine releases are applied by the daily SessionStart updater (opos-session-update.mjs), so a manual sync should be rare. When one is needed, apply every pending release in one run, not one run per release.
Inputs
target_version(optional; default: latest non-prerelease release tag from upstream).branch(optional; default:opos-update-<tag>).check_only(optional bool; default false): if true, runscopier update --dry-runand prints the diff without creating a branch or modifying files. Useful for previewing changes.
Steps
- Resolve repo root via
git rev-parse --show-toplevel. Ensure the working tree is clean (git status --porcelainreturns empty). If not: ABORT with instruction to commit or stash first. Do NOT proceed with a dirty tree —copier updatewould mix consumer's in-progress edits with upstream changes. - Read
<repo-root>/.copier-answers.yml. Extract_src_path. Classify it with the same four-shape logic ascheck-for-updatesstep 4 (remote GitHub →<owner>/<repo>; existing local clone → warn "local path, non-portable" and resolve tags viagit -C <path> tag; missing local path or unparseable → ABORT with:_src_path '<value>' cannot be used for updates on this machine. Edit .copier-answers.yml and set _src_path to gh:<owner>/<repo> (leave _commit untouched), commit, and re-run.). If.copier-answers.ymlis missing: ABORT with instruction to scaffold viacopier copyfirst (this skill cannot bootstrap a repo). - Resolve
target_version:- If
--target_versionpassed: use it. - Else (remote shape):
gh api repos/<owner>/<repo>/releases --jq '[.[] | select(.prerelease == false)] | first | .tag_name'(no leading slash — MSYS/Git-Bash path-mangling on Windows). Local-clone shape:git -C <path> tag --sort=-v:refname | grep -v -- '-' | head -1.
- If
- If
--check_onlyis true (v0.8.1 rewrite — Copier has no--dry-run, and--pretendis ignored bycopier update's patch-apply step, so a real preview needs a throw-away branch):git checkout -b opos-preview-<tag>→copier update --vcs-ref <tag> --defaults --conflict rej→ printgit status --porcelain(flag.rejfiles) andgit diff --stat→git reset --hard && git clean -fd→git checkout -→git branch -D opos-preview-<tag>. Nothing is committed and the tree is left exactly as found. Skip steps 5–9. - Create the update branch:
git checkout -b <branch>(defaultopos-update-<tag>). 5b. Record the current pin asOLD_PIN(_commitin.copier-answers.yml) — step 6c needs it.
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 27d ago Changed · +12 lines scan A → C 654dcd891563
- 28d ago Changed · +15 lines b812a4741384
- 1mo ago Changed · +12 lines 77da975888ee
- 1mo ago First seen · 62 lines · 26 tokens per session scan A 7e1abc3d0bfb
sync-from-core is a skill published in the GitHub repository Koroqe/OPOS (4 stars, last pushed today), licensed MIT. It adds 26 tokens to every session and 2,515 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it C with 1 finding (recursive force delete). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
pr-to-video
Turn a GitHub pull request (a PR URL, owner/repo#N, or 'this PR' in a checked-out repo) into a code-change explainer video — changelog, feature reveal, fix, or refactor walkthrough built from the diff, commits, and files: the input is a code change, not a website. Not a product promo (/product-launch-video) or a no-PR…
om-auto-implement-spec
Everything tracker-facing uses the operations and guards from .ai/trackers/github.md. Resolve an automatic base branch through default-branch; never assume main or develop.
git-worktree-swarm
Automates the complex setup of parallel git worktrees for agentic swarms with dependency-aware wave execution.
Release Notes Generator
Generate professional software release notes from a commit log: classify changes, write user-facing summaries, draft a publishable announcement, and assess release readiness. Use for release, changelog, version, and deploy requests.
pinned-release-checklist
Minimal guidance-only Skill used by release-pinned compatibility examples.
Release Readiness Reviewer
Reviews a release candidate and produces a go/no-go readiness decision.