AI & Humanities · Skills in Practice
From GitHub Two-Factor Authentication to Skills in Practice with WorkBuddy
A practical account of GitHub two-factor authentication, installing Aegis and checking migration, and finding, installing, and validating skills in WorkBuddy.
By Shuye
Recently, while signing in to GitHub, I was stopped by a page in English: “Enable two-factor authentication.” I had previously been able to sign in with my Apple account. Why was another verification step needed this time? And what should I do when I could not find China in the country list?
By asking questions and trying each step, I eventually completed two-factor authentication (2FA) and signed in successfully. Then came another small complication: the authenticator I had just started using offered only a three-day free trial. I found Aegis, a free and open-source alternative, downloaded its installation package, transferred it to my Huawei phone, and installed it.
I am also preparing a salon on WorkBuddy and skills. This experience of signing in and installing an app provides a useful starting point: What resources are available on GitHub? What can a skill do? How do we install it in WorkBuddy and then use a specific task to test whether it works?
01 Why Is Authentication Still Needed After Signing In with Apple?
2FA stands for Two-Factor Authentication, commonly called 双因素认证 or 双重认证 in Chinese. One way to understand it is that, after signing in to an account, you also provide a one-time password (OTP) generated by an authenticator on a phone in your possession.
Signing in with Apple and GitHub’s additional authentication are separate stages. The requirement to enable 2FA in this particular sign-in process did not mean that Apple sign-in had stopped working. Nor does it imply that every account will encounter the same page on every sign-in.
02 Use an Authenticator When China Is Not an SMS Option
“Country or region code” in the screenshot is the list of regions supported for SMS delivery. If China is not listed, there is no need to choose another country and enter a Chinese phone number. Instead, I clicked “Select” beside “Authenticator app” farther down the page to enter the authenticator setup.
What is needed here is an authenticator that supports TOTP, or a time-based one-time password. Once the account is linked, the app generates a fresh six-digit code at regular intervals. It does not have to be a Microsoft product.
Open the authenticator, choose “Add account” or “+,” then choose “Scan QR Code” and point the phone at the QR code on the computer’s web page. Use the authenticator’s scanner, rather than the ordinary scanning function in WeChat or Alipay.
There is another option if scanning does not work: click the blue “setup key” link below the QR code, and GitHub will display a setup key. In the authenticator, choose manual entry, enter GitHub as the account name, and use the string shown on the web page as the key. If a type must be selected, choose “Time-based” or TOTP.
The setup key links the account; the six-digit code generated on the phone verifies your identity. Do not confuse the two, and do not disclose the QR code or setup key publicly.
03 After the Six-Digit Code Come the Recovery Codes
Once a code appeared on the phone, I entered it under “Verify the code from the app” and clicked “Continue.” If a code is about to expire, wait for the next one before entering it. After verification, the page moved to the second step: “Download your recovery codes.”
Scroll down, click “Download,” confirm that the file has been saved, and then click the button to continue. Recovery codes are backup sign-in credentials for when a phone is lost or an authenticator cannot be used. Save them separately in a safe place, rather than keeping them only on the same phone.
In the third step, a green success message appeared: “Two-factor authentication (2FA) is now enabled for your GitHub account.” This meant that setup was complete.
The “Passkeys,” “Security keys,” and “GitHub Mobile” options in the middle of the page are other backup authentication methods that can be configured later. I clicked the green “Return to your work” button at the bottom and was then able to sign in to GitHub.
04 There Is No Need to Pay for an Authenticator After a Three-Day Trial
I use a Huawei phone. Unable to find the Microsoft authenticator mentioned earlier, I found a third-party authenticator with a similar name in the app store. It did generate codes and helped me complete the preceding setup, but I later discovered that its free trial lasted only three days.
“Can generate verification codes” and “is suitable for long-term use” are two things that need to be checked separately. GitHub does not require users to buy a paid authenticator, and the word “Authenticator” in an app’s name does not make it an official Microsoft or Google product.
I later chose Aegis Authenticator. Its official project describes it as a free and open-source Android app for two-factor authentication. It does not have the three-day trial restriction I had just encountered, and it can generate the one-time codes needed by GitHub.
05 How I Installed Aegis on My Huawei Phone
This time, instead of continuing to search the store for similar names, I visited the release page of Aegis’s official GitHub project.
Release page I used https://github.com/beemdevelopment/Aegis/releases/tag/v3.4.3
Step 1: Open the address above in a computer browser, find the “Assets” section, and download aegis-v3.4.3.apk. An APK is an Android app installation package. Do not select “Source code” by mistake.
Step 2: Send the downloaded APK file to your own Huawei phone.
Step 3: Find and open the file on the phone, then follow the system prompts to install it. If the system asks whether to allow the current app to install files, first confirm that the file comes from the official project above, then grant permission as needed.
Step 4: Open Aegis. At this point, I had completed the installation, and what I currently see is free use.
This is the installation route that worked in my own experience. v3.4.3 is the version I used; it may no longer be the latest version when you read this. Whether another Huawei phone can install it depends on whether its system supports Android APKs. Success on my particular phone should not be generalized to every model.
06 After Installation, Confirm That the Account Has Been Migrated
It is important to distinguish the stages reached: I had successfully signed in to GitHub and installed Aegis. Installing a new app, however, does not automatically move the GitHub account out of the old authenticator. Changing authenticators requires linking the account again or migrating it.
According to GitHub’s official instructions, open the profile-picture menu, go to “Settings → Password and authentication,” find “Authenticator app” under “Two-factor methods,” and choose “Edit.” Scan the new QR code with Aegis or manually enter the new setup key. Then enter the six-digit code generated by Aegis into GitHub and click “Save.”
Wait until the new code has been verified and the change saved successfully before dealing with the old authenticator. There is no need to disable two-factor authentication entirely first. Successful installation alone does not establish that migration is complete.
07 What Is GitHub, and Why Get to Know It?
GitHub is a project hosting and collaboration platform built around Git. Git is a version control system that records changes to files; GitHub puts projects online so that they can be shared, discussed, and continually updated.
For friends preparing to attend the salon, a repository, or repo, can initially be understood as a project folder with instructions and a history of updates. It may contain software, materials, templates, or skills for AI to use.
Take yang0/handraw-style as an example: yang0 is the publisher and handraw-style is the repository name. Checking the publisher and project before deciding whether to download is more reliable than searching only for a similar name.
What to Look at First in a Repository
README: find out what problem the project solves and how to install and use it. License: check what kinds of use and adaptation are permitted. Releases: download installation packages published by the author. Issues: review known problems or report a fault. Star: bookmark the project so it is easier to find again; this is not a security certification.
When installing Aegis, I used Releases and downloaded an APK. When installing a skill, we need to locate its entry file, SKILL.md, together with the scripts, references, and assets it depends on. These are different kinds of downloads, so the APK installation method cannot simply be applied to a skill.
Browsing and downloading a public repository generally do not require signing in first. The fact that my account required 2FA on this sign-in does not mean that every public skill requires a login to download. Private repositories or account authorization may require authentication.
A skill is a set of task instructions and resources for AI. It may include a workflow and methods for calling tools. It can help AI follow a particular process to complete a task, but the actual result still depends on the model, available tools, and runtime environment.
GitHub’s official introduction https://docs.github.com/en/get-started/start-your-journey/what-is-github
08 Start with a Hand-Drawn Style Skill
I recently tried installing yang0/handraw-style in WorkBuddy. The conversation returned “Local installation complete” and reported 366 visual styles, 170 layout types, and 36 color themes. The installation feedback is retained below.
Repositories continue to change, and descriptions in different languages may not be updated at the same time. “278 styles” was the description I initially used when asking to find the project; it should not be treated as a fixed current total. Understanding the purpose is more useful than memorizing the numbers.
This project mainly helps generate bilingual image prompts, turning a topic into specific requirements for style, layout, and a color palette. Whether it can generate images directly also depends on the image-generation tools available in WorkBuddy at the time.
Original repository by yang0 https://github.com/yang0/handraw-style
09 Begin with Five Common Skills
I would prioritize the following skills around real tasks for the salon. This is a starter list chosen for common office needs, not a ranking by installation count, and it does not mean that I have tested every one on my own computer. WorkBuddy’s official recommendations also include the four office document skills.
Word Document Skill docx
For creating and editing editable documents. A salon exercise could be: “Turn these discussions into a two-page event briefing, preserve the factual sources, and output a DOCX file.” Check that names, dates, and layout are correct.
Source directory https://github.com/anthropics/skills/tree/main/skills/docx
Presentation Skill pptx
For making or editing slides. Exercise: “Turn the briefing into a six-slide presentation, with one main point per slide, and output an editable PPTX file.” Check for crowded text and readable charts.
Source directory https://github.com/anthropics/skills/tree/main/skills/pptx
Spreadsheet Skill xlsx
For data cleaning, formulas, and summaries. Exercise: “Summarize this sample registration form by participation interest, count participants using formulas, and output an XLSX file.” Check the totals and formulas.
Source directory https://github.com/anthropics/skills/tree/main/skills/xlsx
PDF Processing Skill pdf
For text extraction, splitting, merging, and optical character recognition (OCR) of scanned documents. Exercise: “Extract event information from this PDF and identify the page numbers.” Recognizing text in scans requires additional tools.
Source directory https://github.com/anthropics/skills/tree/main/skills/pdf
Finding Skills Find Skills
If you are unsure what to choose, search for find-skills in WorkBuddy’s skill marketplace. Describe the task first and ask it to compare candidates. Check the publisher and purpose before installing. The four document skills have their own licenses in the original repository; the entire repository should not be treated as having one uniform open-source license. A skill being available does not mean that model calls, credits, or external services are free.
10 How to Install Skills in WorkBuddy and Confirm They Work
Route 1 Use the Skill Marketplace
Open “Experts · Skills · Connectors” on the left, choose “Skills,” and search for docx, pptx, xlsx, pdf, or find-skills. After checking the source, click the “+” on the card, then confirm under “Installed” that it is enabled. The exact interface locations may vary slightly between versions.
A prompt you can copy: “Please search the skill marketplace for a skill suitable for organizing Word documents. List its source and purpose, and check whether a similar skill is already installed. Let me choose before installing.” The official documentation states that this form of conversational marketplace installation covers marketplace skills only.
Route 2 Obtain a Skill from a GitHub Repository
For the hand-drawn style project this time, I delegated the task through a conversation. An example request is: “Please inspect the README, license, and SKILL.md at https://github.com/yang0/handraw-style, locate the skill entry suitable for WorkBuddy, check its dependencies and whether a skill with the same name already exists, then install it and tell me the validation results.” This is a task instruction, not a guarantee that every version can execute it in one step.
If direct import fails, first ask WorkBuddy to assemble a local skill package from the official repository. Retain the SKILL.md, scripts, and referenced assets within the target skill directory. Do not copy only one instruction file, and do not assume that a ZIP of the entire repository is an importable skill package. Then use “Add Skill → Upload Skill” to import a package supported by the interface, checking its structure and dependencies as prompted.
The four document skills come from the skills/docx, skills/pptx, skills/xlsx, and skills/pdf directories in the anthropics/skills repository. If corresponding skills are already available in the marketplace or on your computer, try the existing versions first. If you need repository versions, specify the target subdirectories and licenses to avoid repeatedly installing the entire repository.
Step 3 Validate with a Small Task
Confirm under “Installed” that the skill is enabled, start a new conversation, and explicitly say: “Use the handraw-style skill I just installed to suggest two cover directions for this salon. For now, output only bilingual Chinese–English prompts.” Check whether the intended skill was actually called and whether its output meets the requirements. An installation success message alone does not prove the task is complete.
Use sample materials for the first exercise. If a runtime, image tool, or external service is missing, resolve the dependencies before expanding the task. GitHub sign-in credentials, recovery codes, and keys should not be given to a skill as installation materials.
WorkBuddy’s official skill installation guide https://www.codebuddy.cn/docs/workbuddy/From-Beginner-to-Expert-Guide/Function-Description/Skills-Market
11 A Salon Can Be Organized Around One Deliverable
The WorkBuddy and Skills salon I am preparing could use the same material throughout an exercise: start with an event description, organize it into a briefing with docx, create a presentation with pptx, and then use handraw-style to design cover prompts. Participants do not need to install every skill at once; each person can choose a situation they encounter most often.
These are suggested exercises for a future session, not a record of an event that has already taken place. Validation should focus on opening the actual outputs, checking their facts, formatting, and editability, and comparing ordinary conversation with the use of skills.
Keep a Method You Can Use Next Time
Looking back, what confused me most was not a complex technology, but several things that seemed very similar: Apple sign-in and two-factor authentication, setup keys and one-time codes, a free trial and free use, and completed installation and completed account migration.
Once these are distinguished, the English on the page maps to specific actions: “Select” chooses an authentication method; “setup key” displays the key used to link the account; “Recovery codes” means saving backup codes; and “Return to your work” takes you back to continue.
For an everyday user encountering a verification page, it helps to first understand what is being verified, then decide where to click next. Finding official sources, keeping recovery codes safe, and confirming that a new authenticator really works are small steps that can make the next sign-in more straightforward.
The installation experience in this article is current through October 25, 2026. QR codes have been covered in the article; recovery codes, setup keys, and valid verification codes should not appear in publicly shared illustrations.
Key Terms: Chinese–English Glossary
GitHub: a project hosting and collaboration platform (项目托管与协作平台); Git: a version control tool (版本控制工具); Repository / Repo: 仓库; Public / Private Repository: 公开／私有仓库.
README: project instructions (项目说明); Releases: 版本发布; Assets: release attachments or resources (发布附件或素材), depending on the page; License: 许可证; Issues: problem reports and feedback (问题反馈); Star: bookmarking a project (收藏).
Skill / Agent Skill: 技能／智能体技能; SKILL.md: the skill’s entry instruction file (技能入口说明文件); Workflow: 工作流; Prompt: a prompt or task instruction (提示词或任务指令); Dependencies: 依赖; Scripts: 脚本; References: 参考资料.
2FA / Two-Factor Authentication: 双因素认证; Authenticator: 身份验证器; TOTP / Time-Based One-Time Password: 基于时间的一次性验证码; QR Code: 二维码; Setup Key: 设置密钥; Recovery Codes: 恢复码; Passkey: 通行密钥.
APK / Android Package: an Android installation package (安卓安装包); DOCX: a Word document (Word 文档); PPTX: a PowerPoint presentation (PowerPoint 演示文稿); XLSX: an Excel workbook (Excel 工作簿); PDF / Portable Document Format: 便携式文档格式; OCR / Optical Character Recognition: 光学字符识别.
In the Chinese original, key terms are given in English at their first appearance. Later passages use Chinese or familiar abbreviations to support continuous reading and make interface labels easier to find.
Additional Resources
GitHub’s official introduction https://docs.github.com/en/get-started/start-your-journey/what-is-github
WorkBuddy skill guide https://www.codebuddy.cn/docs/workbuddy/From-Beginner-to-Expert-Guide/Function-Description/Skills-Market
Original repository for the document skills https://github.com/anthropics/skills
Original repository for the hand-drawn style skill https://github.com/yang0/handraw-style
Two-Factor Authentication References
Official Aegis project and its free and open-source description https://github.com/beemdevelopment/Aegis
Aegis v3.4.3 release page https://github.com/beemdevelopment/Aegis/releases/tag/v3.4.3
Configuring two-factor authentication on GitHub https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/configuring-two-factor-authentication
Changing authenticators on GitHub https://docs.github.com/en/authentication/securing-your-account-with-two-factor-authentication-2fa/changing-your-two-factor-authentication-method
About Shuye
Shuye | Professor Quwei Ye
Education researcher, professor, and designer of AI teaching systems.
Former Vice President of Peking University Founder Education Group and former President of Xi’an Technology and Business College. He holds a master’s degree in Artificial Intelligence and Expert Systems from the National University of Defense Technology and was a visiting scholar at Connecticut State University in the United States.
His interests include asking questions with AI, innovation in learning, and personal growth. He developed the Six-Cycle Questioning Framework and hopes to bring ideas from educational research into conversations about reading and everyday life.
Contact
Personal website: www.treeye.cn
WeChat: tree_ye1961
Email: shuye_1961@qq.com
Recent Teaching and Research Work
Teaching practice: Teaches Introduction to Artificial Intelligence, develops interactive courses and course knowledge graphs, and provides training for teachers in AI applications.
Agent development: Develops the AI-PBL-TDA teaching agent and architectures for collaboration among multiple agents to support problem-oriented and project-based learning, emphasizing teacher leadership and evidence review.
Knowledge graphs: Researches knowledge graphs and graph retrieval-augmented generation (GraphRAG), producing thematic reports and interactive graphs that support connections among concepts and tracing back to source texts.
Questioning: Developed the Six-Cycle Questioning Framework of Record, Reflect, Question, Act, Review, and Transform, exploring AI-assisted questioning, reflection, and the transfer of experience.
More work: University Teaching | AI Teaching Lab | Research