Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add ToruAI/toru-claude-agents --skill branch-workflowgit clone --depth 1 https://github.com/ToruAI/toru-claude-agentsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/toruai/toru-claude-agents/branch-workflow)<a href="https://agentmods.dev/skills/toruai/toru-claude-agents/branch-workflow"><img src="https://agentmods.dev/badge/skills/toruai/toru-claude-agents/branch-workflow/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/toruai/toru-claude-agents/branch-workflow"><img src="https://agentmods.dev/badge/skills/toruai/toru-claude-agents/branch-workflow.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00031 | $0.00628 |
| Opus 5 | $0.00015 | $0.00314 |
| Sonnet 5 | $0.00006 | $0.00126 |
| Haiku 4.5 | $0.00003 | $0.00063 |
Grade A, and why
branch-workflow scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 125 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Branch Workflow - Safe Autonomous Coding
All work happens on branches. Main stays clean. The user reviews before merge.
Branch Naming
feat/TASK-ID-short-description # New features
fix/TASK-ID-short-description # Bug fixes
docs/TASK-ID-short-description # Documentation
research/TASK-ID-description # Exploration
refactor/TASK-ID-description # Code improvements
Examples:
feat/API-142-rate-limitingfix/WEB-87-login-redirectdocs/API-150-auth-guide
Commit Format
TASK-ID: Brief description of change
- Detail 1
- Detail 2
Co-Authored-By: Claude <co-author>
Good commits:
- Atomic (one logical change)
- Buildable (tests pass at each commit)
- Descriptive (explains what, not how)
Workflow
Starting Work
git checkout main
git pull origin main
git checkout -b feat/TASK-ID-description
During Work
# Commit often
git add -A
git commit -m "TASK-ID: Implement X"
# Push periodically
git push -u origin feat/TASK-ID-description
Finishing Work
# Ensure tests pass
cargo test # or npm test, pytest, etc.
# Push final state
git push
# Log completion (megg or BACKLOG.md)
Rules
NEVER Do
- Push directly to main
- Force push (
git push --force) - Merge your own branches
- Delete branches without the user's approval
- Commit secrets or credentials
ALWAYS Do
- Create branch before changing code
- Run tests before pushing
- Commit with clear messages
- Push branches for review
- Document decisions
When Blocked
- Push current work to branch
- Document blocker in
.megg/blocked.mdor commit message - Move to next task
- The user will review on return
Review Workflow
The user reviews branches by:
# See all work
git branch -a
# Review specific branch
git log main..feat/BRANCH-NAME
git diff main..feat/BRANCH-NAME
# Merge if good
git checkout main
git merge feat/BRANCH-NAME
Integration with OpenSpec
For OpenSpec changes:
- Branch name matches change ID:
feat/add-plugin-system - One branch per OpenSpec change
- Archive OpenSpec change only after merge
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 10d ago First seen · 125 lines · 31 tokens per session scan A 3559cb481828
branch-workflow is a skill published in the GitHub repository ToruAI/toru-claude-agents (15 stars, last pushed 1mo ago), licensed MIT. It adds 31 tokens to every session and 628 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
commit
Commit the current session's changes only, gateway-inline. Session-isolated (never -A, staged set verified against the session list), doc-sync-gated. The gateway runs the commit inline — it already holds the diff, session file list, and change intent; on a mechanical gate hit it judges doc-sync warm in its own context…
git-commit
Generate conventional commit messages for Java projects. Use when user says "commit", "create commit", "commit changes", or after completing code changes that need to be committed.
security-pipeline
Use when security verification is needed - pre-commit security checks, vulnerability scanning, STRIDE threat analysis. Integrates with /handoff-verify --security and /commit-push-pr. CWE Top 25 based.
memstack-security-git-guard
Use when the user says 'git-guard', 'check git protection', 'is this repo protected', 'verify gitleaks', 'set up git hooks', 'install git-guard', or wants to confirm a repo blocks secrets and internal files before commit. This is an installer and verifier, NOT a scanner (gitleaks does the actual scanning). Do NOT use…
commit-and-push
Create a well-formatted git commit and push to remote repository.
customize-contribute-back
Contribute a user's AIWG customization back upstream as a PR — reviews for general applicability, creates branch, opens PR.