Getting it into your agent
It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.
git clone --depth 1 https://github.com/ooooooooooooooooooop/agent-toolsnpx agentmods add skills/ooooooooooooooooooop/agent-tools/skill-repository-maintainerWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/ooooooooooooooooooop/agent-tools/skill-repository-maintainer)<a href="https://agentmods.dev/skills/ooooooooooooooooooop/agent-tools/skill-repository-maintainer"><img src="https://agentmods.dev/badge/skills/ooooooooooooooooooop/agent-tools/skill-repository-maintainer.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00084 | $0.00635 |
| Opus 5 | $0.00042 | $0.00318 |
| Sonnet 5 | $0.00017 | $0.00127 |
| Haiku 4.5 | $0.00008 | $0.00064 |
Grade A, and why
skill-repository-maintainer scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
Skill 仓库维护
适用范围
把本仓库当作 Skill 源仓库，负责注册表、包边界、结构校验、发布前审计和目的地差异检查。本 Skill 不负责修改 Skill 的行为质量；行为质量交给 skill-quality-gate。
工作流程
-
确认仓库根目录和目的地；没有明确目的地时不要猜测写入路径。
-
清点
skills.json、根目录注册包、SKILL.md、agents/openai.yaml、examples、references、scripts、assets 和被忽略的运行时状态。 -
运行严格校验：
python3 scripts/validate_repo.py --strict -
审查差异和发布边界，隔离私有记忆、缓存、依赖树、机器路径、临时文件和生成报告。
-
对目标设备做只读检查：
python3 scripts/sync_skills.py --destination "<destination>" --profile core --check -
只有用户明确要求同步时才使用
--apply，应用后立即再次--check。永远不通过同步脚本删除目的地额外文件。
仓库已有 validator 时优先使用它；包内 scripts/audit.py 仅作为独立安装或外部仓库没有 validator 时的便携 fallback。
架构边界
skills.json是注册表，根目录注册包是发布源。tier和profiles只描述安装集合，不授权自动安装或执行。skill-quality-gate负责触发、流程、输出和行为质量；本 Skill 负责结构、边界和同步。- 运行时状态可以被审计，但不能进入已发布包。
输出契约
报告 PASS、PARTIAL 或 BLOCKED，并包含仓库路径、目的地、命令、包数量、missing/different/extra、哈希结果、改动文件、残余风险和是否只读。
不要把旧目的地文件、旧 stdout 或单次 apply 当作同步成功证据；只有 post-apply 检查通过才可报告同步完成。
验证
最低验证集：严格仓库校验、相关 Skill smoke test、质量门禁和目标设备只读差异检查。应用操作必须保留目的地额外文件并完成第二次检查。
What ships with it
3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 7d ago First seen · 49 lines · 84 tokens per session scan A 003f61791ab3
skill-repository-maintainer is a skill published in the GitHub repository ooooooooooooooooooop/agent-tools (3 stars, last pushed 3d ago), licensed MIT. It adds 84 tokens to every session and 635 once invoked, about $0.0004 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
release
CONTRIBUTOR TOOL - Cut a plugin release: bump plugin.json version, finalize CHANGELOG, update README if needed, gate on make ci, commit, tag vX.Y.Z, and create the GitHub release. Use when shipping a new plugin version. NOT distributed.
catchup
Summarize and review what changed while you were away. Use after a weekend, vacation, or flight to check missed PRs, git commits, Linear tickets, and meetings — one prioritized brief, not a firehose.
pr-review
Address feedback left on a GitHub pull request: fetch unresolved review threads, make agreed Elixir/Phoenix code fixes, reply, and resolve. Use for a PR URL/number or reviewer comments. NOT for pre-PR review, findings triage, or CI monitoring.
phx-pr-review
Address feedback left on a GitHub pull request: fetch unresolved review threads, make agreed Elixir/Phoenix code fixes, reply, and resolve. Use for a PR URL/number or reviewer comments. NOT for pre-PR review, findings triage, or CI monitoring.
watch-pr
Watch an Elixir/Phoenix PR with an Amp Orb keep-alive lease until required non-deployment CI is green and review threads are resolved. Use after opening or updating a PR.
056-design-avoid-breaking-changes
Use when you need to review a plan, OpenSpec change, specification, or implementation proposal for breaking-change risk across commands, skills, generated outputs, XML sources, README/docs, tests, CI, APIs, schemas, configuration, data, migration, and release guidance. This should trigger for requests such as Review…