Skip to content
cccskills
FreePublished on GitHub

signing-preflight

Before the first commit of a session, check that commit signing will work — the key is loaded and unlocked — and ask the operator to unlock it once, up front, instead of discovering it after a hundred unsigned commits. Never disables signing silently, never re-signs history without asking. Use at the start of implementation work in a repo that signs commits ("коммиты не подписаны", "ssh-keygen висит", "gpg failed to sign"). Loaded by senior-dev, devops.

The English summary is being prepared. Showing the original description.

avelikiy/great_cto
See how to install

Files included (1)

  • SKILL.md3.2 KB

SKILL.md (original)

Review the instructions the agent will receive before you install.

signing-preflight — find the locked key before the first commit, not after the hundredth

On real projects: an agent committed unsigned without asking to unlock the key; a signing call on a locked SSH key hung the session; 121 commits had to be re-signed after the fact — and the key turned out to have no passphrase at all. Each was a two-second question at the start of the session.

Check (read-only, bounded)

git config --get commit.gpgsign          # true → signing is expected
git config --get gpg.format              # ssh | openpgp (empty = openpgp)
git config --get user.signingkey

SSH signing — does a test signature finish? (user.signingkey may be a key file or a literal key::ssh-…; the test signature is the check that works for both.)

K="$(git config --get user.signingkey)"; case "$K" in key::*) printf '%s\n' "${K#key::}" > /tmp/sigpre.pub; K=/tmp/sigpre.pub ;; esac
echo preflight | perl -e 'alarm 5; exec @ARGV' ssh-keygen -Y sign -n git -f "$K" >/dev/null 2>&1 && echo signs || echo CANNOT-SIGN

OpenPGP — a batch signature that refuses to prompt:

echo preflight | perl -e 'alarm 5; exec @ARGV' gpg --batch --pinentry-mode error --clearsign -u "$(git config --get user.signingkey)" >/dev/null 2>&1 && echo signs || echo CANNOT-SIGN

Always bound the test with a timeout: an unbounded signing call on a locked key waits for a passphrase nobody will type, and the session stalls.

Then

  • signs → proceed; nothing to say.
  • CANNOT-SIGN → one question to the operator, before any work: "Commit signing is on and the key is locked / not loaded. Unlock it (ssh-add / gpg-agent) and I will continue — or tell me to commit unsigned for this session." Wait for the answer. This is the one question worth stopping for at the start.

Never, without being told

  • git -c commit.gpgsign=false commit … or --no-gpg-sign — an unsigned commit on a branch that requires signatures is a push that will be refused, or worse, accepted.
  • Re-signing history (rebase --exec 'git commit --amend -S') — it rewrites every hash after the first commit it touches; on a pushed branch that is a force-push.

Report unsigned work

If commits were made unsigned anyway, say so with the list:

git log --format='%h %G? %s' @{upstream}..HEAD | awk '$2!="G"'

Reviews

No reviews yet. Tell others what you thought.

Comments

No login needed. Share how it worked for you, ask a question, or note where it did not run.

No comments yet. Be the first to write one.

Comments are published right away. Do not include personal information such as email addresses or phone numbers. Up to 2 URLs.

0 / 1,000 characters

This form is protected by reCAPTCHA, and the Google Privacy Policy and Terms of Service apply.

More skills from this repository

aesthetic-instrument

Free

great_cto's own committed aesthetic — the instrument panel. Dark five-step surface ladder, exactly one accent, two faces divided by MEANING (Geist speaks, Geist Mono is machine-truth), tabular numerals, and a dash that is not a nought. Twelve checkable rules measured from packages/board and greatcto.systems, not designed for this file. Use when building or extending any great_cto surface — the board, the site, a report, a share page.

The English summary is being prepared. Showing the original description.

avelikiy/great_cto105Updated Oct 23, 2026

anti-patterns

Free

Catalogue of known SDLC anti-patterns that great_cto agents must actively reject when reviewing architecture, plans, code, or post-mortems. Used by architect (pre-impl), pm (planning), senior-dev (impl), l3-support (post-incident).

The English summary is being prepared. Showing the original description.

avelikiy/great_cto105Updated Oct 23, 2026

anydesign

Free

Analyze images, websites, and Figma files to extract their design and generate a `design.md` with token system, component inventory, and reconstruction notes. Use this skill whenever the user wants to understand, document, replicate, or audit the design of something visual: a screenshot, a URL, a Figma link, a Pinterest reference, a mockup, a competitor's site, a component, a dashboard, a landing page. Also when they ask 'extract the design system from X', 'document the style of Y', 'analyze this visually', 'convert this image into tokens', 'help me replicate this design', 'what palette does this site use', 'how is this built'. Also for single elements: 'copy this navbar', 'recreate this illustration', 'give me a prompt to regenerate this graphic' — element mode outputs a focused element.md, with token-grounded image-model prompts when the element is visual art. If the user brings any visual source and wants to understand it at a design level — this skill should activate.

The English summary is being prepared. Showing the original description.

avelikiy/great_cto105Updated Oct 23, 2026

archetype-review-base

Free

Shared review framework that every domain reviewer (pci, oracle, gov, edtech, healthcare, mlops, etc.) MUST follow. Defines the output artifact (TM-{slug}.md), mandatory sections, severity scale, verdict format, the workflow scaffold (when-invoked, Step-0 read-inputs, HANDOFF), and the "domain heuristic vs generic check" boundary. Eliminates duplication across the ~30 reviewer prompts.

The English summary is being prepared. Showing the original description.

avelikiy/great_cto105Updated Oct 23, 2026

brainstorming

Free

Structured idea generation + multi-LLM debate for the product-owner stage. Diverge (generate genuinely different bets), debate (a 4-persona panel on 4 models argues over 2 rounds), converge (synthesize a recommendation). Used by product-owner before architect; available to architect for design-space exploration.

The English summary is being prepared. Showing the original description.

avelikiy/great_cto105Updated Oct 23, 2026

codex-host

Free

Run the great_cto controlled Codex lifecycle with controller-owned writes, verifier evidence, human gates and optional artifact release.

The English summary is being prepared. Showing the original description.

avelikiy/great_cto105Updated Oct 23, 2026

See all skills by avelikiy

Report a problem with this skill