Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add laolaoshiren/claude-code-skills-zh --skill git-workflowgit clone --depth 1 https://github.com/laolaoshiren/claude-code-skills-zhWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/laolaoshiren/claude-code-skills-zh/git-workflow)<a href="https://agentmods.dev/skills/laolaoshiren/claude-code-skills-zh/git-workflow"><img src="https://agentmods.dev/badge/skills/laolaoshiren/claude-code-skills-zh/git-workflow.svg" alt="Measured on agentmods" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 2 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Tool Misuse · line 99 Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).Fix: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults.
- high Tool Misuse · line 99 Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).Fix: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00073 | $0.01087 |
| Opus 5 | $0.00036 | $0.00544 |
| Sonnet 5 | $0.00015 | $0.00217 |
| Haiku 4.5 | $0.00007 | $0.00109 |
Grade A, and why
git-workflow scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
Git 工作流助手
核心原则
- 只执行用户明确要求的 Git 动作。生成提交信息不等于暂存或提交;提交不等于推送;创建 PR 不等于合并 PR、关闭 Issue 或发布 Release。
- 把工作树中已有、未跟踪和无关的修改视为用户资产,不覆盖、不回退、不混入本轮提交。
- 优先使用非交互命令。涉及历史重写、冲突选择或远程覆盖时降低自动化程度。
工作流程
1. 读取仓库规则与状态
先阅读适用的 AGENTS.md、CONTRIBUTING.md、README、提交规范和 CI 说明,再检查:
git status --short --branch
git diff
git diff --cached
git log --oneline -10
git remote -v
git branch -vv
同时识别未跟踪文件、当前分支、upstream、远程差异和已有失败。不得只看 staged diff。
2. 明确动作与文件范围
把用户请求拆成独立授权:
| 动作 | 默认权限 |
|---|---|
| 分析状态、生成 commit message 或 PR 文案 | 只读 |
| 暂存、commit | 仅用户要求后执行,只选本轮相关文件 |
| 创建或切换分支 | 仅用户明确要求时执行;实现流程需要但未获授权时,先说明原因并取得同意 |
| fetch、push、创建 PR | 分别确认在请求范围内,不互相推导 |
| merge、关闭 Issue、发布 Release | 必须有明确授权 |
| rebase、修改已发布历史、强制更新远程 | 高风险,必须明确授权并满足额外条件 |
存在无关改动时不得使用 git add . 或 git add -A。逐个暂存目标文件,并用 git diff --cached 复核。
3. 规划原子提交
- 根据真实 diff 判断
feat、fix、docs、refactor、test、perf或chore。 - 沿用仓库近期提交的语言、scope 和格式。
- 一个提交只表达一项可独立理解和验证的改动。
Closes #123仅在对应 Issue 确实应由该提交自动关闭时使用。
提交信息遵循:
<type>(<scope>): <简短描述>
<必要时说明原因、关键实现和兼容性>
<关联 Issue 或 Breaking Change>
4. 验证后执行
提交前先检查验证脚本是否会下载依赖、访问外部服务或产生其他状态,再运行与改动相关的测试、lint、构建或文档检查,并记录实际命令和退出状态。可能产生外部副作用时先取得授权。基线已有失败时单独说明,不能把未运行的项目标为通过。
执行 commit 后检查:
git status --short --branch
git show --stat --oneline HEAD
推送前先 git fetch,确认 upstream 没有未整合的新提交;禁止 force push。
5. 创建 PR
PR 文案应帮助 reviewer 结合 diff 和验证结果快速审查,至少包含:
## 变更摘要
## 关键改动
## 验证结果
## 风险与回滚
## 关联 Issue
只勾选真实完成的检查。截图、迁移说明和回滚步骤仅在适用时加入。
Rebase 与历史整理边界
- rebase 前要求工作树和暂存区都干净;未经授权不得自动 stash。
- 先 fetch 并确认目标基线,必要时在用户允许下创建本地备份引用。
- 不对公共分支或其他人依赖的已发布提交执行 rebase。
- 禁止
git push --force。确需更新用户明确授权重写的私有分支时,只能在重新确认远程状态后使用--force-with-lease。 - 遇到冲突时停止并报告冲突文件与可选方案,不猜测内容归属或擅自解决。
输出
用中文简要报告:
- 执行了哪些 Git 动作、影响哪些文件和分支。
- 实际运行的验证及结果。
- commit SHA、push 状态和 PR URL(若已执行)。
- 未执行、失败或仍需用户决定的事项。
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 110 lines · 73 tokens per session scan A 9e5f27001245
git-workflow is a skill published in the GitHub repository laolaoshiren/claude-code-skills-zh (823 stars, last pushed yesterday), licensed MIT. It adds 73 tokens to every session and 1,087 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
changelog-from-commits
Generate a user-facing CHANGELOG entry from raw git log output. Use when the user is preparing a release, says "what changed since last version", asks to write release notes, or wants to summarize a batch of commits for end users.
resolve-pr-comments
Evaluate, fix, answer, and reply to GitHub pull request review comments and conversation comments. Handles both change requests (fix or skip) and reviewer questions (explain using reasoning recalled from past Claude Code transcripts). Use when the user asks to "resolve PR comments", "fix review comments", "address PR…
create-pr
Create a GitHub pull request with a drafted title and description. Use when the user asks to "create a PR", "create a pull request", "open a PR", or "submit a PR".
update-pr
Update an existing GitHub pull request's title and description to reflect the current state of the branch. Use when the user asks to "update the PR", "update PR description", "update PR title", "refresh PR description", or "sync PR with changes".
changelog-rules
Shared changelog conventions and formatting rules referenced by /create-changelog and /update-changelog. Not typically invoked directly.
ship
Commit, push, and optionally create or update a PR for the current staged changes. Use when the user asks to "ship", "ship it", "ship changes", "commit push and PR", or "ship this".