agent-workflow SKILL.md skillA

agent-workflow from galact-byte/galact-skills is an agent skill: a SKILL.md folder an AI agent loads when a task calls for it.

Install it, pinned
mdr add galact-byte/galact-skills/agent-workflow@git:20260909.1191434

Pins git:20260909.1191434 in mdr.lock. Pin the fingerprint instead.

Audit grade
A, 17 of 17 checks passed
Kind
SKILL.md skill
Repository
galact-byte/galact-skills
Path
skills/agent-workflow/SKILL.md
Versions recorded
2
Latest version
git:20260909.1191434, committed Sep 9, 2026
First version recorded
Sep 8, 2026
Size
7,950 bytes
Repository stars
7
License
a license file GitHub does not identify

Use when an agent must decide whether to proceed autonomously, ask for clarification, request approval, or select an appropriate verification scope for a coding or documentation task.

Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.

What the file says

# Agent Workflow

## 核心原则

授权范围内,Agent 自主决定实现细节、工具选择与相称的验证方式;复杂度只调整调查、沟通和验证强度,不单独制造审批门槛。先调查仓库、测试、配置和相关约定,优先复用已完成且仍有效的产物。自治不扩大范围、不替用户决定外部结果,并服从用户明确指令、已启用的领域流程和 Trellis 优先级。沉默、离线或未回复不构成批准,授权也不外溢到新的范围、风险或副作用。

除非确有必要,否则由主会话直接完成,不轻易使用子代理。确需委派时,按任务难度与风险选择足够的推理强度,不默认使用高档;用户指定的独立审阅、工具或模型要求仍须遵守。

## 适用范围与优先级

本 Skill 适用于需要决定“继续执行、询问、请求批准或选择验证范围”的编码和文档任务。明确实施时执行当前已批准范围;仅计划时只产出计划;用户明确要求先审方案时停在检查点。Trellis 流程、显式领域流程及其批准节点优先于本 Skill;本 Skill 不会自动接管 Trellis,也不因提及某个 Skill 就自动启用其专用流程。本 Skill 不覆盖用户和显式流程规定的审批、预算、生产访问、领域检查点或其他安全边界。仅在相关流程适用或明确启用时使用其规则,混合任务只约束匹配部分。

需要核对决策边界时,读取[场景正反例](references/scenarios.md)。

## 决策顺序

1. 识别请求模式和当前进度:区分明确实施、仅计划、显式先审方案;读取仓库、测试、配置、文档、历史和可用工具,先消除可以自行回答的不确定性,并复用已完成的有效产物。
2. 若任务在既有需求、架构和授权内,直接选择最小兼容方案;跨文件或复杂本身不触发请示,复杂度只提高调查与验证强度。
3. 若有多个实现方式但对用户可见结果等价,选择最小方案;若不确定性会改变范围、架构、数据安全、兼容性、外部副作用或最终结果,先调查并澄清。
4. 仅让真正未决项阻塞其依赖部分;已确认且独立的工作继续。已授权的直接后续步骤不重复请求同一批准。
5. 若触发批准边界,先取得明确批准;批准后只完成当前范围内的直接隐含子任务。范围或风险变化时重新评估,授权不外溢。需要扩大授权的建议单独提出,不冻结其他已确认的独立工作。

## 必须先批准

执行以下操作前必须取得明确批准:

- 删除或覆盖用户数据、存档、数据库或不可替代资产;
- 生产访问(含只读访问),或修改生产系统、实时外部系统、真实用户数据;
- 发送消息、发布、推送代码、创建外部 Issue/PR;
- 改变认证、授权、安全控制或隐私行为;
- 在多个实质不同的架构或兼容性方案之间替用户做最终选择;
- 付费、安装或下载未经授权的软件;
…

Read the whole file at its exact version.

How to install

The exact contents, by fingerprint
mdr add galact-byte/galact-skills/agent-workflow@sha256:ba5a4851953e8995

The line at the top of this page pins the label git:20260909.1191434, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.

Badge

mdr badge

[![mdr](https://markdownregistry.com/badge/art_nznwlreuufopdsh5.svg)](https://markdownregistry.com/a/art_nznwlreuufopdsh5)

3 badge image fetches in 30 days. What the badge shows.

Versions

The registry has recorded 2 versions of this file, between Sep 8, 2026 and Sep 9, 2026, more than one a day.

versioncommittedcommitsizeaudit
git:20260909.1191434 latest2026-09-09 1191434 7,950 BA view · diff
git:20260908.819733e2026-09-08 819733e 3,251 BA view

Audit of the latest version

A  17 of 17 checks passed. Fixed automatic checks with no AI involved, so the same checks give the same answer every run.
  • pass: Frontmatter block present
  • pass: Frontmatter declares a name
  • pass: Frontmatter declares a description
  • pass: Size between 200 bytes and 200 KB (7950 bytes)
  • pass: No zero-width or bidi control characters
  • pass: No instruction hidden inside an HTML comment
  • pass: No link to an exfiltration or paste host
  • pass: No credential-shaped string
  • pass: No instruction to send local credentials anywhere
  • pass: No text hidden with inline styles
  • pass: No prompt-injection phrasing
  • pass: No curl or wget piped into a shell
  • pass: No recursive delete of root, home or parent
  • pass: No instruction to read or print local credentials
  • pass: No base64 blob over 200 characters
  • pass: No link to a raw IP address
  • pass: No script tag

Source

GitHub

galact-byte/galact-skills · 7 stars · license a license file GitHub does not identify · pushed 2026-10-12 · branch master

API

GET https://markdownregistry.com/api/v1/artifacts/art_nznwlreuufopdsh5
GET https://markdownregistry.com/api/v1/resolve?ref=galact-byte/galact-skills/agent-workflow
GET https://markdownregistry.com/api/v1/blob/ba5a4851953e8995af926000af833231c7ac2d886cd4921f3dc0b6260c707555

Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.

Guides: the SKILL.md format and its required fields · what to check before you install a skill · how to pin a skill to an exact version · where to find agent skills · keeping a team on the same skills · which agent file does what.

More from galact-byte/galact-skills

hunt-auth-bypass SKILL.md skill
galact-byte/galact-skills · skills/hunt-auth-bypass/SKILL.md · 在授权渗透测试中挖掘认证/授权绕过(authentication & authorization bypass)。当目标的登录、SSO/OAuth/SAML、2FA、会话、密码重置、邮箱验证等鉴权环节可能被逻辑缺陷或解析差异绕过时使用——典…
git:20260806.1b94651 · audit A · 7 stars
hunt-cache-poisoning SKILL.md skill
galact-byte/galact-skills · skills/hunt-cache-poisoning/SKILL.md · 在授权渗透测试中挖掘 Web 缓存投毒与缓存欺骗(web cache poisoning / cache deception)。当目标前有缓存层(CDN/反代/Varnish)且缓存键未覆盖某些影响响应的输入(unkeyed…
git:20260806.1b94651 · audit A · 7 stars
hunt-command-injection SKILL.md skill
galact-byte/galact-skills · skills/hunt-command-injection/SKILL.md · 在授权渗透测试中系统性挖掘命令注入与参数/标志注入(OS command injection、argument/flag injection、外部程序 delegate 注入)。当目标把用户输入拼进 shell 命令、或作为参数传给…
git:20260806.bbab2e5 · audit A · 7 stars
hunt-csrf SKILL.md skill
galact-byte/galact-skills · skills/hunt-csrf/SKILL.md · 在授权渗透测试中挖掘跨站请求伪造(CSRF)及其防护绕过。当目标存在状态变更操作(改邮箱/密码/角色/设置、转账、增删)而 CSRF 防护缺失或可绕过时使用——典型场景:无 token/token 不校验、SameSite=Lax 被…
git:20260806.1b94651 · audit A · 7 stars
hunt-deserialization SKILL.md skill
galact-byte/galact-skills · skills/hunt-deserialization/SKILL.md · 在授权渗透测试中挖掘不安全反序列化(insecure deserialization)。当目标把用户可控数据交给 unserialize/Marshal/pickle/ObjectInputStream/BinaryFormatter/YA…
git:20260806.1b94651 · audit A · 7 stars
hunt-nodejs-permission-bypass SKILL.md skill
galact-byte/galact-skills · skills/hunt-nodejs-permission-bypass/SKILL.md · 在授权测试中核验 Node.js 权限模型(--permission / --experimental-permission,及旧 policy.json)能否被内部 API 绕过。当目标依赖 Node.js Permission…
git:20260806.bbab2e5 · audit A · 7 stars
hunt-open-redirect SKILL.md skill
galact-byte/galact-skills · skills/hunt-open-redirect/SKILL.md · 在授权渗透测试中挖掘开放重定向(open redirect)及其危害升级。当目标按用户可控参数做跳转(登录后 next、SSO returnUrl、注销、短链、回调)时使用——典型场景:绕过 URL 白名单跳到外站钓鱼、泄露…
git:20260806.1b94651 · audit A · 7 stars
hunt-path-traversal SKILL.md skill
galact-byte/galact-skills · skills/hunt-path-traversal/SKILL.md · 在授权渗透测试中系统性挖掘路径遍历/目录穿越(path traversal、directory traversal、zip-slip、archive/symlink…
git:20260806.bbab2e5 · audit A · 7 stars
hunt-prototype-pollution SKILL.md skill
galact-byte/galact-skills · skills/hunt-prototype-pollution/SKILL.md · 在授权渗透测试中挖掘 JavaScript 原型污染(prototype pollution,服务端 Node.js 与客户端)。当目标把用户可控的键名递归合并进对象(merge/extend/set/clone、JSON…
git:20260806.1b94651 · audit A · 7 stars
hunt-request-smuggling SKILL.md skill
galact-byte/galact-skills · skills/hunt-request-smuggling/SKILL.md · 在授权渗透测试中系统性挖掘 HTTP 请求走私(HTTP Request Smuggling / desync)。当目标前面有反向代理/CDN/负载均衡(前端)转发给后端应用,且怀疑前后端对 Content-Length 与…
git:20260806.bbab2e5 · audit A · 7 stars
hunt-sqli SKILL.md skill
galact-byte/galact-skills · skills/hunt-sqli/SKILL.md · 在授权渗透测试中挖掘 SQL/NoSQL 注入(SQLi、NoSQLi,含 WAF 绕过、盲注、堆叠查询、类型混淆注入)。当用户输入拼进 SQL/NoSQL 查询时使用——典型场景:id/搜索/排序/过滤参数、数组键当 SQL…
git:20260806.1b94651 · audit A · 7 stars
hunt-ssrf SKILL.md skill
galact-byte/galact-skills · skills/hunt-ssrf/SKILL.md · 在授权渗透测试中系统性挖掘服务端请求伪造(SSRF)。当目标存在"服务端按用户可控的 URL/主机/地址发起出站请求"的功能——如 URL 预览、图片/视频抓取、Webhook、集成回调、导入远程资源、PDF/截图渲染、代理转发——需要判定…
git:20260806.712112c · audit A · 7 stars

Every file in galact-byte/galact-skills

Other files named agent-workflow

agent-workflow SKILL.md skill
akillness/jeo-skills · .agent-skills/agent-workflow/SKILL.md · Plan and improve day-to-day AI coding-agent workflow across Claude Code, Codex, Gemini CLI, and MCP-heavy repos…
v2.0.0 · audit A · 53 stars
agent-workflow SKILL.md skill
d-padmanabhan/agent-engineering-handbook · skills/agent-workflow/SKILL.md · Structured development workflow with Plan/Implement/Review phases, QA validation, context management, and audit…
git:20260819.d23bb73 · audit A · 20 stars
agent-workflow SKILL.md skill
projectbluefin/website · docs/skills/agent-workflow/SKILL.md · Use at session start, before commits, before pushes, at factory gates, and when a task crosses local, GitHub…
git:20261031.cca5d34 · audit A · 10 stars

Browse by kind, by grade A, or by owner.