Add a source behavior spec and TypeScript eval coverage for the code-simplifier skill. Split eval cases by behavior so they can run with controlled concurrency.
Co-Authored-By: Codex <codex@openai.com>
Remove named cross-skill invocations from the `commit` and `pr-writer`
skills, and add an Independence principle to
`skill-writer/references/design-principles.md` so future skills are
authored the same way.
**Why.** Skills that name another skill in their runtime instructions
silently break in three ways: the named skill may not be installed, it
may be renamed, or it may be overridden by a user's own skill of the
same name. `commit` pointed at `create-branch`; `pr-writer` pointed at
`sentry-skills:commit`. Both now state the intent directly and trust
skill discovery to pick up whatever matches.
**Scope of the principle.** The rule targets *runtime dependency*:
agent-facing instructions and loaded resources must not assume another
skill is present. Non-runtime mentions — provenance logs, audit
allowlists, human-facing eval prompts — are fine.
`claude-settings-audit` enumerates every skill name because that is its
job, and `prompt-optimizer/SOURCES.md` cites `skill-writer` as a
synthesis source; both are intentional exceptions carved out in the
principle's text.
**What changed.**
- `skills/commit/SKILL.md` — drop `create-branch` references; keep the
"branch off main/master first" requirement inline.
- `skills/pr-writer/SKILL.md` — drop `sentry-skills:commit` references;
keep the "commit first" requirement inline.
- `skills/skill-writer/references/design-principles.md` — add an
Independence section with do/don't examples and the runtime-scope
carve-out.
- `skills/skill-writer/EVAL.md` — remove the
`sentry-skills:skill-writer` self-reference from the sample eval prompt.
---------
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Close three open enhancement issues on the `prompt-optimizer` skill by
filling
gaps where the skill was either silent or actively nudging authors
toward
weaker patterns. All edits land in the existing skill structure — no new
workflow steps, no new reference files.
## What changed
**#120 — tool policy vs. native tool disclosure**
- Renamed the `<tools>` marker to `<tool_policy>` in the portable
skeleton,
Example 1, and the canonical "good section names" list.
- Added a note in `core-patterns.md` and one line per provider section
in
`model-family-notes.md` clarifying that tool schemas are disclosed via
the
provider-native `tools` parameter (Anthropic, OpenAI, Gemini) — the
prompt
should carry policy, not schema restatements.
- Tightened the "Layer the prompt correctly" long-prompt bullet to
match.
**#121 — layered prompts with multiple owners**
- New `### Layered prompts with multiple owners` subsection in
`core-patterns.md` covering the platform-layer vs.
deployer-persona-layer
split (`SOUL.md`, `CLAUDE.md`, `AGENTS.md`).
- The invariant: the deployer layer is voice-only; platform behavior
rules
must still fire if the deployer layer is empty or sparse.
- Cross-reference added from `SKILL.md` Step 3.
**#122 — directives in descriptive markers**
- New `### Where rules live` subsection in `core-patterns.md` noting
that
descriptive markers (`<context>`, `<state>`, `<turn-state>`,
`<environment>`) read as data and state-conditional directives buried
in them can underperform the same directive in a canonical rules section
(`<behavior>`, `<constraints>`, `<tool_policy>`, `<workflow>`).
- New bullet in "High-value prompt moves".
- New `## Example 4` in `transformed-examples.md` with the resume-notice
before/after (0.5 → ≥0.75 on the relevant eval with no other change).
## Why
Each issue came with a concrete field finding. The skill was either
silent
on the topic (#121 layered prompts, #122 rule placement) or actively
nudging
authors toward the weaker pattern (#120 enumerating tools in the
prompt).
The edits keep the skill's "empirical finding → rule" voice and stay
inside
the existing file structure.
## Prior art consulted
Rather than rely purely on the field observations in the issues, I
checked
authoritative sources for each claim:
- [Anthropic tool-use
docs](https://platform.claude.com/docs/en/agents-and-tools/tool-use/overview):
"When you call the Claude API with the tools parameter, the API
constructs
a special system prompt from the tool definitions, tool configuration,
and
any user-specified system prompt" — schemas are injected automatically.
- [pi-agent-core](https://github.com/badlogic/pi-mono)
`packages/agent/src/agent-loop.ts`:
LLM is invoked with `llmContext = { systemPrompt, messages, tools }` —
tools
are a distinct native parameter alongside prompt text.
- [OpenAI Codex CLI system
prompt](https://github.com/openai/codex/blob/main/codex-rs/core/gpt-5.1-codex-max_prompt.md):
references tools contextually as policy ("prefer `rg` for searching")
and
does not restate schemas.
- [Hermes Agent
SOUL.md](https://hermes-agent.nousresearch.com/docs/user-guide/features/personality)
and [soul-md.xyz](https://www.soul-md.xyz/): direct industry prior art
for
the platform + persona layering model (SOUL.md for voice, AGENTS.md for
project, platform defaults code-level). Hermes explicitly falls back to
a
built-in default identity when SOUL.md is empty — the pattern the skill
now documents.
Notably, Codex and Claude Code system prompts both do embed directives
in
descriptive sections in places, so the #122 guidance is scoped to
state-conditional rules where the author's eval showed a measurable gap,
not an absolute rule against context-section prose.
Fixes#120Fixes#121Fixes#122
---------
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Extract the iterate-pr monitor loop into a bundled script and update the
skill docs to point at that script instead of embedding the polling
behavior inline.
This follow-up also fixes `skill-writer`'s path guidance. The repo
already standardizes on `${CLAUDE_SKILL_ROOT}` for bundled skill assets,
so `skill-writer` should preserve that prior art instead of treating it
as invalid by default.
Keeping the monitor behavior in `scripts/monitor_pr_checks.py` makes the
CI-wait logic easier to maintain and keeps the Claude-only `MonitorTool`
guidance tied to repo-shipped behavior instead of a markdown shell
snippet.
Validated with `uv run skills/iterate-pr/scripts/monitor_pr_checks.py
--help`, `uv run skills/skill-writer/scripts/quick_validate.py
skills/iterate-pr --skill-class workflow-process --strict-depth`, and
`uv run skills/skill-writer/scripts/quick_validate.py
skills/skill-writer --skill-class skill-authoring --strict-depth`.
---------
Co-authored-by: OpenAI Codex <noreply@openai.com>
hello! full transparency: this is a claude-authored pr. i'm hopping in
on the description just to say hi.
i have my own personal skill, very similar to this one, for monitoring
PRs. i just updated mine to use the new Monitor tool in claude code, and
thought i'd propose such a change here
my impression was this skill is claude specific, so it's fine to call
out a specific claude code tool like `MonitorTool` in the skill itself
([docs](https://code.claude.com/docs/en/tools-reference#monitor-tool))
without ado, the pr description from claude:
***
Replace the `sleep 30` polling loop in step 7 with MonitorTool guidance.
The MonitorTool runs a background script that streams stdout lines as
notifications, avoiding burning context on repeated sleep/poll cycles.
- Add concrete polling script with transient error handling
- References 'MonitorTool' for explicit tool discovery
- Link to docs:
https://code.claude.com/docs/en/tools-reference#monitor-tool
- Link to CC pm's announce-tweet:
https://x.com/noahzweben/status/2042332268450963774?s=20
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Co-authored-by: David Cramer <dcramer@gmail.com>
Co-authored-by: OpenAI Codex <noreply@openai.com>
Make repo-root `skills/` and `agents/` the canonical source for the
`sentry-skills` plugin by loading the plugin from repo root instead of
from `plugins/sentry-skills`.
The earlier refactor moved the tree to top level, but leaving a
plugin-local `skills` symlink still created a loader risk for
marketplace installs. This removes that dependency entirely: the
marketplace entry now points at `./`, the root plugin manifest uses
repo-root `skills/` and `agents/`, and the old plugin-local `skills`
path goes away.
This pass also tightens the repo guidance around standard skill
locations. `skill-writer` goes back to using `.agents/skills` as its
default local target, `skill-writer` and `skill-scanner` now explicitly
recognize canonical `skills/<name>/` roots, and the repo docs and
registrations are updated to match the new layout, including
`presentation-creator`.
I validated the change with strict-depth validation for `skill-writer`
and `skill-scanner`, plus a local Claude marketplace add/install smoke
test that produced real `skills/` and `agents/` directories in the
installed plugin cache without any plugin-local `skills` symlink.
---------
Co-authored-by: Codex <noreply@openai.com>
Co-authored-by: Codex <codex@openai.com>
Add a new canonical `prompt-optimizer` skill for creating and refining
agent prompts, system prompts, and reusable prompt templates.
This packages the current prompt guidance we found across OpenAI,
Anthropic, and Gemini into one workflow-oriented skill instead of a
loose collection of tips. The skill covers prompt contracts,
model-family adapters, marker discipline, eval-driven iteration,
and transformed examples.
The later update tightened the skill around prompt compaction and
clarity. It now has an explicit prompt-learnings pass for removing
low-value prompt text, collapsing duplicated instructions, separating
policy from evidence, and ordering long-context inputs deliberately.
The supporting `SOURCES.md` records the local `skill-writer` basis,
provider docs, and prompt-optimization research used to shape the
workflow. The PR also registers the new skill in the public README,
project settings, and the `claude-settings-audit` allowlist.
Add a new `typing-exclusion-worker` skill and register it for discovery.
This workflow is intended to be reused across Python repositories such
as
`sentry` and `getsentry` where teams remove modules from mypy exclusion
overrides in `pyproject.toml` and need a consistent fix-and-validate
loop.
I considered including Python directly in the skill name, but kept the
broader
`typing-exclusion-worker` name and moved Python to the front of the
description instead. That keeps naming flexible while making trigger
matching
for Python workflows explicit.
The skill is registered in the public skills inventory and allowlists so
agents
can discover and invoke it reliably.
Move Python to the front of the typing-exclusion-worker description so
trigger matching is clearer for Python repos and the README wording stays in
sync with the skill metadata.
Co-Authored-By: Codex 5.3 <codex@openai.com>
Made-with: Cursor
Add the typing-exclusion-worker skill to the canonical skills tree and register
it so agents can discover and use it consistently across repos with pyproject-
based mypy configuration.
Co-Authored-By: Codex 5.3 <codex@openai.com>
Made-with: Cursor
## Summary
Adds two new sections to the blog writing skill based on editorial
feedback from Greg Kumparak and SEO learnings from the agent monitoring
blog posts.
### Formatting for Skimmability
- Break paragraphs at contrast/pivot points (when sentence shifts to
"but"/"however")
- One idea per paragraph, shorter is better for online reading
- No em dashes in blog formatting
- Good/bad example showing the line break pattern
### SEO for Developer Content
- Lead generic (tool-agnostic educational content), close specific
(product as example)
- Put target keywords in H2 headings
- Include definitional "What is X?" sections for head terms
- Add FAQ for long-tail keyword targeting
These came from a real editing session where Greg reviewed two Sentry
blog drafts and identified consistent patterns around paragraph breaks
at contrast points and skimmability. The SEO section came from an Ahrefs
content analysis where we found competitors outranking us by leading
with tool-agnostic content.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
- SEO section now cross-references Section Headings instead of
repeating the same weak heading examples
- Product-page closer guidance moved from AI Patterns into The Closing
section where it belongs
- The Closing section expanded to cover what not to do (hype, recaps,
sales CTAs) alongside what to do
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Examples now use generic debugging/deployment scenarios instead of
agent-monitoring-specific ones so the guidance applies to any post.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Each pattern now has concrete bad and good examples so the agent can
pattern-match against specific phrasings rather than abstract rules.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Add a concise checklist of common LLM-generated prose patterns to flag
and rewrite: staccato fragments, bumper-sticker aphorisms, three-beat
reveals, smug simplicity, parallel ad copy, missing mid-post personality,
and product-page closers.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
## What
Rewrites step 5 (Fix CI Failures) with more explicit, actionable
investigation requirements.
## Why
Agents were skipping thorough investigation and guessing at fixes —
often dismissing upstream feedback as a false positive without doing the
actual work to verify. This rewrite makes it unambiguous that:
- Investigation is **mandatory** before touching code
- The full log must be read (not just the snippet)
- The agent must be able to articulate the root cause before fixing
- Apparent false positives must be fully investigated before being
dismissed
- Related instances must be found and fixed
## Changes
- Adds a hard preamble: investigation is mandatory, no guessing
- Expands the 4-step list to 7 explicit steps with bolded directives
- Removes the soft 'Do NOT' caveats and replaces with affirmative
requirements
---------
Co-authored-by: Junior <junior@sentry.io>
Clean break from legacy alias skills. No compat shims, no forwarding
aliases — just canonical skill names.
## Removed
### `create-pr`
Alias for `pr-writer`. Was actively causing routing problems — agents
were landing on `create-pr` instead of the canonical skill.
### `skill-creator`
Alias for `skill-writer`. Same problem: alias existence invites routing
to the wrong skill.
## Also cleaned up
- `.claude/settings.json` — removed both from the allow list
- `AGENTS.md` — removed alias mentions
- `claude-settings-audit/SKILL.md` — removed expected entries for both
- `skill-writer/SOURCES.md` and
`skill-writer/references/synthesis-path.md` — removed `skill-creator`
source references
---------
Co-authored-by: junior <junior@sentry.io>
Co-authored-by: junior <noreply@sentry.io>
Add two new sections based on editorial feedback from Greg Kumparak
and SEO learnings from agent monitoring blog posts:
Formatting for Skimmability:
- Break paragraphs at contrast/pivot points
- One idea per paragraph
- No em dashes in blog formatting
SEO for Developer Content:
- Lead generic (tool-agnostic), close specific (product examples)
- Put target keywords in H2 headings
- Include definitional "What is X?" sections
- Add FAQ for long-tail keywords
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Skill reference docs were using `axios` in code examples even though
native
`fetch` is available everywhere Node.js is used today. Skills shouldn't
nudge agents toward installing a third-party HTTP client when the
platform
API works fine.
Changes across three security-review reference files:
- **ssrf.md** — Rewrote the `safeFetch` Node.js example to use `fetch`
with
`redirect: 'error'` and `AbortSignal.timeout()` instead of axios
options.
- **javascript.md** — Removed the `axios.get(userUrl)` SSRF flag line;
`fetch`
and `http.get` already cover the pattern.
- **supply-chain.md** — Swapped `"axios": "latest"` for `"left-pad":
"latest"`
in the vulnerable version-range example, which is also a better fit for
a
supply-chain context.
The grep detection pattern in ssrf.md was intentionally left alone since
it
should still detect axios usage in audited codebases.
Skill reference docs should not recommend third-party HTTP clients when
the native fetch API covers the same use cases. Swap axios for fetch in
the SSRF safe-fetch example, remove the redundant axios SSRF flag pattern,
and replace axios with left-pad in the supply-chain version pinning example.
<!-- CURSOR_AGENT_PR_BODY_BEGIN -->
## Summary
Moves the `*— Claude Code*` attribution from the SKILL.md prompt
instructions into the `reply_to_thread.py` script itself. The script now
automatically appends the attribution if not already present, preventing
duplicates and ensuring consistent attribution without requiring agents
to manually add it.
## Changes
- **`scripts/reply_to_thread.py`**:
- Enhanced `_normalize_body()` to automatically append `*— Claude Code*`
attribution if not already present
- Uses regex pattern `^\*[—-]\s+.+\*$` to detect any bot signature on
the last line (supports both em-dash and hyphen variants)
- Detects signatures from any bot (Claude Code, Cursor, etc.) without
maintaining a hardcoded list
- **`SKILL.md`**: Updated documentation to reflect that attribution is
now automatic, removed manual attribution instructions from the prompt
## Motivation
This addresses feedback about ensuring attribution is automatically
enforced rather than prompt-based. By moving this logic into the script,
we:
- Ensure consistent attribution on all replies
- Prevent agents from forgetting to add attribution
- Reduce prompt complexity
- Make attribution enforcement more reliable
- Support any bot signature format without code changes
## Testing
Verified the regex-based attribution logic handles:
- Messages without attribution → adds `\n\n*— Claude Code*`
- Messages with `*— Claude Code*` → no change
- Messages with `*- Claude Code*` → no change (preserves existing
variant)
- Messages with other bot signatures (`*— Cursor*`, `*- Another Bot*`) →
no change
- Multi-line messages → proper spacing before attribution
- Bot signatures in the middle of text → adds attribution (only checks
last line)
<!-- CURSOR_AGENT_PR_BODY_END -->
[Slack
Thread](https://sentry.slack.com/archives/C07P2KGJGG0/p1774432721828049?thread_ts=1774432721.828049&cid=C07P2KGJGG0)
<div><a
href="https://cursor.com/agents/bc-6b90813c-59f0-5ff2-b0c0-838b15c1ab7b"><picture><source
media="(prefers-color-scheme: dark)"
srcset="https://cursor.com/assets/images/open-in-web-dark.png"><source
media="(prefers-color-scheme: light)"
srcset="https://cursor.com/assets/images/open-in-web-light.png"><img
alt="Open in Web" width="114" height="28"
src="https://cursor.com/assets/images/open-in-web-dark.png"></picture></a> <a
href="https://cursor.com/background-agent?bcId=bc-6b90813c-59f0-5ff2-b0c0-838b15c1ab7b"><picture><source
media="(prefers-color-scheme: dark)"
srcset="https://cursor.com/assets/images/open-in-cursor-dark.png"><source
media="(prefers-color-scheme: light)"
srcset="https://cursor.com/assets/images/open-in-cursor-light.png"><img
alt="Open in Cursor" width="131" height="28"
src="https://cursor.com/assets/images/open-in-cursor-dark.png"></picture></a> </div>
---------
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Co-authored-by: Ivan Dlugos <vaind@users.noreply.github.com>
Clarify how skill-writer should handle bundled file paths and
registration paths so generated skills stay portable across hosts.
This updates the authoring and validation guidance to prefer
skill-root-relative references like references/... and scripts/...,
avoid provider-specific path variables in generic skills, and keep
repository registration steps tied to the active workspace layout.
It also does a self-pass on skill-writer so the portability rule lives
in the design, authoring, and validation references instead of expanding
the top-level orchestration flow.
---------
Co-authored-by: Codex <codex@openai.com>
Make `create-branch` derive and create branch names without prompting
for user input.
This trims the skill down to the core naming and checkout workflow so it
uses fewer tokens while still documenting the fallback rules for prefix
resolution, base selection, and collision handling.
It also updates `commit` to treat `create-branch` as a non-interactive
helper so branch creation no longer blocks PR creation or commit flows.
Co-authored-by: OpenAI Codex <noreply@openai.com>
Add detection for attack vectors discovered through systematic
benchmarking
of 10 malicious skill patterns across 14 LLM models
(https://github.com/gricha/dangerous-skills).
New detections in `scan_skill.py`:
- **Symlinks** pointing outside skill directory (e.g.,
`examples/id_rsa.example` → `~/.ssh/id_rsa`) — critical
- **YAML frontmatter hooks** (`PostToolUse`, etc.) that execute shell
commands automatically — critical
- **`!`command`` pre-prompt injection** that runs at template expansion
before the model sees the prompt — high
- **Test file auto-discovery** (`conftest.py`, `test_*.py`, `*.test.js`)
that execute as side effects of `pytest`/`npm test` — high
- **npm lifecycle hooks** (`postinstall`) in bundled `package.json`
files — critical
- **PNG metadata text injection** (tEXt/iTXt chunks with hidden
instructions) — high
- **Unicode Tag character smuggling** (U+E0000 block, invisible to
humans but read by LLMs) — critical
Updated `SKILL.md` Phase 5 behavioral analysis with structural attack
checklist.
Updated reference files with new pattern documentation.
Tested against all 10 skills in the dangerous-skills repo — every attack
vector is detected.
Agent transcript:
https://claudescope.sentry.dev/share/KrNBlA9AEa20a0jWE4qxfVvJWVmp7ytU94Rs7fRFdfM
- iTXt chunks have 5 null-separated fields (keyword, comprFlag,
comprMethod, langTag, transKeyword, text) — parse all 5 instead
of treating like tEXt (which has only 2).
- Handle package.json where "scripts" is null instead of missing.
Co-Authored-By: Claude <noreply@anthropic.com>
## Summary
- Adds explicit instruction not to increase sleep duration on subsequent
polling iterations
## Why
The agent sometimes applies exponential backoff to the 30-second sleep
in the polling loop (30s → 60s → 120s → ...), turning a ~5 minute CI
wait into 10+ minutes of idle time. The fixed 30s interval is already
appropriate — CI checks don't benefit from longer gaps between polls.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Without a specific callout for uv, agents waste time searching for uv
when it's missing instead of guiding users to install it. Add a
**Requires** directive with the uv install URL to gh-review-requests,
iterate-pr, skill-scanner, and skill-writer so the agent can surface the
issue to the end user. This mirrors the **Requires** directive for the
`gh` CLI with auth.
Resolvesgetsentry/skills#93
## Summary
- Adds `reply_to_thread.py` script that wraps the GraphQL
`addPullRequestReviewThreadReply` mutation
- Supports batching multiple thread replies into a single GraphQL call
- Updates SKILL.md to use the script instead of inline GraphQL
instructions
## Why
The iterate-pr skill replies to review threads using raw `gh api
graphql` calls with inline mutation queries. Every such call triggers a
permission prompt because `gh api graphql` is a broad, powerful command
that can't be safely whitelisted. By wrapping the reply logic in a
dedicated script, users can whitelist `uv run .../reply_to_thread.py`
specifically — scoped to just thread replies — so the polling loop runs
unattended without manual approval on each reply.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Escape pullRequestReviewThreadId with JSON string encoding when building the batched mutation.
This prevents malformed IDs from breaking out of the GraphQL string literal while preserving existing behavior for valid thread IDs.
Co-Authored-By: GitHub Copilot <noreply@github.com>
Preserve per-operation results in reply_to_thread so repeated thread IDs do not overwrite earlier outcomes in the summary output.
Normalize literal \n sequences in reply bodies and update skill examples to use shell quoting that produces real newlines, preventing escaped newline text in posted replies.
Co-Authored-By: GitHub Copilot <noreply@github.com>
The reply_to_thread.py script only checked subprocess returncode,
missing application-level GraphQL errors returned with HTTP 200.
Now parses the response body to detect partial failures per alias.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Explicitly instruct the agent not to increase the sleep duration on
subsequent polling iterations. Without this, the agent sometimes
applies exponential backoff (30s → 60s → 120s…) which wastes time
when CI runs are typically ~5 minutes.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Wraps the GraphQL addPullRequestReviewThreadReply mutation in a
script so it can be whitelisted as a permission instead of requiring
raw gh api graphql approval each time. Supports batching multiple
replies into a single call.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Without a specific callout for uv, agents waste time searching for
uv when it's missing instead of guiding users to install it. Add a
**Requires** directive with the uv install URL to gh-review-requests,
iterate-pr, skill-scanner, and skill-writer so the agent can surface
the issue to the end user.
Resolvesgetsentry/skills#93
best used as following for full output
```
claude --agent sentry-skills:senpai
explain relay's role in sentry's infrastructure
```
or like this which delegates to subagent but does an extra step of
unnecessary summarizing
```
ask senpai to explain relay's role in sentry's infrastructure
```
outputs below are single question, agent invokations
- Create an interactive HTML presentation in a Sentry-themed light mode
- Build in node, preview locally with hot-reload and export to a single
HTML file in the /dist folder
- Use Recharts to visualize data interactively using Tableau's chart
pallette
- Provide sane defaults for slide types and structure
- Contains a Sentry svg for logo and watermark
Align commit attribution wording to require the agent's name and
attribution byline everywhere this guidance appears.
This updates AGENTS.md, the agents-md skill, and the commit skill so
they consistently use the same placeholder format and avoid the older
'agent model' phrasing.
It also strengthens the commit skill with explicit guidance to avoid
literal \n sequences in commit messages and to use properly formatted
multiline commit bodies.
Co-authored-by: GPT-5 Codex <noreply@openai.com>
Merge skill synthesis into `skill-writer` so there is one canonical flow
for creating and improving skills.
**Canonical workflow consolidation**
`skill-writer` now owns synthesis, authoring, iteration, evaluation, and
registration in one path. This removes split ownership between creation
and synthesis and makes outcomes more consistent.
**`skill-creator` compatibility behavior**
`skill-creator` is now an alias entrypoint rather than a separate
framework. Existing prompts still work, but execution routes to the
canonical `skill-writer` behavior.
**Input-depth and coverage gates**
The workflow now explicitly prioritizes broad source collection before
authoring. It adds coverage/depth gates to reduce shallow skills and
force clearer gap handling.
**Provenance and iteration tracking**
Skill synthesis now records sources and change history in `SOURCES.md`
instead of adding heavy attribution blocks in `SKILL.md`. This improves
traceability and makes iterative updates easier to audit.
**Case-study guidance quality**
Reference examples were upgraded from generic guidance to case-study
style patterns with concrete source-to-decision framing. This is
intended to improve synthesis quality for future skills.
**Cross-agent execution consistency**
Guidance was normalized to be generic across Claude and Codex, with
script execution clarified around `uv run` and skill-directory script
paths. This keeps the workflow portable while staying operationally
concrete.
---------
Co-authored-by: GPT-5 Codex <noreply@openai.com>
* docs: list all available skills
* docs(skills): Align registration guidance and skill allowlists
Require alphabetical ordering when updating the Available Skills table\nin contributor guidance and skill creation workflow docs.\n\nSynchronize skill allowlists with the actual sentry-skills directory so\nautomatic skill injection guidance reflects all available skills.\n\nCo-Authored-By: GPT-5 Codex <noreply@openai.com>
---------
Co-authored-by: shuofengzhang <sofuncheung16@gmail.com>
* ref(skills): Rename PR and skill authoring workflows
Promote pr-writer and skill-writer as canonical skill names while\nkeeping create-pr and skill-creator as compatibility aliases.\n\nUpdate skill registration, settings allowlists, and documentation\nreferences to prefer canonical names.\n\nExtend skill-writer guidance with capability-first naming practices\nand examples for clearer skill discovery.
Co-Authored-By: GPT-5 Codex <noreply@openai.com>
* fix(skills): Address review bot feedback on skill rename
Restrict skill-writer with an explicit allowed-tools frontmatter field,\nremove dead code in quick_validate, and delete orphaned duplicate\nreferences/scripts from the skill-creator alias directory to avoid drift.
Co-Authored-By: GPT-5 Codex <noreply@openai.com>
* fix(skills): Drop allowed-tools from skill-writer
Keep skill-writer frontmatter compatible across clients by avoiding\nthe optional allowed-tools field while retaining the other review\nfixes in this PR.
Co-Authored-By: GPT-5 Codex <noreply@openai.com>
* docs(skill-writer): Default to omitting allowed-tools
Clarify that skill authoring should avoid allowed-tools unless a user\nexplicitly requests strict tool scoping or repo policy requires it,\nsince allowlist syntax differs across clients.
Co-Authored-By: GPT-5 Codex <noreply@openai.com>
* docs(pr-writer): Include update flows in skill discovery text
Expand pr-writer trigger language to explicitly cover updating PR artifacts\nlike title and description, not only creating a new PR.\n\nAlso align the README skill table description so repository docs\nmatch the canonical skill wording.
Co-Authored-By: GPT-5 Codex <noreply@openai.com>
---------
Co-authored-by: GPT-5 Codex <noreply@openai.com>
Replace git config user.name lookup with gh api user --jq .login so the
branch prefix always matches the user's actual GitHub handle.
Co-Authored-By: Claude <noreply@anthropic.com>
Greg Pstrucha
