Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add yunshu0909/yunshu_skillshub --skill git-pushgit clone --depth 1 https://github.com/yunshu0909/yunshu_skillshubWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/yunshu0909/yunshu_skillshub/git-push)<a href="https://agentmods.dev/skills/yunshu0909/yunshu_skillshub/git-push"><img src="https://agentmods.dev/badge/skills/yunshu0909/yunshu_skillshub/git-push/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/yunshu0909/yunshu_skillshub/git-push"><img src="https://agentmods.dev/badge/skills/yunshu0909/yunshu_skillshub/git-push.svg" alt="Reviewed on agentmods" width="80" height="20"></a>- NVIDIA SkillSpector warn
SkillSpector: 1 finding, up to high
These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →
- high Tool Misuse · line 201 Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).Fix: Validate all tool parameters against an allowlist. Reject dangerous parameter values (shell=True, --force, -rf /) and use safe defaults.
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00223 | $0.03711 |
| Opus 5 | $0.00112 | $0.01855 |
| Sonnet 5 | $0.00045 | $0.00742 |
| Haiku 4.5 | $0.00022 | $0.00371 |
Grade A, and why
git-push scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 10d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 391 lines — stays where its author put it; the contents beside it link to each section on GitHub.
一键推送 GitHub
功能说明
把当前项目一键推送到 GitHub,覆盖完整生命周期:
- 首次推送 — 新项目从零到 GitHub
- 日常更新 — 改了文件,推一下(commit + push)
- 版本发布 — 打 tag + 创建 Release,可附带下载文件
核心原则:安全第一。宁可多问一句,不能把不该推的东西推上去。
工作流程
第0步:环境检查 + 模式判断
依次检查前置条件,任一不满足就终止并给出指引:
1. git 是否安装
- ❌ → 提示:
brew install git,终止 - ✅ → 继续
2. gh CLI 是否安装
- ❌ → 提示:
brew install gh,终止 - ✅ → 继续
3. gh 是否已登录 GitHub
- 执行
gh auth status检查 - ❌ 未登录 → 提示:
gh auth login,终止 - ✅ 已登录 → 记录账号名,告诉用户"当前登录账号:[xxx]",继续
4. git 用户信息是否配置
- 执行
git config user.name和git config user.email检查 - ❌ 未配置 → 提示用户设置:
终止git config --global user.name "你的名字" git config --global user.email "你的邮箱" - ✅ 已配置 → 继续
5. 当前目录是否已是 git 仓库 → 决定走哪条路
不是 git 仓库 → 【首次推送】从第1步开始
是 git 仓库,无 remote → "本地有 git 但没关联远程"
→ 先执行第1步的大文件扫描(确保安全)
→ 再跳到第2步关联远程
是 git 仓库,有 remote → 【已有仓库】进入模式选择:
├── "推日常更新" → 跳到第3B步(日常更新)
├── "发新版本" → 检查是否有未提交的变更
│ ├── 有变更 → 先走第3B步,再走第4步
│ └── 无变更 → 直接跳到第4步(只打 tag + Release)
└── "重新来"
→ ⚠️ 警告:"这将删除所有 Git 历史记录(包括所有提交、分支、tag),不可恢复。"
→ 用户二次确认后删除 .git,从第1步开始
第1步:项目扫描 + .gitignore 生成
⚠️ 铁律:.gitignore 必须在第一次
git add之前就位。绝不能先提交再排除——Git 历史里的大文件删不干净,会导致仓库臃肿、推送失败。
1.1 扫描目录大小
用 du -sh 扫描所有顶级目录和文件,按大小排序。
大文件分级处理:
| 大小 | 处理方式 |
|---|---|
| >10MB | 列出,逐个问用户"要推吗?" |
| >50MB | 额外警告"较大,推送会比较慢" |
| 单文件 >100MB | 必须排除,GitHub 硬限制,推不上去 |
展示格式(示例):
扫描发现以下内容超过 10MB:
1. 109MB slides/ (PPT + 大图片)
2. 12MB assets/ (视频文件)
⚠️ 其中 slides/ 超过 50MB,推送会很慢。
❌ 其中 recording.mp4 (150MB) 超过 GitHub 100MB 单文件限制,必须排除。
要排除哪些?(输入序号,或 "全部排除" / "全部保留")
1.2 敏感内容扫描(仅公开仓库)
如果用户选了公开仓库,额外扫描:
.env/.env.*— 环境变量/密钥*secret*/*credential*/*token*— 密钥文件*.pem/*.key— 证书文件memory//MEMORY.md— AI 工具记忆文件- 任何看起来像私人内容的文件
列出建议排除项,让用户逐项确认。
1.3 生成或更新 .gitignore
如果不存在 .gitignore:基于扫描结果生成新文件。
如果已存在 .gitignore:读取现有内容,将新增排除项合并进去,展示差异让用户确认。不覆盖用户已有的规则。
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 10d ago First seen · 391 lines · 223 tokens per session scan A 74ea7f32371c
git-push is a skill published in the GitHub repository yunshu0909/yunshu_skillshub (755 stars, last pushed 1mo ago), licensed MIT. It adds 223 tokens to every session and 3,711 once invoked, about $0.0011 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
comet-safe-delivery
A Chinese-language procedure for safely delivering specified Comet changes through Git. It covers checking worktrees and unrelated edits, staging exact files, validating hooks, and authorized commits or pushes.
changelog
Auto-generates a changelog from git commits, sprint data, and design documents. Produces both internal and player-facing versions.
close-task-commit-push-pr
Close the active backlog task (detected from branch name), commit all changes, push to remote, and open a pull request. Use when the user says "close task and ship it", "close task commit push pr", or invokes /close-task-commit-push-pr.
git-workflow
Guides you through Git workflows — branching strategies, commit conventions, merge conflict resolution, and release management. Use when working with Git repositories or when the user asks about version control best practices.
development-workflow
Detailed development workflow with modular patterns for git, review, testing, and deployment.
git-workflow
Git workflow patterns including branching strategies, commit conventions, merge vs rebase, conflict resolution, and collaborative development best practices for teams of all sizes.