Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add xyva-yuangui/XyvaClaw --skill github-managergit clone --depth 1 https://github.com/xyva-yuangui/XyvaClawWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/xyva-yuangui/xyvaclaw/github-manager)<a href="https://agentmods.dev/skills/xyva-yuangui/xyvaclaw/github-manager"><img src="https://agentmods.dev/badge/skills/xyva-yuangui/xyvaclaw/github-manager/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/xyva-yuangui/xyvaclaw/github-manager"><img src="https://agentmods.dev/badge/skills/xyva-yuangui/xyvaclaw/github-manager.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 3 findings, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Privilege Escalation · line 45 Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
- high Rogue Agent · line 240 Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.Fix: Prevent the skill from modifying its own code, SKILL.md, or configuration files. Treat skill files as read-only at runtime.
- medium Excessive Agency · line 195 Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.Fix: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00000 | $0.01346 |
| Opus 5 | $0.00000 | $0.00673 |
| Sonnet 5 | $0.00000 | $0.00269 |
| Haiku 4.5 | $0.00000 | $0.00135 |
Grade A, and why
github-manager scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 250 lines — stays where its author put it; the contents beside it link to each section on GitHub.
GitHub Manager Skill
一个全面的GitHub仓库管理工具，提供代码审查、自动部署、changelog生成、CI/CD配置、Bug追踪和项目管理自动化功能。
功能特性
1. 代码审查
- 自动PR审查和建议
- 代码质量检查
- 安全漏洞扫描
- 代码风格一致性检查
2. 自动部署
- 自动化部署流水线
- 多环境部署（开发/测试/生产）
- 回滚机制
- 部署状态监控
3. Changelog自动生成
- 基于commit消息自动生成changelog
- 版本号管理
- 发布说明生成
4. CI/CD配置
- GitHub Actions工作流模板
- 测试自动化
- 构建和发布流程
- 环境变量管理
5. Bug追踪与修复
- Issue模板管理
- Bug优先级分类
- 自动分配和跟踪
- 修复验证
6. 项目管理自动化
- 项目看板管理
- 里程碑跟踪
- 自动化任务分配
- 进度报告生成
配置要求
必需配置
- GitHub Token: 具有repo权限的Personal Access Token
- GitHub用户名: 你的GitHub用户名
可选配置
- 默认仓库: 经常操作的仓库
- Webhook URL: 用于接收GitHub事件通知
- 部署环境: 开发/测试/生产环境配置
使用方法
初始化配置
# 设置GitHub认证
github config --token YOUR_GITHUB_TOKEN --username YOUR_USERNAME
# 设置默认仓库
github config --default-repo username/repo-name
常用命令
仓库管理
# 列出所有仓库
github repos list
# 创建新仓库
github repos create --name my-new-repo --description "New repository"
# 克隆仓库
github repos clone username/repo-name
# 同步仓库
github repos sync username/repo-name
代码审查
# 审查PR
github review pr --number 123
# 自动审查所有打开的PR
github review all
# 设置审查规则
github review rules --set "require-tests=true"
部署管理
# 部署到开发环境
github deploy dev --branch main
# 部署到生产环境
github deploy prod --tag v1.0.0
# 查看部署状态
github deploy status
# 回滚部署
github deploy rollback --to v0.9.0
Changelog管理
# 生成changelog
github changelog generate --since v1.0.0
# 发布新版本
github release create --version v1.1.0 --notes "New features added"
# 更新changelog
github changelog update --version v1.1.1 --type "fix"
CI/CD管理
# 查看工作流状态
github ci status
# 运行特定工作流
github ci run --workflow test.yml
# 查看构建日志
github ci logs --run-id 123456
Bug管理
# 列出所有issue
github issues list
# 创建bug报告
github issues create --title "Bug found" --body "Description" --label bug
# 分配issue
github issues assign --number 45 --assignee username
# 关闭issue
github issues close --number 45 --comment "Fixed in PR #123"
What ships with it
17 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- _meta.json 195 B
- .clawhub/origin.json 146 B
- .github/workflows/ci.yml 1.1 KB
- .github/workflows/deploy.yml 567 B
- config-template.json 2.6 KB
- config.json 2.6 KB
- github-cli.js 16 KB runs code
- package.json 1.3 KB
- README.md 5.3 KB
- scripts/code-review.js 13 KB runs code
- scripts/generate-changelog.js 9.2 KB runs code
- scripts/github_cli.py 4.3 KB runs code
- scripts/health_check.py 1.1 KB runs code
- scripts/project-manager.js 17 KB runs code
- SKILL_CN.md 4.7 KB
- templates/github-actions/ci-workflow.yml 5.4 KB
- templates/github-actions/deploy-workflow.yml 8.9 KB
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 250 lines · 0 tokens per session scan A 2922bb88d49f
github-manager is a skill published in the GitHub repository xyva-yuangui/XyvaClaw (21 stars, last pushed 1mo ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 1,346 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
github
GitHub operations: list/create issues, PRs, check CI, manage repos. Requires GHTOKEN.
linear-cli
Use when the user wants to list, view, start, create, or update Linear issues from the terminal via schpet/linear-cli, including setup, auth, repo config, and safe read/write boundaries.
github
GitHub operations via gh CLI or Python API. Use when: listing repos, creating/viewing issues and PRs, checking CI runs, managing releases, or querying the GitHub API. NOT for: general git commands (use git directly), cloning private repos without auth.
things
Manage Things 3 on macOS: add/update todos and projects via URL scheme, read inbox/today/upcoming, search tasks. Syncs to iOS.
trello
Manage Trello boards: list/create/move cards, checklists, labels. Requires TRELLOAPIKEY and TRELLOTOKEN.
github-issues
Manage GitHub issues, pull requests, CI runs, and repository operations via the gh CLI.