Borrowing it
Nothing to install: this file belongs to nikzlabs/shipit. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/nikzlabs/shipit/main/.agents/skills/git-architecture/SKILL.mdgit clone --depth 1 https://github.com/nikzlabs/shipitWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/nikzlabs/shipit/git-architecture)<a href="https://agentmods.dev/skills/nikzlabs/shipit/git-architecture"><img src="https://agentmods.dev/badge/skills/nikzlabs/shipit/git-architecture/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/nikzlabs/shipit/git-architecture"><img src="https://agentmods.dev/badge/skills/nikzlabs/shipit/git-architecture.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00063 | $0.02224 |
| Opus 5.5 | $0.00025 | $0.00890 |
| Sonnet 5.5 | $0.00013 | $0.00445 |
| Haiku 4.5 | $0.00006 | $0.00222 |
Grade C, and why
git-architecture scanned grade C with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Reaches for credential fileshighPrivilege escalation
SSH keys, cloud credentials, git-credentials, .npmrc, /etc/shadow: reading these is how a config file becomes a credential leak.
- **`shipit-credentials.json`** — `CredentialStore` (`credential-store.ts`). Holds `githubToken`, `agentEnv`, provider-account metadata, and app settings as *fields in one JSON file*, encrypted when a cipher is supplied. How it starts
The opening of the file, as written. The whole thing — 168 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Git Architecture
ShipIt uses git for version control at two levels: per-session workspace repos managed by GitManager, and a shared per-remote bare cache (from which each session gets its own independent local clone) managed by RepoGit. Both use the simple-git library.
Each session gets its own independent full clone —
git clone --localfrom the bare cache, which hardlinks objects so the clone is fast and disk-cheap. Each session owns a complete.git/and shares nothing mutable with its siblings.
Two Git Layers
GitManager (per-session)
src/server/shared/git.ts — operates on a single session's workspace directory.
Each session gets its own GitManager instance via the createGitManager(dir) factory. Used for:
init()— initialize repo with initial commit (so rollback always has a base)autoCommit(summary)— stage all + commit if anything changedlog(maxCount)— commit historyrollback(hash)— hard reset to a previous commitpush(remote, branch)— push with upstream trackingpull(remote, branch)— pull from remoteaddRemote(name, url)/getRemotes()— remote managementcheckoutNewBranch(name)/renameBranch(old, new)— branch operationsdiffSummary()— per-file diff stats for the working treediffStatVsBranch(baseBranch)— insertions/deletions vs a base branch (for PR stats)getFileAtCommit(hash, filePath)— file content at a specific commitdiffNameStatus(from, to)— changed files with status between commitsmerge(branchName)— merge with conflict detection
RepoGit (bare cache)
src/server/orchestrator/repo-git.ts — operates on a per-remote bare cache directory (one bare clone per remote URL, at {stateDir}/repo-cache/{hash}).
Used by the orchestrator to seed and refresh the cache, then cut per-session clones from it:
cloneBare(url)— bare-clone the remote into the cache dir (git clone --bare)fetchCache(ttlMs?)— fetch the remote into the bare cache (advances localrefs/heads/*); TTL-throttledcloneFromCache(sessionDir, remoteUrl?)— create a session's clone:git clone --localfrom the cache (hardlinked objects), setgc.auto=0, then resetoriginto the real remote URLgetDefaultBranch(remote)— detect main/master (tries local refs first to avoid network calls)deleteBranch(name)— delete local branchisEmpty()/createInitialCommit()— empty-repo handlingreadHead()/lastFetchAgeMs()— cache freshness checks used by the proactive pre-fetcher
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago Changed · -4 lines ae934ccc4eb6
- 1mo ago First seen · 172 lines · 63 tokens per session scan C 4d9eda76cdeb
git-architecture is a skill published in the GitHub repository nikzlabs/shipit (9 stars, last pushed today), licensed Apache-2.0. It adds 63 tokens to every session and 2,224 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it C with 1 finding (reaches for credential files). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
github-lanes-bridge
Use when bridging GitHub and Lanes — importing GitHub issues into Lanes for local Claude Code execution, batch-spawning sessions per ticket, decomposing one GitHub issue into multiple Lanes sub-issues with dependencies, or posting session results (PR links, comments, follow-up issues) back to GitHub. Triggers on…
project-session-manager
Worktree-first dev environment manager for issues, PRs, and features with optional tmux sessions.
pr
Draft a PR body from OMC's paper trail — the smallest visual that proves the change, evidence consumed from the verify protocol (never re-collected), reversibility from the ADR test on the diff, glossary language throughout.
security-ownership-map
Analyze git repositories to build a security ownership topology (people-to-file), compute bus factor and sensitive-code ownership, and export CSV/JSON for graph databases and visualization. Trigger only when the user explicitly wants a security-oriented ownership or bus-factor analysis grounded in git history (for…
moai-workflow-worktree
Git worktree management for parallel SPEC development with isolated workspaces, automatic branch registration, and seamless MoAI-ADK integration. Use when setting up parallel development environments.
blueprint-repo-baseline
Find the repository's own gates — install, format check, lint, typecheck, build, test — record them, and prove they all pass before anything is touched.