Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add laolaoshiren/claude-code-skills-zh --skill git-workflowgit clone --depth 1 https://github.com/laolaoshiren/claude-code-skills-zhWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/laolaoshiren/claude-code-skills-zh/git-workflow)<a href="https://agentmods.dev/skills/laolaoshiren/claude-code-skills-zh/git-workflow"><img src="https://agentmods.dev/badge/skills/laolaoshiren/claude-code-skills-zh/git-workflow/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/laolaoshiren/claude-code-skills-zh/git-workflow"><img src="https://agentmods.dev/badge/skills/laolaoshiren/claude-code-skills-zh/git-workflow.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 2 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Tool Misuse · line 99 Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).Fix: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults.
- high Tool Misuse · line 99 Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).Fix: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00073 | $0.01087 |
| Opus 5.5 | $0.00029 | $0.00435 |
| Sonnet 5.5 | $0.00015 | $0.00217 |
| Haiku 4.5 | $0.00007 | $0.00109 |
Grade A, and why
git-workflow scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
Git 工作流助手
核心原则
- 只执行用户明确要求的 Git 动作。生成提交信息不等于暂存或提交;提交不等于推送;创建 PR 不等于合并 PR、关闭 Issue 或发布 Release。
- 把工作树中已有、未跟踪和无关的修改视为用户资产,不覆盖、不回退、不混入本轮提交。
- 优先使用非交互命令。涉及历史重写、冲突选择或远程覆盖时降低自动化程度。
工作流程
1. 读取仓库规则与状态
先阅读适用的 AGENTS.md、CONTRIBUTING.md、README、提交规范和 CI 说明,再检查:
git status --short --branch
git diff
git diff --cached
git log --oneline -10
git remote -v
git branch -vv
同时识别未跟踪文件、当前分支、upstream、远程差异和已有失败。不得只看 staged diff。
2. 明确动作与文件范围
把用户请求拆成独立授权:
| 动作 | 默认权限 |
|---|---|
| 分析状态、生成 commit message 或 PR 文案 | 只读 |
| 暂存、commit | 仅用户要求后执行,只选本轮相关文件 |
| 创建或切换分支 | 仅用户明确要求时执行;实现流程需要但未获授权时,先说明原因并取得同意 |
| fetch、push、创建 PR | 分别确认在请求范围内,不互相推导 |
| merge、关闭 Issue、发布 Release | 必须有明确授权 |
| rebase、修改已发布历史、强制更新远程 | 高风险,必须明确授权并满足额外条件 |
存在无关改动时不得使用 git add . 或 git add -A。逐个暂存目标文件,并用 git diff --cached 复核。
3. 规划原子提交
- 根据真实 diff 判断
feat、fix、docs、refactor、test、perf或chore。 - 沿用仓库近期提交的语言、scope 和格式。
- 一个提交只表达一项可独立理解和验证的改动。
Closes #123仅在对应 Issue 确实应由该提交自动关闭时使用。
提交信息遵循:
<type>(<scope>): <简短描述>
<必要时说明原因、关键实现和兼容性>
<关联 Issue 或 Breaking Change>
4. 验证后执行
提交前先检查验证脚本是否会下载依赖、访问外部服务或产生其他状态,再运行与改动相关的测试、lint、构建或文档检查,并记录实际命令和退出状态。可能产生外部副作用时先取得授权。基线已有失败时单独说明,不能把未运行的项目标为通过。
执行 commit 后检查:
git status --short --branch
git show --stat --oneline HEAD
推送前先 git fetch,确认 upstream 没有未整合的新提交;禁止 force push。
5. 创建 PR
PR 文案应帮助 reviewer 结合 diff 和验证结果快速审查,至少包含:
## 变更摘要
## 关键改动
## 验证结果
## 风险与回滚
## 关联 Issue
只勾选真实完成的检查。截图、迁移说明和回滚步骤仅在适用时加入。
Rebase 与历史整理边界
- rebase 前要求工作树和暂存区都干净;未经授权不得自动 stash。
- 先 fetch 并确认目标基线,必要时在用户允许下创建本地备份引用。
- 不对公共分支或其他人依赖的已发布提交执行 rebase。
- 禁止
git push --force。确需更新用户明确授权重写的私有分支时,只能在重新确认远程状态后使用--force-with-lease。 - 遇到冲突时停止并报告冲突文件与可选方案,不猜测内容归属或擅自解决。
输出
用中文简要报告:
- 执行了哪些 Git 动作、影响哪些文件和分支。
- 实际运行的验证及结果。
- commit SHA、push 状态和 PR URL(若已执行)。
- 未执行、失败或仍需用户决定的事项。
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 110 lines · 73 tokens per session scan A 9e5f27001245
git-workflow is a skill published in the GitHub repository laolaoshiren/claude-code-skills-zh (893 stars, last pushed yesterday), licensed MIT. It adds 73 tokens to every session and 1,087 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
antigravity-maintainer-batch-release
Run protected AAS maintainer sweeps, PR merge batches, canonical sync, Core preview checks, and scripted releases. Use for repository maintenance, main alignment, CLI/MCP/Workbench changes, or release work; not ordinary contribution tasks.
github-comment-triage
Triage and address GitHub PR review comments systematically—classify, respond, fix or defer with rationale. Use when a PR has review feedback, requested changes, or unresolved threads.
dev-ship
Fechamento de feature — verificação goal-backward antes de declarar pronto. Roda Must-Haves do PLAN.md, executa o demo script, revisa o diff completo procurando bugs e restos (debug logs, TODOs, código morto), passa lente de segurança nos arquivos tocados, escreve SUMMARY.md e arquiva o plano. Use quando o usuário…
changelog-generator
Automatically creates user-facing changelogs from git commits by analyzing commit history, categorizing changes, and transforming technical commits into clear, customer-friendly release notes. Turns hours of manual changelog writing into minutes of automated generation.
changelog-from-commits
Generate a user-facing CHANGELOG entry from raw git log output. Use when the user is preparing a release, says "what changed since last version", asks to write release notes, or wants to summarize a batch of commits for end users.
aider-delegate
Delegate coding tasks to Aider (aider) only when the user explicitly requests it, while the orchestrator retains review and landing responsibility.