shenxingy/equip
configs/skills/equip/SKILL.md
Equipment manager for Claude Code projects — inventory local skills/agents/scripts, audit external upstream repos (red-flag + prompt-injection screening), and sync selectively after user approval. Absorbs container-layout skill repos AND single-skill-at-root repos (e.g. a company design-system repo). Project-agnostic.
$ install --global
skillsauthnpx skillsauth add shenxingy/claude-code-kit equipInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Jul 11, 2026, 5:52 AM111.6s4 files scanned
SKILL.md
- name:
- equip
- description:
- Equipment manager for Claude Code projects — inventory local skills/agents/scripts, audit external upstream repos (red-flag + prompt-injection screening), and sync selectively after user approval. Absorbs container-layout skill repos AND single-skill-at-root repos (e.g. a company design-system repo). Project-agnostic.
- when_to_use:
- equip, upstream, absorb skill, absorb a design-system repo, update skill from github, review external skill, sync skill, inventory skills, 装备, 更新外部技能, 审核上游, 管理插件来源 — NOT for first-party feature development (just write code)
- argument-hint:
- <command> [args] # inventory | audit <repo|id> | sync <id> [--apply] | diff <id> | list | add <repo> | remove <id>
- user_invocable:
- true
/equip — Equipment Manager
A project-agnostic skill for managing "absorbed" assets (skills, agents, scripts) that originated in external GitHub repos. It treats each upstream as a supplier whose shipments must be reviewed before adoption, not blindly synced.
Subcommands
| Command | Purpose |
|---|---|
| /equip inventory | Scan current project; classify every asset as native / absorbed / modified-absorbed / orphan; write .claude/equipment/inventory.yaml |
| /equip audit <repo\|id> | Clone upstream, apply red-flag checks to each skill, score, write markdown audit report with decision checkboxes |
| /equip sync <id> [--apply] | Parse audit report, perform 3-way merge (base/ours/theirs) for ADOPT decisions; dry-run by default |
| /equip diff <id> | Show per-file delta between registered last_synced_commit and remote HEAD |
| /equip list | Show registered upstreams with ahead/behind status |
| /equip add <repo> | Register a new upstream (interactive: select which local paths it covers) |
| /equip remove <id> | Unregister an upstream (keeps files, removes tracking) |
Usage
/equip inventory # first step for any project
/equip audit AgriciDaniel/claude-seo # full evaluation
/equip sync claude-seo # dry-run: show what would change
/equip sync claude-seo --apply # actually write changes
/equip diff claude-seo # inspect drift
/equip audit . # self-audit current project as if upstream
Design principles
- Review-first, not sync-first: upstream content is always audited before it touches local files
- Trust is per-skill, not per-repo: one upstream can have 17 good skills + 3 bad ones;
/equippicks - Local customizations are sacred: files modified locally are never overwritten without explicit approval
- Transparent: every decision recorded in
.claude/equipment/audits/<id>-<date>.mdthat the user can read and edit
Related Skills
shenxingy/codex-orchestrate
development
VerifiedTrustedCommunity
Orchestrate a fleet of parallel `codex exec` workers with you (Claude Code) as the supervisor — spawn one per isolated git worktree, dispatch headless, verify each INDEPENDENTLY, PR/merge. The manual "codex-ultracode" pattern for fanning out real implementation, research, or review work onto Codex. Bakes in the hard gotchas (stdin blocking, background tracking, don't-trust-self-reports, writer isolation). Triggers on — orchestrate codex, codex workers, codex fleet, spawn codex, delegate to codex in parallel, manual ultracode, 开 codex 小弟, 派 codex worker — NOT for a single cross-vendor opinion (use the `second-opinion-codex` agent), NOT for web-UI worker decomposition (use `/orchestrate`).
8SKILL.mdUpdated Jul 16, 2026
shenxingy/worktree
development
VerifiedTrustedCommunity
Create and manage git worktrees for parallel Codex sessions
8SKILL.mdUpdated Jul 14, 2026
shenxingy/verify
development
VerifiedTrustedCommunity
Verify project behavior anchors — compilation, tests, and interaction checks after autonomous runs. NOT the Codex built-in /verify (which runs the app to observe a single change working) — this one walks the AGENTS.md "Features (Behavior Anchors)" list.
8SKILL.mdUpdated Jul 14, 2026
shenxingy/sync
documentation
VerifiedTrustedCommunity
End-of-session documentation sync — updates TODO.md and PROGRESS.md only (run /commit after to commit everything)
8SKILL.mdUpdated Jul 14, 2026