Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add tranhieutt/software_development_department --skill sync-templategit clone --depth 1 https://github.com/tranhieutt/software_development_departmentWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/tranhieutt/software_development_department/sync-template)<a href="https://agentmods.dev/skills/tranhieutt/software_development_department/sync-template"><img src="https://agentmods.dev/badge/skills/tranhieutt/software_development_department/sync-template/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/tranhieutt/software_development_department/sync-template"><img src="https://agentmods.dev/badge/skills/tranhieutt/software_development_department/sync-template.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00051 | $0.00787 |
| Opus 5 | $0.00026 | $0.00394 |
| Sonnet 5 | $0.00010 | $0.00157 |
| Haiku 4.5 | $0.00005 | $0.00079 |
Grade C, and why
sync-template scanned grade C with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Recursive force deletehighDestructive command
rm -rf with a variable or a broad path is one typo away from removing the wrong tree.
rm -rf "$SYNC_TMP" How it starts
The opening of the file, as written. The whole thing — 97 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Sync the .claude/ directory from an upstream template repository into this project.
Determine the upstream URL
If $ARGUMENTS is provided, use it as the upstream repository URL.
If $ARGUMENTS is empty, check CLAUDE.md for a line like:
**Template upstream**: <url>
If no URL is found in either place, ask the user:
"What is the upstream template repository URL to sync from? (e.g. https://github.com/owner/repo)"
Do not proceed until a URL is confirmed.
Steps
1. Fetch the upstream template
Run:
SYNC_TMP=$(mktemp -d /tmp/template-sync-XXXXXX)
git clone --filter=blob:none --sparse "$UPSTREAM_URL" "$SYNC_TMP" 2>&1
cd "$SYNC_TMP" && git sparse-checkout set .claude
If the clone fails (no internet, repo moved, auth required, etc.) stop immediately and report the error clearly. Do not attempt fallbacks.
2. Show a diff summary
Compare $SYNC_TMP/.claude/ against the project's .claude/ directory and report:
- New files — present in upstream but not locally (will be added)
- Modified files — present in both but with different content (will be overwritten)
- Local-only files — present locally but not in upstream (will be kept unchanged — these are project-specific customizations)
If there are no differences, say so and skip to clean-up.
3. Ask for confirmation
Present the diff summary and ask:
"Apply these changes from
<upstream-url>? Type yes to apply or no to cancel."
Do not proceed until the user explicitly confirms with "yes".
4. Apply the changes
From the project root, run:
cp -r "$SYNC_TMP/.claude/." .claude/
This will:
- Overwrite files that exist in both upstream and locally
- Add new files from upstream
- Preserve all local-only files (project-specific agents, skills, rules, hooks)
5. Report
List each file that was added or updated, grouped by type:
- Added:
[file list] - Updated:
[file list]
6. Clean up
rm -rf "$SYNC_TMP"
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 97 lines · 51 tokens per session scan C 58c6d7ddfa5f
sync-template is a skill published in the GitHub repository tranhieutt/software_development_department (72 stars, last pushed 4mo ago), licensed MIT. It adds 51 tokens to every session and 787 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it C with 1 finding (recursive force delete). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
changelog
Generates and maintains changelogs following Keep a Changelog format. Use when updating release notes, finishing tasks, or tagging versions. For version bumps, see semantic-versioning.
conventional-commits
Enforces Conventional Commits format for git commit messages. Use when formatting commits or validating message structures. For git commands, see git-control.
git-control
Standardizes git operations, branch management, and disaster recovery. Use when committing, branching, or resolving conflicts. For commit formatting, see conventional-commits.
ship-preflight
Stage ⑤.a Ship sub — release-preflight gate. Runs harnessed release-preflight (read-only: CHANGELOG [Unreleased] non-empty + version + git-clean + tag-absent). A failing gate blocks shipping. Nothing is pushed/published/tagged here.
semantic-versioning
Manages project versioning following Semantic Versioning (SemVer) principles. Calculates increments based on changes and synchronizes version across documentation and metadata. Use when the user asks to "bump the version", "prepare a release", or when the changelog skill calls for a release.
storozh
Advisory semantic guard over a changeset manifest before it lands in shared state. Use after a multi-repo session produces a changeset-manifest (mirabilis C1) and before the co-sign push gate — classify each unit's routing against the darwin routing-policy (C3) and NLI-check each unit against the shield corpus (claims…