Add a source-backed skill for reviewing and rewriting public APIs,
names, and contract docs toward simple, explicit interfaces.
Ground the guidance in positive and contrast examples across
TypeScript and Python, including oRPC, requests, Remix,
better-auth, ts-rest, and Next.js. Include transformed examples,
trigger sets, and the required skill registration updates.
Co-Authored-By: OpenAI Codex <codex@openai.com>
best used as following for full output
```
claude --agent sentry-skills:senpai
explain relay's role in sentry's infrastructure
```
or like this which delegates to subagent but does an extra step of
unnecessary summarizing
```
ask senpai to explain relay's role in sentry's infrastructure
```
outputs below are single question, agent invokations
- Create an interactive HTML presentation in a Sentry-themed light mode
- Build in node, preview locally with hot-reload and export to a single
HTML file in the /dist folder
- Use Recharts to visualize data interactively using Tableau's chart
pallette
- Provide sane defaults for slide types and structure
- Contains a Sentry svg for logo and watermark
Align commit attribution wording to require the agent's name and
attribution byline everywhere this guidance appears.
This updates AGENTS.md, the agents-md skill, and the commit skill so
they consistently use the same placeholder format and avoid the older
'agent model' phrasing.
It also strengthens the commit skill with explicit guidance to avoid
literal \n sequences in commit messages and to use properly formatted
multiline commit bodies.
Co-authored-by: GPT-5 Codex <noreply@openai.com>
Merge skill synthesis into `skill-writer` so there is one canonical flow
for creating and improving skills.
**Canonical workflow consolidation**
`skill-writer` now owns synthesis, authoring, iteration, evaluation, and
registration in one path. This removes split ownership between creation
and synthesis and makes outcomes more consistent.
**`skill-creator` compatibility behavior**
`skill-creator` is now an alias entrypoint rather than a separate
framework. Existing prompts still work, but execution routes to the
canonical `skill-writer` behavior.
**Input-depth and coverage gates**
The workflow now explicitly prioritizes broad source collection before
authoring. It adds coverage/depth gates to reduce shallow skills and
force clearer gap handling.
**Provenance and iteration tracking**
Skill synthesis now records sources and change history in `SOURCES.md`
instead of adding heavy attribution blocks in `SKILL.md`. This improves
traceability and makes iterative updates easier to audit.
**Case-study guidance quality**
Reference examples were upgraded from generic guidance to case-study
style patterns with concrete source-to-decision framing. This is
intended to improve synthesis quality for future skills.
**Cross-agent execution consistency**
Guidance was normalized to be generic across Claude and Codex, with
script execution clarified around `uv run` and skill-directory script
paths. This keeps the workflow portable while staying operationally
concrete.
---------
Co-authored-by: GPT-5 Codex <noreply@openai.com>
* docs: list all available skills
* docs(skills): Align registration guidance and skill allowlists
Require alphabetical ordering when updating the Available Skills table\nin contributor guidance and skill creation workflow docs.\n\nSynchronize skill allowlists with the actual sentry-skills directory so\nautomatic skill injection guidance reflects all available skills.\n\nCo-Authored-By: GPT-5 Codex <noreply@openai.com>
---------
Co-authored-by: shuofengzhang <sofuncheung16@gmail.com>
* ref(skills): Rename PR and skill authoring workflows
Promote pr-writer and skill-writer as canonical skill names while\nkeeping create-pr and skill-creator as compatibility aliases.\n\nUpdate skill registration, settings allowlists, and documentation\nreferences to prefer canonical names.\n\nExtend skill-writer guidance with capability-first naming practices\nand examples for clearer skill discovery.
Co-Authored-By: GPT-5 Codex <noreply@openai.com>
* fix(skills): Address review bot feedback on skill rename
Restrict skill-writer with an explicit allowed-tools frontmatter field,\nremove dead code in quick_validate, and delete orphaned duplicate\nreferences/scripts from the skill-creator alias directory to avoid drift.
Co-Authored-By: GPT-5 Codex <noreply@openai.com>
* fix(skills): Drop allowed-tools from skill-writer
Keep skill-writer frontmatter compatible across clients by avoiding\nthe optional allowed-tools field while retaining the other review\nfixes in this PR.
Co-Authored-By: GPT-5 Codex <noreply@openai.com>
* docs(skill-writer): Default to omitting allowed-tools
Clarify that skill authoring should avoid allowed-tools unless a user\nexplicitly requests strict tool scoping or repo policy requires it,\nsince allowlist syntax differs across clients.
Co-Authored-By: GPT-5 Codex <noreply@openai.com>
* docs(pr-writer): Include update flows in skill discovery text
Expand pr-writer trigger language to explicitly cover updating PR artifacts\nlike title and description, not only creating a new PR.\n\nAlso align the README skill table description so repository docs\nmatch the canonical skill wording.
Co-Authored-By: GPT-5 Codex <noreply@openai.com>
---------
Co-authored-by: GPT-5 Codex <noreply@openai.com>
Replace git config user.name lookup with gh api user --jq .login so the
branch prefix always matches the user's actual GitHub handle.
Co-Authored-By: Claude <noreply@anthropic.com>
Add a new skill for reviewing GitHub Actions workflows for security
vulnerabilities, covering expression injection, pwn requests, supply
chain attacks, credential escalation, and AI prompt injection via CI.
Includes reference documentation for all major GHA attack vectors.
Also updates AGENTS.md to the concise agent-instructions format and
registers the new skill in settings and the claude-settings-audit allowlist.
Co-Authored-By: Claude <noreply@anthropic.com>
Replace skill-discovery focus with project-analysis approach. Add line
budget guidance (target 60, max 100), file-scoped commands section,
and anti-patterns for linter duplication. Remove Local Skills required
section since agents discover skills automatically. Rewrite AGENTS.md
for this repo to follow the updated guidance.
Co-authored-by: Claude <noreply@anthropic.com>
Reduce SKILL.md from 446 to 186 lines (58%) by removing content that
was duplicated across sections or controlled by Warden. Modeled after
the sentry-security skill structure (Step 1-4 pattern).
Removed: Phase 1 (file discovery, Warden provides files), Phase 2
(duplicate of Reference Files table), Phase 4 (duplicate of Core
Principles), Phase 5 (duplicate of validation section), Quick Patterns
Reference (duplicates safe patterns table + reference files),
Attacker-Controlled Expressions table (moved to reference file),
standalone Severity Model (replaced with confidence model), and ~10
inline repetitions of the external attacker concept.
Added confidence model (HIGH/MEDIUM/LOW) matching sentry-security
pattern. Moved attacker-controlled expressions quick reference table
to references/expression-injection.md where it belongs.
Co-Authored-By: Claude <noreply@anthropic.com>
Agent transcript: https://claudescope.sentry.dev/share/spByNq2HxKsjIIoMtNrC7sncSkRu68d6dqVVv7xZ4k0
Refine the skill to reduce false positives:
- Add "external attacker threat model" principle: only report vulns
exploitable without write access. workflow_dispatch input injection,
push-to-protected-branch expression injection, and schedule-only
secrets are not findings.
- Add "validate before reporting" principle: require reading the actual
workflow YAML and tracing every link in the attack chain before
reporting. Pattern matching alone is not enough.
- Expand Phase 5 into a structured validation gauntlet (prove attack
path, check mitigations, confirm impact) with a table of checks
that must pass before a finding is reported.
- Move workflow_dispatch inputs and commit messages on push to the
"safe expressions" table with rationale.
- Add "Do NOT Flag" and "Not a finding" sections to quick patterns
and severity model.
- Update expression-injection.md to mark workflow_dispatch as not a
finding and add nuance to commit message injection.
Co-Authored-By: Claude <noreply@anthropic.com>
Agent transcript: https://claudescope.sentry.dev/share/lxT27jHfwxvYtwFoKykzZV-XILSBNXhdMCKRNCjKvFY
Replace the complex stash state machine with concise, principle-based
instructions that trust the agent's judgment. Fixes the bug where
git stash pop ran unconditionally on checkout failure even when no
changes were stashed.
Co-Authored-By: Claude <noreply@anthropic.com>
Detect the primary remote by preferring "origin" if it exists rather than
taking the first alphabetical remote. Also instruct the agent to restore
the stash if the user cancels at any point after stashing, preventing
changes from being silently left in the stash.
Co-Authored-By: Claude <noreply@anthropic.com>
Add instructions to restore stashed changes if `git checkout <default-branch>`
fails or if `git checkout -b <branch-name>` fails, so the user's work is
never silently left in the stash when an error occurs.
Co-Authored-By: Claude <noreply@anthropic.com>
Reword the collision block to make it unambiguous that the user is always
asked to choose a different name when a collision is detected, whether or
not changes were stashed, preventing the agent from skipping the collision
path and attempting to create an already-existing branch.
Co-Authored-By: Claude <noreply@anthropic.com>
When a collision is detected and changes were stashed, restore the stash
and clear the stashed flag before returning to Step 4, so the final
restore step does not attempt a second stash pop on a new name attempt.
Co-Authored-By: Claude <noreply@anthropic.com>
Detect the primary remote via `git remote | head -1` and use it for
default-branch detection and remote branch existence checks, so repos
with a non-origin primary remote (e.g. upstream forks) work correctly.
Co-Authored-By: Claude <noreply@anthropic.com>
- Strip trailing whitespace from default branch detection output
- Clarify abort path: stop skill if user aborts stash prompt
- Restore stash before informing user of branch name collision
- Add re-check in commit skill to verify branch changed before committing
Co-Authored-By: Claude <noreply@anthropic.com>
- Check refs/remotes/origin/ in addition to refs/heads/ to detect remote branch collisions
- Clarify in commit skill that create-branch still proposes a name for confirmation;
only the decision to create a branch at all is skipped
Co-Authored-By: Claude <noreply@anthropic.com>
After switching to the default branch and creating a new branch,
run git stash pop to restore any changes that were stashed earlier
in the workflow.
Co-Authored-By: Claude <noreply@anthropic.com>
Use git show-ref with refs/heads/ to only match local branches,
not remote branches or tags, before creating a new branch.
Co-Authored-By: Claude <noreply@anthropic.com>
- Use git diff without --stat so agent reads actual content, not just filenames
- Strip non-ASCII characters from username prefix to ensure valid branch names
- Ask user when both main and master exist instead of blindly defaulting to main
Co-Authored-By: Claude <noreply@anthropic.com>
When the user chooses to switch to the default branch first, the skill
was missing the git checkout step, causing the new branch to be created
from the wrong base.
Co-Authored-By: Claude <noreply@anthropic.com>
When git branch --show-current returns empty, detect the detached HEAD
and show the current commit, so the user understands their state before
choosing where to branch from.
Co-Authored-By: Claude <noreply@anthropic.com>
When neither main nor master exists, defaulting to main would cause
git checkout to fail. Ask the user instead.
Co-Authored-By: Claude <noreply@anthropic.com>
Replace the inline branch naming logic with a reference to the
create-branch skill to ensure consistent naming conventions across both skills.
Co-Authored-By: Claude <noreply@anthropic.com>
Reorder Step 5 so the default branch is detected before it's used
in the non-default branch check. Replace the vague fallback with a
concrete `git branch --list main master` command, explicit precedence
rules (main > master > fallback to main), and add `git branch
--show-current` to retrieve the current branch name for the comparison.
Co-Authored-By: Claude <noreply@anthropic.com>
Adds a new skill that creates git branches following Sentry naming
conventions. Detects the username from git config, inspects local
changes or prompts for context, classifies the work type, and
proposes a branch name before creating it.
Co-Authored-By: Claude <noreply@anthropic.com>
gh pr checks exits non-zero when any check is failing or pending, so
check=True raises CalledProcessError and discards all check data.
Remove it to allow parsing output regardless of exit code.
Co-Authored-By: Claude <noreply@anthropic.com>
Change PR review reply signature from bullet point (`- Claude Code`) to
italic format (`*— Claude Code*`) for better visual separation. Also
improves duplicate detection to match both hyphen and em-dash variants.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Without check=True, subprocess.run silently succeeds even when gh
returns non-zero, making the CalledProcessError handler dead code.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The get_checks() function was using an unsupported --json flag with
gh pr checks. Replace with direct subprocess call that parses the
tab-separated text output format (name, status, duration, URL).
Co-Authored-By: Claude <noreply@anthropic.com>
David Cramer