Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add theafh/ai-modules --skill git_refreshgit clone --depth 1 https://github.com/theafh/ai-modulesWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/theafh/ai-modules/git_refresh)<a href="https://agentmods.dev/skills/theafh/ai-modules/git_refresh"><img src="https://agentmods.dev/badge/skills/theafh/ai-modules/git_refresh/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/theafh/ai-modules/git_refresh"><img src="https://agentmods.dev/badge/skills/theafh/ai-modules/git_refresh.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00127 | $0.01278 |
| Opus 5.5 | $0.00051 | $0.00511 |
| Sonnet 5.5 | $0.00025 | $0.00256 |
| Haiku 4.5 | $0.00013 | $0.00128 |
Grade A, and why
git_refresh scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 47 lines — stays where its author put it; the contents beside it link to each section on GitHub.
git_refresh
<git_refresh_skill>
Refresh the current repository to its remote default branch and remove only branch refs whose deletion is provably safe by default.
<command_intent>fetch and prune, switch to the detected default branch, fast-forward only, delete cleanly merged local branches, and report gated branch cleanup candidates</command_intent>
<path_resolution>
Bundled scripts live in scripts/ next to this SKILL.md. Resolve the helper path by combining the directory of this SKILL.md with scripts/refresh_repo.sh and invoke the absolute path. If the first invocation reports a missing file, re-resolve the absolute path once before treating the script as failed. Open references/manual_fallback.md only after the script exits non-zero after that retry.
</path_resolution>
<primary_workflow>
<default_run>Invoke scripts/refresh_repo.sh with no arguments. The helper performs the safe default run without per-action prompts: git fetch --prune, remote-HEAD default branch detection, clean-worktree switch to the default branch, fast-forward-only update, and git branch -d cleanup for branches already merged into the default branch.</default_run>
<consume_report>Read the helper output as the action log. Report the fetch/prune, detected default branch, switch result, fast-forward result, each deleted branch, and each skipped action exactly enough for the user to know what changed.</consume_report>
<closing_question>When the helper prints a follow-up question with upstream-gone candidates, ask the user whether to run the gated cleanup and name the exact branches in the offer. When the helper reports that nothing further remains, close with that state and ask no extra cleanup question.</closing_question>
</primary_workflow>
<safe_default_policy>
<default_branch_detection>Resolve the default branch from the remote HEAD; never hardcode main. The helper uses refs/remotes/origin/HEAD first and git remote show origin as fallback, so repositories whose default branch is master or another name refresh correctly.</default_branch_detection>
<fast_forward_only>Update the default branch only by fast-forward. When local and upstream histories have diverged, report the divergence and leave the branch untouched; use no merge commit and no rebase.</fast_forward_only>
<clean_delete_only>Delete local branches in the default run only with git branch -d after the branch is already merged into the default branch. Keep every branch that could contain unmerged or unpushed work.</clean_delete_only>
<protected_branches>Keep the current branch and the detected default branch out of deletion candidates.</protected_branches>
<dirty_worktree>When uncommitted changes would block switching or fast-forwarding, report git status --short and skip the blocked actions. Use no stash, reset, checkout-discard, or other command that hides or discards user changes.</dirty_worktree>
<default_boundary>The default run never runs git branch -D and never deletes upstream-gone branches. It only reports those candidates for an explicit follow-up.</default_boundary>
</safe_default_policy>
<gated_extensions>
<upstream_gone_pruning>
Run this only after the user opts in. Invoke scripts/refresh_repo.sh --prune-gone to process all upstream-gone branches, or append branch names to narrow the scope. The helper lists candidates with git for-each-ref --format '%(refname:short) %(upstream:track)' refs/heads, checks commits absent from the default branch with git log --oneline <default>..<branch>, deletes branches with no absent commits via git branch -d, and shows absent commits for every branch that requires force-delete confirmation. This covers stale upstream-gone and squash-merged PR cleanup while preserving branches that still carry unique work.
</upstream_gone_pruning>
<force_delete>
Run this only after the user explicitly confirms the exact branch. Invoke scripts/refresh_repo.sh --force-delete <branch> --confirm-force-delete <branch>. The helper prints git log --oneline <default>..<branch> before deletion and then runs git branch -D only when the confirmation argument exactly matches the branch.
</force_delete>
</gated_extensions>
<fallback_on_script_failure>
Open references/manual_fallback.md after scripts/refresh_repo.sh exits non-zero and one re-resolved retry also fails.
Recover only the failed action manually, then return to the primary workflow for any remaining reporting or gated follow-up.
</fallback_on_script_failure>
<output_contract>
<default_report>Report the concrete actions taken and skipped: fetch/prune, detected default branch, switch, fast-forward extent or divergence, and each deleted branch.</default_report>
<gated_offer>When riskier candidates exist, surface each upstream-gone or squash-merged branch, marking branches with no absent commits as safe for git branch -d after opt-in and branches with absent commits as requiring explicit force-delete confirmation with those commits shown.</gated_offer>
<nothing_remaining>When no gated candidates exist, state that nothing further remains.</nothing_remaining>
</output_contract>
</git_refresh_skill>
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 47 lines · 127 tokens per session scan A 0e6eeb951af7
git_refresh is a skill published in the GitHub repository theafh/ai-modules (38 stars, last pushed today), licensed MIT. It adds 127 tokens to every session and 1,278 once invoked, about $0.0005 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
merge-batch
Prepare and merge an owner-selected PR batch with contributor credit and exact-candidate admission. Use for a pasted PR list; combined focused validation is diagnostic, and every actual landing still requires its applicable checks and authorization.
prowler-commit
Creates professional git commits following conventional-commits format. Trigger: When creating commits, after completing code changes, when user asks to commit.
gh-auth-isolation
Safely manage multiple GitHub identities (EMU + personal) in agent workflows.
comet-github
A routing guide for Comet-related GitHub work. It directs requests about pull requests, issues, CI failures, ideas, and fixes to the appropriate review or implementation process.
github-skill
Work with GitHub via the gh CLI — clone repositories, create/list/merge pull requests, create/list issues, and run any other gh command (API calls, workflow runs, releases, repo administration). List operations return parsed JSON.
release-helper
Ensures configuration and code changes are released correctly. Use PROACTIVELY whenever you edit config.json, change any setting, or fix a configuration bug in this project, so the change reaches production.