Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add martin1847/evolab --skill repo-governance-bootstrapgit clone --depth 1 https://github.com/martin1847/evolabWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/martin1847/evolab/repo-governance-bootstrap)<a href="https://agentmods.dev/skills/martin1847/evolab/repo-governance-bootstrap"><img src="https://agentmods.dev/badge/skills/martin1847/evolab/repo-governance-bootstrap/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/martin1847/evolab/repo-governance-bootstrap"><img src="https://agentmods.dev/badge/skills/martin1847/evolab/repo-governance-bootstrap.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00056 | $0.04868 |
| Opus 5 | $0.00028 | $0.02434 |
| Sonnet 5 | $0.00011 | $0.00974 |
| Haiku 4.5 | $0.00006 | $0.00487 |
Grade B, and why
repo-governance-bootstrap scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks for rootmediumPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
10. **生成 `ACCESS.local.md` + 值文件孪生 `ACCESS.local.env` 并写进 `.gitignore`**：按 `references/templates.md` 的 ACCESS.local 模板建三段式骨架（值/元数据物理分离：`.md` 只留元数据+秘密名字+gotcha，值进纯 KEY=VALUE 的 `.env` 孪生并 `chmod 600`；注入 `set -a; source; se How it starts
The opening of the file, as written. The whole thing — 211 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Repo Governance Bootstrap
何时调用
用户说出以下任一：
- "初始化文档治理 / 项目治理 / repo governance"
- "建立 ADR / roadmap / 文档骨架"
- "新仓库接入 AI 协作"
- "整理混乱的 docs 目录"
跳过条件：仓库已有 docs/INDEX.md 和 docs/ACTIVE_CONTEXT.md → 提演化方案、不重新初始化；绝不覆盖既有治理文件。
FOR
- 新仓库初始化
- 引入 AI coding workflow
- 重构混乱 docs 结构
- 建立长期演化管理
NOT FOR
- 重型流程管理 / Jira / RFC 工作流
- 复杂审批体系
- 外部 wiki 替代 Git
- 创建
future_plan.md/ideas.md/ generic TODO dump
目标结构（最小）
docs/
├── INDEX.md
├── ACTIVE_CONTEXT.md # 当前焦点 / hot context
├── NORTH_STAR.md # 可选：长期架构方向（伞仓或有明确长期方向的仓）
├── decisions/
│ └── ADR-0001-<slug>.md # 仓库边界（ADR 编号固定 4 位）
├── modules/
│ └── <module>.md # 每个核心模块一个 flat 文件
└── roadmap/
├── README.md # status-bucket 索引（Active / Deferred / Obsolete）
├── active-roadmap.md # 单文件，inline Status
├── deferred/
│ └── README.md # deferred 索引（Items 表 + Entry Criteria + Promotion Rule）
└── obsolete/
└── README.md # obsolete 索引（仅索引，少用）
AGENTS.md # repo 治理规则（Codex 读）
CLAUDE.md # 一行：@AGENTS.md（Claude 读）
scripts/engineering-gate.sh # 后端 repo-owned fix/check/test 稳定接口（有代码 marker 时）
scripts/engineering-gate.conf # 初始化时固化 profile + module root，不在每次运行时猜
.githooks/pre-commit # docs-check → engineering check → local test
ACCESS.local.md / .env # gitignored — 元数据+名字+gotcha / 值(KEY=VALUE, 600)
治理系统观（对抗熵增：每个产物一个寿命层、一种更新纪律、一道防腐门）
定位分工：本 skill = 结构层（一次性生成骨架 + 写入纪律 + 机检门）；循环层的防腐 （收口三同步 / 复盘 / 教训分层沉淀）由编排 skill 承担（
cto-orchestration§5 +orchestrator-core铁律九），其项目宪法拷贝即本 skill 生成的 AGENTS.md §6。腐烂是 workflow 问题——没有门校验， 任何结构都会漂；快照类整篇重写、知识类逐条增改、决策类只增不删，三种纪律别互串。
| 产物 | 寿命层 | 更新纪律 | 防腐机制 |
|---|---|---|---|
AGENTS.md 宪法 |
慢·治理变量 | 逐行准入："删了这行 agent 会犯错吗？"不会 → 删；代码能推出的不写 | 尺寸门 <200 行（超长被降权）/ 32KiB（超限被 harness 静默截断） |
| ADR | 只增·决策史 | 不可变；翻案标 superseded by、不删；1-2 页对未来开发者说全句 |
4 态状态机；组件 ADR 带 Owner/Sunset/Review-by |
| module FOR/NOT FOR | 慢·边界 | 随触及它的代码同一 commit 更新 | 边界冲突显式上报（宪法 §3） |
| roadmap | 中·映射层 | 只映射外部任务 SoT、不复制状态（任务状态是高频信息，天然不属于常驻 docs；两套账本必烂一套） | 三桶 + 6 态词汇；沿用外部 ID |
ACTIVE_CONTEXT |
快·快照 | 收口整篇重写 ~60 行，快照非日志（当日志 append 会冻结腐烂） | freshness 门 + 收口三同步（宪法 §6） |
ACCESS.local |
本机·含密 | 写时脱敏；gitignored 永不提交 | gitignore + 提交前 redaction sweep |
INDEX |
慢·traffic cop | 只放链接——超过一行说明的内容 = 放错了地方 | 死链门 |
NORTH_STAR（可选） |
最慢·方向 | 仅 maintainer 修订、semver 版本化（细则在模板注）；ADR 记历史、它记方向 | 原则带稳定 NS-ID 被评审 brief/门禁引用（没人检查的原则是注释）；与 accepted ADR 冲突不择边、升级 maintainer |
governance/ GOV 正典（可选·演化项） |
慢·活规则书 | 每域一份 GOV-NNN-<slug>.md、随实证增订原篇（日期戳节）。域路由按更新契约判，不按主题：会原地演进的现行可执行规则 → GOV；只被 supersede 的定格裁决与理由 → ADR；冻结证据快照 → audit；在飞协调物 → orchestration；混合体拆开各归其主、互挂指针 |
docs/governance/INDEX.md 持域登记表 + 路由判据句 + 维护协议（新域先查表——已有域增订原篇、无域才立新号）；根 docs/INDEX.md 只挂一行链接（traffic-cop 契约不变）；goal/评审 brief 与门禁的 Read 指针在 GOV 持有该现行规则时指 GOV，否则指实际 owner |
What ships with it
12 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- hooks.json 592 B
- references/docs-check.sh 4.2 KB runs code
- references/engineering-gate.conf.example 361 B
- references/engineering-gate.sh 6.8 KB runs code
- references/hook-wiring.md 2.4 KB
- references/memory-discipline-hook.py 2.7 KB runs code
- references/memory-discipline-hook.ts 1.5 KB runs code
- references/PR_SELF_CHECK.skeleton.md 826 B
- references/pre-commit.sh 1.4 KB runs code
- references/pre-push.template 3.5 KB
- references/PROJECT_AGENT.md 8.2 KB
- references/templates.md 14 KB
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- yesterday Changed a6b4f908f4d0
- 5d ago Changed 13c398ad6cef
- 11d ago First seen · 211 lines · 56 tokens per session scan B 04606085decd
repo-governance-bootstrap is a skill published in the GitHub repository martin1847/evolab (6 stars, last pushed yesterday), licensed MIT. It adds 56 tokens to every session and 4,868 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it B with 1 finding (asks for root). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
issue-triage
Triage and categorize GitHub issues with priority labels. Use when user says "triage issues", "check issues", "review open issues", or during regular maintenance of GitHub issue backlog.
ln-51-opportunity-evaluator
Evaluates new product opportunities using demand, channels, competition, and economics. Not for committed-backlog or implementation planning.
design-inventory
Use to run the Claude Design to ClosedLoop pipeline against the current web-ui. Stage A inventories a design export zip into schema-validated findings (typed design units - screens, regions like nav bars, standalone components like a chat dialog; UX and behavioral changes; Storybook component reuse mapping; token…
prd-creator
This skill helps PMs draft lightweight PRDs. It should be used when a PM wants to define a new feature, brainstorm requirements, or prep for sprint planning. Triggers include "I have a feature idea", "help me write a PRD", "let's break this into stories", or "what do I need for sprint planning". Optimized for speed …
upload-artifact
Upload a file as a ClosedLoop document (PRD, implementation plan, feature, or template). Reads file content and uploads via MCP without consuming conversation context. Also supports creating new versions of existing documents. Triggers on: "upload artifact", "upload PRD", "upload implementation plan", "upload…
cross-repo-cache
Check if cross-repo coordinator results can be reused, avoiding redundant Sonnet agent launches. Compares peer repo git hashes against stored hashes from last coordinator run. Triggers on: entering Phase 1.4.1, checking cross-repo cache, before discovering peers. Returns CROSSREPOCACHEHIT with cached status or…