Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add wahidyankf/ose-public --skill repo-propagating-rulesgit clone --depth 1 https://github.com/wahidyankf/ose-publicWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/wahidyankf/ose-public/repo-propagating-rules)<a href="https://agentmods.dev/skills/wahidyankf/ose-public/repo-propagating-rules"><img src="https://agentmods.dev/badge/skills/wahidyankf/ose-public/repo-propagating-rules/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/wahidyankf/ose-public/repo-propagating-rules"><img src="https://agentmods.dev/badge/skills/wahidyankf/ose-public/repo-propagating-rules.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00137 | $0.00717 |
| Opus 5.5 | $0.00055 | $0.00287 |
| Sonnet 5.5 | $0.00027 | $0.00143 |
| Haiku 4.5 | $0.00014 | $0.00072 |
Grade A, and why
repo-propagating-rules scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 53 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Propagating Repository Rules
Rule work does not go in through an ad-hoc edit. It goes through rules-propagation, which exists because placing a rule badly is invisible at review time and expensive later.
Recognising Rule Work
The phrasing varies more than the intent does. All of these are rule work:
- Named: "add rule", "update the rule", "change the convention", "delete that rule".
- Unnamed: "from now on…", "we should always…", "never do X again", "make sure that before Y we do Z". A standing obligation stated in prose is a rule whether or not the word appears.
- Implied by target: any edit to governance prose, the instruction surfaces, an agent or skill definition, the machine-readable declarations, the enforcement wiring, or the language style guides.
A one-off instruction for the current task is not rule work. The test is whether the obligation outlives the work that prompted it.
What Running It Means
Ten steps, summarised: normalize the rule until it is falsifiable both ways; classify its subject, audience, vendor-neutrality, and layer; scan for contradictions and apply layer-aware precedence before writing anything; place it on the narrowest surface that binds, evicting from the instruction surface if it is admitted there; tidy every other surface stating its subject; record one of three enforcement dispositions; verify; deliver.
Read the workflow rather than working from this summary — the steps carry conditions this Skill deliberately does not restate.
Do Not
- Do not edit a rule surface first and reconcile it afterwards. The conflict scan is a pre-write step because a contradiction found after the write often means the wrong rule was edited.
- Do not finish Step 6 without classifying every subject-scoped rule and discoverability surface as keep, amend, merge, delete, relocate, or supersede. Merge or delete only after every distinct obligation and necessary discoverability path survives at the canonical home; a kept duplicate needs a rationale.
- Do not soften an unfalsifiable rule into "guidance" so it can be written. That is a halt.
- Do not raise a word budget to make a rule fit.
What ships with it
1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 53 lines · 137 tokens per session scan A 1123ebc1d583
repo-propagating-rules is a skill published in the GitHub repository wahidyankf/ose-public (12 stars, last pushed today), licensed MIT. It adds 137 tokens to every session and 717 once invoked, about $0.0005 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-14.
Other skills, from other repositories
add-a-lib
Scaffold a new shared library under libs/ in the builders-stack monorepo. Use when code is needed in two or more places (apps or services) and should become a single source of truth consumed by package name. Covers the package.json, tsconfig, the one-public-door src/index.ts barrel, and wiring it into a consumer…
implement
Implement an agreed issue or spec through implementation, review, fixes, and a PR ready to merge.
triage
Classify an issue, identify missing information, and decide whether bounded automatic work is safe.
record-gotchas
Capture surprises, workarounds, and rough edges hit while consuming the public surface of Prisma 8, Prisma Compute, or Prisma Postgres — anything a real user of these products would experience. Fires whenever an operator (or agent) writes a workaround, hits a surprising failure mode, or finds undocumented behaviour…
resolution_playbook
How to choose one resolution action from a ticket and its customer history.
stacking-prs
Create and manage GitHub native Stacked PRs in this repo with the gh stack CLI. Use when asked to stack PRs, split a large change into a stack, add a layer to a stack, restack or rebase a stack, adopt existing branches or PRs into a stack, check out someone else's stack, or land a stack. Covers creating and submitting…