Agent Skills › Lifecycle-Innovations-Limited/claude-ops › ops-rotate-setup

ops-rotate-setup

GitHub

指导操作员使用 staged-enrollment.mjs 脚本进行 Claude 账户的阶段性注册与安全配置，涵盖信任根固定、审批签名及 writer 隔离，严禁自动执行或绕过安全限制。

claude-ops/skills/ops-rotate-setup/SKILL.md Lifecycle-Innovations-Limited/claude-ops

Trigger Scenarios

rotate setup enroll Claude seat

Install

npx skills add Lifecycle-Innovations-Limited/claude-ops --skill ops-rotate-setup -g -y

More Options

Non-standard path

npx skills add https://github.com/Lifecycle-Innovations-Limited/claude-ops/tree/main/claude-ops/skills/ops-rotate-setup -g -y

Use without installing

npx skills use Lifecycle-Innovations-Limited/claude-ops@ops-rotate-setup

指定 Agent (Claude Code)

npx skills add Lifecycle-Innovations-Limited/claude-ops --skill ops-rotate-setup -a claude-code -g -y

安装 repo 全部 skill

npx skills add Lifecycle-Innovations-Limited/claude-ops --all -g -y

预览 repo 内 skill

npx skills add Lifecycle-Innovations-Limited/claude-ops --list

SKILL.md

Frontmatter

{
    "name": "ops-rotate-setup",
    "effort": "low",
    "maxTurns": 5,
    "description": "OPS on-demand: This skill should be used when the user asks to \"rotate setup\", \"enroll Claude seat\", or…",
    "allowed-tools": [
        "Read"
    ],
    "argument-hint": "",
    "disable-model-invocation": true
}

Claude enrollment handoff

Load ops-rules before acting. Public repo (no personal data). Outbound: one draft → one approval → one send. If AskUserQuestion / Workflow are missing, follow Rule 10 in ops-rules (Hermes: numbered options / two-turn Telegram card; delegate_task).

Direct Claude browser, OAuth, magic-link, setup, and unattended authentication are disabled. Do not launch a browser, poll email, invoke rotate.mjs --setup, invoke rotate-magic.mjs, modify auth inventory, or suggest an environment bypass.

Tell the operator to use scripts/account-rotation/staged-enrollment.mjs with:

An owner-only deployment config that pins every trust root and the canonical operation lock.
A short-lived, separately signed stage approval for an externally captured CLIProxyAPI Claude auth candidate.
External containment of all writers.
A distinct activate approval bound to the staged digest and attesting writersQuiesced: true.

The attestation records operator confirmation; it does not stop services or contain writers itself. This skill does not sign approvals or perform either operation on the operator's behalf.