Users reported the skill keeps asking them to approve the branch name.
Strengthen the non-interactive language so the agent generates the name
and moves on without pausing for confirmation.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Clarify how skill-writer should handle bundled file paths and
registration paths so generated skills stay portable across hosts.
This updates the authoring and validation guidance to prefer
skill-root-relative references like references/... and scripts/...,
avoid provider-specific path variables in generic skills, and keep
repository registration steps tied to the active workspace layout.
It also does a self-pass on skill-writer so the portability rule lives
in the design, authoring, and validation references instead of expanding
the top-level orchestration flow.
---------
Co-authored-by: Codex <codex@openai.com>
Make `create-branch` derive and create branch names without prompting
for user input.
This trims the skill down to the core naming and checkout workflow so it
uses fewer tokens while still documenting the fallback rules for prefix
resolution, base selection, and collision handling.
It also updates `commit` to treat `create-branch` as a non-interactive
helper so branch creation no longer blocks PR creation or commit flows.
Co-authored-by: OpenAI Codex <noreply@openai.com>
Add detection for attack vectors discovered through systematic
benchmarking
of 10 malicious skill patterns across 14 LLM models
(https://github.com/gricha/dangerous-skills).
New detections in `scan_skill.py`:
- **Symlinks** pointing outside skill directory (e.g.,
`examples/id_rsa.example` → `~/.ssh/id_rsa`) — critical
- **YAML frontmatter hooks** (`PostToolUse`, etc.) that execute shell
commands automatically — critical
- **`!`command`` pre-prompt injection** that runs at template expansion
before the model sees the prompt — high
- **Test file auto-discovery** (`conftest.py`, `test_*.py`, `*.test.js`)
that execute as side effects of `pytest`/`npm test` — high
- **npm lifecycle hooks** (`postinstall`) in bundled `package.json`
files — critical
- **PNG metadata text injection** (tEXt/iTXt chunks with hidden
instructions) — high
- **Unicode Tag character smuggling** (U+E0000 block, invisible to
humans but read by LLMs) — critical
Updated `SKILL.md` Phase 5 behavioral analysis with structural attack
checklist.
Updated reference files with new pattern documentation.
Tested against all 10 skills in the dangerous-skills repo — every attack
vector is detected.
Agent transcript:
https://claudescope.sentry.dev/share/KrNBlA9AEa20a0jWE4qxfVvJWVmp7ytU94Rs7fRFdfM
- iTXt chunks have 5 null-separated fields (keyword, comprFlag,
comprMethod, langTag, transKeyword, text) — parse all 5 instead
of treating like tEXt (which has only 2).
- Handle package.json where "scripts" is null instead of missing.
Co-Authored-By: Claude <noreply@anthropic.com>
## Summary
- Adds explicit instruction not to increase sleep duration on subsequent
polling iterations
## Why
The agent sometimes applies exponential backoff to the 30-second sleep
in the polling loop (30s → 60s → 120s → ...), turning a ~5 minute CI
wait into 10+ minutes of idle time. The fixed 30s interval is already
appropriate — CI checks don't benefit from longer gaps between polls.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Without a specific callout for uv, agents waste time searching for uv
when it's missing instead of guiding users to install it. Add a
**Requires** directive with the uv install URL to gh-review-requests,
iterate-pr, skill-scanner, and skill-writer so the agent can surface the
issue to the end user. This mirrors the **Requires** directive for the
`gh` CLI with auth.
Resolvesgetsentry/skills#93
Escape pullRequestReviewThreadId with JSON string encoding when building the batched mutation.
This prevents malformed IDs from breaking out of the GraphQL string literal while preserving existing behavior for valid thread IDs.
Co-Authored-By: GitHub Copilot <noreply@github.com>
Preserve per-operation results in reply_to_thread so repeated thread IDs do not overwrite earlier outcomes in the summary output.
Normalize literal \n sequences in reply bodies and update skill examples to use shell quoting that produces real newlines, preventing escaped newline text in posted replies.
Co-Authored-By: GitHub Copilot <noreply@github.com>
The reply_to_thread.py script only checked subprocess returncode,
missing application-level GraphQL errors returned with HTTP 200.
Now parses the response body to detect partial failures per alias.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Explicitly instruct the agent not to increase the sleep duration on
subsequent polling iterations. Without this, the agent sometimes
applies exponential backoff (30s → 60s → 120s…) which wastes time
when CI runs are typically ~5 minutes.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Wraps the GraphQL addPullRequestReviewThreadReply mutation in a
script so it can be whitelisted as a permission instead of requiring
raw gh api graphql approval each time. Supports batching multiple
replies into a single call.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Without a specific callout for uv, agents waste time searching for
uv when it's missing instead of guiding users to install it. Add a
**Requires** directive with the uv install URL to gh-review-requests,
iterate-pr, skill-scanner, and skill-writer so the agent can surface
the issue to the end user.
Resolvesgetsentry/skills#93
best used as following for full output
```
claude --agent sentry-skills:senpai
explain relay's role in sentry's infrastructure
```
or like this which delegates to subagent but does an extra step of
unnecessary summarizing
```
ask senpai to explain relay's role in sentry's infrastructure
```
outputs below are single question, agent invokations
Align commit attribution wording to require the agent's name and
attribution byline everywhere this guidance appears.
This updates AGENTS.md, the agents-md skill, and the commit skill so
they consistently use the same placeholder format and avoid the older
'agent model' phrasing.
It also strengthens the commit skill with explicit guidance to avoid
literal \n sequences in commit messages and to use properly formatted
multiline commit bodies.
Co-authored-by: GPT-5 Codex <noreply@openai.com>
Merge skill synthesis into `skill-writer` so there is one canonical flow
for creating and improving skills.
**Canonical workflow consolidation**
`skill-writer` now owns synthesis, authoring, iteration, evaluation, and
registration in one path. This removes split ownership between creation
and synthesis and makes outcomes more consistent.
**`skill-creator` compatibility behavior**
`skill-creator` is now an alias entrypoint rather than a separate
framework. Existing prompts still work, but execution routes to the
canonical `skill-writer` behavior.
**Input-depth and coverage gates**
The workflow now explicitly prioritizes broad source collection before
authoring. It adds coverage/depth gates to reduce shallow skills and
force clearer gap handling.
**Provenance and iteration tracking**
Skill synthesis now records sources and change history in `SOURCES.md`
instead of adding heavy attribution blocks in `SKILL.md`. This improves
traceability and makes iterative updates easier to audit.
**Case-study guidance quality**
Reference examples were upgraded from generic guidance to case-study
style patterns with concrete source-to-decision framing. This is
intended to improve synthesis quality for future skills.
**Cross-agent execution consistency**
Guidance was normalized to be generic across Claude and Codex, with
script execution clarified around `uv run` and skill-directory script
paths. This keeps the workflow portable while staying operationally
concrete.
---------
Co-authored-by: GPT-5 Codex <noreply@openai.com>
* docs: list all available skills
* docs(skills): Align registration guidance and skill allowlists
Require alphabetical ordering when updating the Available Skills table\nin contributor guidance and skill creation workflow docs.\n\nSynchronize skill allowlists with the actual sentry-skills directory so\nautomatic skill injection guidance reflects all available skills.\n\nCo-Authored-By: GPT-5 Codex <noreply@openai.com>
---------
Co-authored-by: shuofengzhang <sofuncheung16@gmail.com>
* ref(skills): Rename PR and skill authoring workflows
Promote pr-writer and skill-writer as canonical skill names while\nkeeping create-pr and skill-creator as compatibility aliases.\n\nUpdate skill registration, settings allowlists, and documentation\nreferences to prefer canonical names.\n\nExtend skill-writer guidance with capability-first naming practices\nand examples for clearer skill discovery.
Co-Authored-By: GPT-5 Codex <noreply@openai.com>
* fix(skills): Address review bot feedback on skill rename
Restrict skill-writer with an explicit allowed-tools frontmatter field,\nremove dead code in quick_validate, and delete orphaned duplicate\nreferences/scripts from the skill-creator alias directory to avoid drift.
Co-Authored-By: GPT-5 Codex <noreply@openai.com>
* fix(skills): Drop allowed-tools from skill-writer
Keep skill-writer frontmatter compatible across clients by avoiding\nthe optional allowed-tools field while retaining the other review\nfixes in this PR.
Co-Authored-By: GPT-5 Codex <noreply@openai.com>
* docs(skill-writer): Default to omitting allowed-tools
Clarify that skill authoring should avoid allowed-tools unless a user\nexplicitly requests strict tool scoping or repo policy requires it,\nsince allowlist syntax differs across clients.
Co-Authored-By: GPT-5 Codex <noreply@openai.com>
* docs(pr-writer): Include update flows in skill discovery text
Expand pr-writer trigger language to explicitly cover updating PR artifacts\nlike title and description, not only creating a new PR.\n\nAlso align the README skill table description so repository docs\nmatch the canonical skill wording.
Co-Authored-By: GPT-5 Codex <noreply@openai.com>
---------
Co-authored-by: GPT-5 Codex <noreply@openai.com>
Replace git config user.name lookup with gh api user --jq .login so the
branch prefix always matches the user's actual GitHub handle.
Co-Authored-By: Claude <noreply@anthropic.com>
Add a new skill for reviewing GitHub Actions workflows for security
vulnerabilities, covering expression injection, pwn requests, supply
chain attacks, credential escalation, and AI prompt injection via CI.
Includes reference documentation for all major GHA attack vectors.
Also updates AGENTS.md to the concise agent-instructions format and
registers the new skill in settings and the claude-settings-audit allowlist.
Co-Authored-By: Claude <noreply@anthropic.com>
Replace skill-discovery focus with project-analysis approach. Add line
budget guidance (target 60, max 100), file-scoped commands section,
and anti-patterns for linter duplication. Remove Local Skills required
section since agents discover skills automatically. Rewrite AGENTS.md
for this repo to follow the updated guidance.
Co-authored-by: Claude <noreply@anthropic.com>
Reduce SKILL.md from 446 to 186 lines (58%) by removing content that
was duplicated across sections or controlled by Warden. Modeled after
the sentry-security skill structure (Step 1-4 pattern).
Removed: Phase 1 (file discovery, Warden provides files), Phase 2
(duplicate of Reference Files table), Phase 4 (duplicate of Core
Principles), Phase 5 (duplicate of validation section), Quick Patterns
Reference (duplicates safe patterns table + reference files),
Attacker-Controlled Expressions table (moved to reference file),
standalone Severity Model (replaced with confidence model), and ~10
inline repetitions of the external attacker concept.
Added confidence model (HIGH/MEDIUM/LOW) matching sentry-security
pattern. Moved attacker-controlled expressions quick reference table
to references/expression-injection.md where it belongs.
Co-Authored-By: Claude <noreply@anthropic.com>
Agent transcript: https://claudescope.sentry.dev/share/spByNq2HxKsjIIoMtNrC7sncSkRu68d6dqVVv7xZ4k0
Refine the skill to reduce false positives:
- Add "external attacker threat model" principle: only report vulns
exploitable without write access. workflow_dispatch input injection,
push-to-protected-branch expression injection, and schedule-only
secrets are not findings.
- Add "validate before reporting" principle: require reading the actual
workflow YAML and tracing every link in the attack chain before
reporting. Pattern matching alone is not enough.
- Expand Phase 5 into a structured validation gauntlet (prove attack
path, check mitigations, confirm impact) with a table of checks
that must pass before a finding is reported.
- Move workflow_dispatch inputs and commit messages on push to the
"safe expressions" table with rationale.
- Add "Do NOT Flag" and "Not a finding" sections to quick patterns
and severity model.
- Update expression-injection.md to mark workflow_dispatch as not a
finding and add nuance to commit message injection.
Co-Authored-By: Claude <noreply@anthropic.com>
Agent transcript: https://claudescope.sentry.dev/share/lxT27jHfwxvYtwFoKykzZV-XILSBNXhdMCKRNCjKvFY
Replace the complex stash state machine with concise, principle-based
instructions that trust the agent's judgment. Fixes the bug where
git stash pop ran unconditionally on checkout failure even when no
changes were stashed.
Co-Authored-By: Claude <noreply@anthropic.com>
Detect the primary remote by preferring "origin" if it exists rather than
taking the first alphabetical remote. Also instruct the agent to restore
the stash if the user cancels at any point after stashing, preventing
changes from being silently left in the stash.
Co-Authored-By: Claude <noreply@anthropic.com>
Add instructions to restore stashed changes if `git checkout <default-branch>`
fails or if `git checkout -b <branch-name>` fails, so the user's work is
never silently left in the stash when an error occurs.
Co-Authored-By: Claude <noreply@anthropic.com>
Reword the collision block to make it unambiguous that the user is always
asked to choose a different name when a collision is detected, whether or
not changes were stashed, preventing the agent from skipping the collision
path and attempting to create an already-existing branch.
Co-Authored-By: Claude <noreply@anthropic.com>
When a collision is detected and changes were stashed, restore the stash
and clear the stashed flag before returning to Step 4, so the final
restore step does not attempt a second stash pop on a new name attempt.
Co-Authored-By: Claude <noreply@anthropic.com>
Detect the primary remote via `git remote | head -1` and use it for
default-branch detection and remote branch existence checks, so repos
with a non-origin primary remote (e.g. upstream forks) work correctly.
Co-Authored-By: Claude <noreply@anthropic.com>
- Strip trailing whitespace from default branch detection output
- Clarify abort path: stop skill if user aborts stash prompt
- Restore stash before informing user of branch name collision
- Add re-check in commit skill to verify branch changed before committing
Co-Authored-By: Claude <noreply@anthropic.com>
- Check refs/remotes/origin/ in addition to refs/heads/ to detect remote branch collisions
- Clarify in commit skill that create-branch still proposes a name for confirmation;
only the decision to create a branch at all is skipped
Co-Authored-By: Claude <noreply@anthropic.com>
After switching to the default branch and creating a new branch,
run git stash pop to restore any changes that were stashed earlier
in the workflow.
Co-Authored-By: Claude <noreply@anthropic.com>
Use git show-ref with refs/heads/ to only match local branches,
not remote branches or tags, before creating a new branch.
Co-Authored-By: Claude <noreply@anthropic.com>
- Use git diff without --stat so agent reads actual content, not just filenames
- Strip non-ASCII characters from username prefix to ensure valid branch names
- Ask user when both main and master exist instead of blindly defaulting to main
Co-Authored-By: Claude <noreply@anthropic.com>
When the user chooses to switch to the default branch first, the skill
was missing the git checkout step, causing the new branch to be created
from the wrong base.
Co-Authored-By: Claude <noreply@anthropic.com>
When git branch --show-current returns empty, detect the detached HEAD
and show the current commit, so the user understands their state before
choosing where to branch from.
Co-Authored-By: Claude <noreply@anthropic.com>
When neither main nor master exists, defaulting to main would cause
git checkout to fail. Ask the user instead.
Co-Authored-By: Claude <noreply@anthropic.com>
Replace the inline branch naming logic with a reference to the
create-branch skill to ensure consistent naming conventions across both skills.
Co-Authored-By: Claude <noreply@anthropic.com>
Reorder Step 5 so the default branch is detected before it's used
in the non-default branch check. Replace the vague fallback with a
concrete `git branch --list main master` command, explicit precedence
rules (main > master > fallback to main), and add `git branch
--show-current` to retrieve the current branch name for the comparison.
Co-Authored-By: Claude <noreply@anthropic.com>
Adds a new skill that creates git branches following Sentry naming
conventions. Detects the username from git config, inspects local
changes or prompts for context, classifies the work type, and
proposes a branch name before creating it.
Co-Authored-By: Claude <noreply@anthropic.com>
gh pr checks exits non-zero when any check is failing or pending, so
check=True raises CalledProcessError and discards all check data.
Remove it to allow parsing output regardless of exit code.
Co-Authored-By: Claude <noreply@anthropic.com>
Priscila Oliveira