Add a skill that reviews Rust code changes against Sentry's Rust
conventions. Covers error handling, iterator patterns, async code,
field visibility, import organization, naming, documentation, and
versioning. Designed to be invoked when validating or finishing a PR.
Based on https://develop.sentry.dev/engineering-practices/rust.md
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* feat(skill-creator): Synthesize upstream best practices into skill-creator
Research and incorporate patterns from Anthropic's and OpenAI's
skill-creators, the Agent Skills spec, and best practices docs.
Adds planning step, description guidelines, validation script,
Claude Code extension docs, workflow/output patterns, and
expanded anti-patterns.
Co-Authored-By: Claude <noreply@anthropic.com>
* docs: Add skill synthesis guide
Document the agent-driven workflow for researching upstream
implementations and best practices when creating new skills.
Pairs with the skill-creator skill — synthesis handles research,
skill-creator handles implementation.
Co-Authored-By: Claude <noreply@anthropic.com>
---------
Co-authored-by: Claude <noreply@anthropic.com>
Add strong steering to both skill descriptions so they are always
triggered in their respective contexts. Update commit skill to
default to creating a feature branch when on main/master unless
the user explicitly asks otherwise.
Co-authored-by: Claude <noreply@anthropic.com>
Review bots (Sentry, Warden, Cursor, Bugbot, CodeQL, etc.) post
actionable code feedback that was being silently ignored because all
bot comments were dumped into a single "bot" bucket. Split bot
classification so review bot feedback flows through LOGAF content
categorization into high/medium/low with a review_bot flag, while
informational bots (Codecov, Dependabot, etc.) remain in the bot
bucket for silent skipping.
Co-authored-by: Claude <noreply@anthropic.com>
Second-pass Warden skill that evaluates first-pass findings and proposes
deterministic lint rules to permanently catch the same patterns. Requires
Warden's multi-pass pipeline (phase 2).
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix(skills): Standardize allowed-tools to comma-separated format
Claude Code docs specify comma-separated format for allowed-tools.
Update all skill frontmatters, documentation, and the scan_skill.py
parser to use and support comma-separated tool lists.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix(skills): Remove model attribute from skill documentation
Skills should not hardcode model overrides — let users control
which model runs their skills.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
* feat: Set up Warden for automated skill security scanning
Adds warden.toml config, GitHub Actions workflow, and .agents/skills
symlink so Warden discovers and runs skill-scanner on PRs that modify
skills.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: Remove paths filter from Warden workflow
Warden.toml already handles path filtering; the workflow should run on
all PRs.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* fix: Use Warden GitHub Action instead of npx
Switch to getsentry/warden@v0 action and match the convention from the
warden repo for env vars and token handling.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Quote the description in django-access-review to fix YAML parse failure
caused by unescaped colons. Remove hardcoded model overrides from
django-access-review, django-perf-review, security-review, and
code-simplifier so skills use the user's default model.
Co-authored-by: Claude <noreply@anthropic.com>
* feat(skills): Add skill-creator skill for guided skill authoring
Adds a new skill that walks agents through creating skills for this
repository, covering requirements gathering, writing SKILL.md with
proper frontmatter, creating supporting files, and completing all
registration steps.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
* ref(skill-creator): Generalize skill to work in any repository
Remove sentry-skills-specific paths and registration steps. The skill
now teaches general Agent Skills spec conventions and defers to the
target repository's CLAUDE.md for project-specific registration.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
Introduces a new skill for reviewing Django codebases for access control
vulnerabilities, with focus on IDOR detection. Unlike pattern-matching
scanners, this skill emphasizes investigation-based review: understanding
the authorization model, tracing data flows, and confirming gaps through
code analysis.
Includes reference docs for Django ORM, views, DRF permissions, and
tenant isolation patterns.
Co-Authored-By: Claude <noreply@anthropic.com>
- Fix re.PatternError when combining patterns with inline (?i) flags by
using re.IGNORECASE flag in re.search() instead
- Add note that scripts must run from repository root directory
- Update all script references to use ${CLAUDE_SKILL_ROOT} for full paths
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
Without explicit Python version metadata, uv defaults to requiring
Python 3.13+, which may not be installed. Adding requires-python = ">=3.9"
ensures compatibility with the Python version the scripts were designed for.
Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
The gh pr checks --json workflow field returns a string, not an object.
The previous code assumed it was a dict with a "name" key, causing an
AttributeError when accessing .get("name") on a string.
Also update SKILL.md to use uv run instead of python directly, and add
skill design guideline to AGENTS.md for consistent script invocation.
Co-authored-by: Claude <noreply@anthropic.com>
The union syntax (dict | list) requires Python 3.10+. Adding
`from __future__ import annotations` enables this syntax on 3.7+.
Co-Authored-By: Claude <noreply@anthropic.com>
* feat(iterate-pr): Add scripts for structured CI and feedback data
Add helper scripts that pre-process GitHub API data to reduce token
usage and improve feedback categorization:
- fetch_pr_checks.py: Fetches CI checks and extracts relevant failure
snippets using pattern matching instead of full logs
- fetch_pr_feedback.py: Categorizes PR feedback as blocking, suggestion,
bot, or resolved
Update SKILL.md to:
- Reference the optional helper scripts with fallback to gh commands
- Add Step 6 for handling subjective feedback with user prompts
- Present suggestion-type feedback as numbered list for user selection
Co-Authored-By: Claude <noreply@anthropic.com>
* ref(iterate-pr): Make scripts primary, reduce verbosity
Restructure SKILL.md to follow OpenAI skill patterns:
- Scripts are now the primary approach, not optional
- Reduced from 185 to 131 lines by removing redundant gh CLI docs
- Moved fallback commands to a single section at the end
- Clearer workflow with numbered steps
Co-Authored-By: Claude <noreply@anthropic.com>
* feat(iterate-pr): Support LOGAF scale for feedback categorization
Update fetch_pr_feedback.py to detect and use Sentry's LOGAF scale:
- h: / [h] / high: → high priority (must fix)
- m: / [m] / medium: → medium priority (should fix)
- l: / [l] / low: → low priority (optional)
Categories renamed from blocking/suggestion to high/medium/low to
align with Sentry's code review guidelines.
Refs: https://develop.sentry.dev/engineering-practices/code-review/#logaf-scale
Co-Authored-By: Claude <noreply@anthropic.com>
---------
Co-authored-by: Claude <noreply@anthropic.com>
Sync the code-simplifier agent as a skill to make it directly usable in
Warden. Adds SKILL.md with frontmatter, examples, and refinement
principles based on Anthropic's official code-simplifier agent.
- Add missing quotes around skill name in JSON example
- Remove "Missing Prefetch on Single Object" category - 2 queries vs 1
on a single fetch is a micro-optimization not worth reporting
- Add explicit guidance in "What NOT to Report" section
Co-Authored-By: Claude <noreply@anthropic.com>
Add skill for reviewing Django code for validated performance issues:
- N+1 queries with full data flow tracing
- Unbounded querysets and pagination
- Missing database indexes
- Write loops (bulk_create/update patterns)
- Missing prefetch on single object fetches
Includes validation requirements and false positive guidance to ensure
only real, impactful issues are reported.
Co-Authored-By: Claude <noreply@anthropic.com>
The skills CLI parser expects YAML frontmatter to be at the very
beginning of the file. The HTML attribution comment was preventing
the skill from being detected.
Also updated docs to clarify frontmatter positioning requirements.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Simplify installation to two primary methods (Claude Code marketplace
and skills.sh) and consolidate all developer content under Contributing.
Apply Plain Speech guidelines with concise, direct language.
Co-authored-by: Claude <noreply@anthropic.com>
Add a focused security code review skill that evaluates specific files
or changes against OWASP vulnerability patterns.
Features:
- 10 security categories: Injection, XSS, Auth, Authorization, Crypto,
Data Exposure, SSRF, Deserialization, File Operations, Modern Threats
- Reference files with detailed patterns and remediation guidance
- Reports only actual vulnerabilities, not best-practice suggestions
- Focused on single file/change review, not codebase mapping
Reference material derived from OWASP Cheat Sheet Series (CC BY-SA 4.0).
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Create PRs in draft state by default, giving authors time to review
before requesting feedback. Skip fetching repository PR templates in
favor of the skill's own consistent format.
Co-authored-by: Claude <noreply@anthropic.com>
Explains the three-tier approach for skill placement:
- Global skills in sentry-skills plugin
- Domain-specific skills in dedicated plugins (e.g., infra-skills)
- Repo-specific skills in the repository itself
Also documents how the marketplace structure works - this repo can
host multiple plugins that users install independently.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Explains why we vendor skills (consistency, customization, reliability)
and how to retain attribution via comments and LICENSE files.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Add the doc-coauthoring skill from anthropics/skills to help Sentry
employees with structured documentation workflows for proposals,
technical specs, decision docs, and similar content.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Add a new skill that helps write copy following Sentry's brand
guidelines. Covers both Plain Speech (default for UI) and Sentry Voice
(personality-rich) tones, with guidance on tone selection, word choices,
dash usage, UI element guidelines, and anti-patterns.
Co-authored-by: Claude <noreply@anthropic.com>
* fix(create-pr): Replace broken gh pr edit with gh api
The `gh pr edit` command fails with a GraphQL error about Projects
(classic) deprecation, even when editing unrelated fields like title
or body. Use `gh api` PATCH requests instead which bypass this issue.
- Remove Step 5 "Add Reviewers" section that used gh pr edit
- Add new "Editing Existing PRs" section with working gh api commands
Co-authored-by: Claude <noreply@anthropic.com>
* Replace deslop skill with code-simplifier
- Add new code-simplifier skill with comprehensive simplification guidelines
- Remove old deslop skill directory
- Update README.md to reference code-simplifier instead of deslop
- Update .claude/settings.json with code-simplifier permission
- Update claude-settings-audit skill to include code-simplifier in recommendations
The code-simplifier skill is based on Anthropic's approach and provides more comprehensive code simplification beyond just removing slop, including simplifying complex logic, removing unnecessary abstractions, and improving code readability while maintaining functionality.
Co-authored-by: david <david@sentry.io>
* Convert code-simplifier from skill to subagent
- Create agents/ directory for subagents
- Add code-simplifier.md subagent using Anthropic's official version
- Remove code-simplifier from skills directory
- Update README.md to document subagents separately from skills
- Update .claude/settings.json to remove code-simplifier skill permission (subagents don't require permissions)
- Update claude-settings-audit to not recommend code-simplifier skill
- Update repository structure documentation
The code-simplifier is now a proper subagent following Anthropic's official implementation from claude-plugins-official repo.
Co-authored-by: david <david@sentry.io>
* Add attribution for code-simplifier subagent
- Add source attribution comment to code-simplifier.md pointing to Anthropic's official repo
- Create agents/README.md to document subagents and their sources
- Ensures proper credit and traceability for externally sourced subagents
Co-authored-by: david <david@sentry.io>
* Update attribution to note prior art without license
- Changed attribution from license reference to prior art acknowledgment
- Verified that anthropics/claude-plugins-official has no license file
- Updated both code-simplifier.md and agents/README.md accordingly
- Clarifies we're noting this as prior art from Anthropic rather than claiming any specific license
Co-authored-by: david <david@sentry.io>
* Simplify attribution to just note source
- Remove license commentary from code-simplifier.md
- Remove license mention from agents/README.md
- Keep clean attribution showing it's based on Anthropic's subagent
Co-authored-by: david <david@sentry.io>
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Update the create-pr skill to fetch and respect the repository's PR template before writing the PR description.
Previously, the skill would always use its default structure for PR descriptions. Now it first checks for a PR template using gh repo view --json pullRequestTemplates and instructs the agent to follow that template's structure when one exists.
This ensures PRs created by the agent match the expected format for each repository and fill in all required sections defined by the repo maintainers.
Fetch the repository's PR template using `gh repo view --json
pullRequestTemplates` before writing the PR description. This ensures
PRs follow the repo's expected format and fill in required sections.
Co-Authored-By: Claude <noreply@anthropic.com>
Establish contribution philosophy emphasizing incremental change and
self-review as the default workflow. Include instructions for testing
skills locally and a checklist for adding new skills.
Co-Authored-By: Claude <noreply@anthropic.com>
New skill that guides agents to create and maintain concise AGENTS.md
documentation with CLAUDE.md as a symlink. Enforces minimal style with
headers, bullets, and skill references instead of verbose prose.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Apply the same gh repo view pattern for consistency across all skills
that diff against the default branch.
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
lcian