Borrowing it
Nothing to install: this file belongs to SummerSec/SumSec-Skills. Take a copy, put it at the same path in your own repository, and replace the rules that are about this project with yours.
curl -O https://raw.githubusercontent.com/SummerSec/SumSec-Skills/master/.claude/skills/sync-skills/SKILL.mdgit clone --depth 1 https://github.com/SummerSec/SumSec-SkillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/summersec/sumsec-skills/sync-skills)<a href="https://agentmods.dev/skills/summersec/sumsec-skills/sync-skills"><img src="https://agentmods.dev/badge/skills/summersec/sumsec-skills/sync-skills.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00042 | $0.02789 |
| Opus 5 | $0.00021 | $0.01394 |
| Sonnet 5 | $0.00008 | $0.00558 |
| Haiku 4.5 | $0.00004 | $0.00279 |
Grade A, and why
sync-skills scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 219 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Sync Skills — Submodule Skill 与插件同步管理
概述
本仓库从 git submodule（claude-plugins-official、context7 等）引用第三方 skill 和插件，通过 复制同步 管理。
支持两种粒度：
- 组件级：同步单个 skill/commands/agents/hooks 子目录到目标插件
- 插件级：同步整个插件目录（含 plugin.json、README、LICENSE、截图等根级文件）
位置说明
.claude/skills/sync-skills/ 是本 skill 的唯一源，包含 SKILL.md、脚本和映射表，应直接提交到 git。
agents-dev/skills/sync-skills/ 是同步到 agents-dev 插件的副本，不提交到 git。
核心文件
| 文件 | 说明 |
|---|---|
scripts/sync-skills.py |
同步脚本（Python 3 标准库，无额外依赖） |
scripts/skill-map.json |
工作映射表（source → target），可编辑 |
scripts/skill-map.default.json |
默认模板，skill-map.json 不存在时从中初始化 |
skill-map.json是唯一操作入口；skill-map.default.json仅作模板，不要直接编辑。
何时使用
- 用户要求「添加一个来自 submodule 的 skill」「同步 skills」「新增映射」
- 用户提到
skill-map.json、sync-skills.py - 需要从
claude-plugins-official或其他 submodule 引入新 skill/插件 - 用户要求「添加插件」「同步插件」「从 submodule 复制插件」
工作流
添加新 skill 映射（组件级）
- 确认源路径（submodule 内的 skill 目录）和目标路径（本仓插件目录下的位置）
- 执行添加命令：
python .claude/skills/sync-skills/scripts/sync-skills.py --add "<source_relative_path>" "<target_relative_path>" # 如果源可能不存在（可选依赖），加 --optional python .claude/skills/sync-skills/scripts/sync-skills.py --add "<source>" "<target>" --optional - 运行同步：
python .claude/skills/sync-skills/scripts/sync-skills.py - 确认
.gitignore中已添加对应的目标目录忽略规则
添加整个插件映射（插件级）
适用于纯镜像插件（目标完全来自 submodule，无自定义代码）。一条命令替换所有散装映射：
python .claude/skills/sync-skills/scripts/sync-skills.py --add-plugin <plugin_name>
行为：
- 自动构建路径：
claude-plugins-official/plugins/<name>→<name> - 清除该 target 下所有旧的散装映射（如
skills/、commands/等单独条目） - 同步时复制整个插件目录（含 plugin.json、README、LICENSE、截图等）
- 输出
.gitignore建议：整个插件目录应忽略不提交
适用条件：
- 目标插件是 submodule 源的完整镜像（无自定义代码混入）
- 反面例子：
hookify、plugin-dev有自定义 Python/配置，只能用组件级映射
完整流程：
# 1. 添加插件映射
python .claude/skills/sync-skills/scripts/sync-skills.py --add-plugin claude-md-management
# 2. 执行同步并提交（不再需要改 .gitignore）
python .claude/skills/sync-skills/scripts/sync-skills.py
git add claude-md-management/
git commit -m "feat(claude-md-management): mirror from upstream"
What ships with it
5 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 219 lines · 42 tokens per session scan A 49cef09f8bec
sync-skills is a skill published in the GitHub repository SummerSec/SumSec-Skills (8 stars, last pushed 24d ago), licensed Apache-2.0. It adds 42 tokens to every session and 2,789 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
github-proxy
A tool that routes GitHub downloads through a proxy service, including repository clones, release files, raw files, and archives.
github
Interact with GitHub using the gh CLI. Use gh issue, gh pr, gh run, and gh api for issues, PRs, CI runs, and advanced queries.
yao-workspace-config
Workspace Git identity and credential management. ALWAYS invoke this skill when the user asks about configuring Git user info, adding HTTPS tokens, importing SSH keys, or managing workspace-level Git authentication.
github-sync-pr-flow
Use when preparing iPolloWork local changes for GitHub: stash or preserve local edits, sync the current personal branch with remote main, re-apply local work, diagnose conflicts, commit in English, push to the current remote branch, and open a PR to main without creating extra branches.
github-publish-changes
Publish intentional local changes by confirming scope, creating a branch when needed, staging selected files, committing, pushing, and creating a Draft Pull Request through the connected GitHub service.
github
Use the connected iPolloWork GitHub service to inspect repositories, pull requests, issues, reviews, and Actions, then route focused work to the review, CI, or publish skill.