Menu

Not in the top 1,000 by GitHub stars

egdev6/github-repository-bootstrap

Pi skill that plans and applies repeatable GitHub repository governance: labels, milestones, templates, and Projects v2

Engineering

History

Review weekly changes to SKILL.md before updating. Dates mark the weeks in which we observed each version; checks apply to the recorded commits.

View weekly changes

skills/github-ci-advisor/SKILL.md

Week of Nov 2, 2026 · +0 / −0 lines

Before Network or broad shell → After Network or broad shell

23d623077b07 → 23d623077b07

Compare on GitHub

Week of Oct 26, 2026 · Line counts unavailable

Before Not checked yet → After Network or broad shell

First observation → 23d623077b07

No earlier version was observed for comparison.

Compare on GitHub

skills/github-repository-bootstrap/SKILL.md

Week of Nov 2, 2026 · +0 / −0 lines

Before Network or broad shell → After Network or broad shell

23d623077b07 → 23d623077b07

Compare on GitHub

Week of Oct 26, 2026 · Line counts unavailable

Before Not checked yet → After Network or broad shell

First observation → 23d623077b07

No earlier version was observed for comparison.

Compare on GitHub

skills/repository-security-review/SKILL.md

Week of Nov 2, 2026 · +0 / −0 lines

Before Network or broad shell → After Network or broad shell

23d623077b07 → 23d623077b07

Compare on GitHub

Week of Oct 26, 2026 · Line counts unavailable

Before Not checked yet → After Network or broad shell

First observation → 23d623077b07

No earlier version was observed for comparison.

Compare on GitHub

View on GitHubAdd to my skills

Verified commit 23d623077b0764d17c90a43fe0dc1f320fa7e181

23GitHub stars
0stars in 7 days
3skills in this repository
37commits in 30 days

Heat

1.7
  • Star growth, last 7 daysNot available
  • Star growth, last 24 hoursNot available
  • Rank movement, last 7 daysNot available
  • Commits, last 30 daysNot available
  • Accounts asking about it through MCP, last 7 daysNot available
  • Hot votes this weekNot available

Heat never changes the order by stars, and sponsorship never touches it. How heat works

Stars over time

Oct 25, 2026Oct 25, 202623

30-day change not yet available: not enough history.

Individual skills in this repository

How it works

github-ci-advisor

When your agent uses it

Trigger: CI advisor, build pipeline, test pipeline, GitHub Actions, CI audit, security check, CI evolution. Propose, and only after approval apply, least-privilege CI for an existing repository.

What it loads into context

Frontmatter

74 tokens

Always available to the agent

SKILL.md

829 tokens

When the skill is activated

Reference documents

1,586 tokens

Loaded on request

Token counts are estimates. Scripts run separately; they are not counted as reference context.

The playbook

  1. Activation Contract
  2. Hard Rules
  3. Decision Gates
  4. Execution Steps
  5. Output Contract
  6. References

Files

  • SKILL.mdcore3,936 bytes
  • references/ci-review.mddoc4,088 bytes
  • ../repository-security-review/SKILL.mddoc3,679 bytes
Read SKILL.md

# GitHub CI Advisor

## Activation Contract

Use for CI advice, build/test pipelines, audits, security checks, or CI evolution (add, modify, retire). Do not activate automatically during repository bootstrap, and invent no fixed CI manifest or unknown schema fields. It proposes, applies only after explicit approval, and never commits, pushes, releases, deploys, or enables checks or protection.

## Hard Rules

- Discover read-only: read manifests, lockfiles, and script definitions; inspect workflows, triggers, action pins, permissions, and required checks. Use the API for required checks only with authorized, valid access. Never run project scripts, install hooks, or execute downloaded code as discovery.
- Propose from observed commands only: build, typecheck, and tests when they exist, otherwise a smoke check. Ask the human for unset requirements, skip unwanted modules, and never guess a universal CI from an assumed npm project.
- Pin every action to an immutable SHA with human-verified provenance; without verified provenance, stop with unresolved pins and invent no SHA, version, dependency, or code.
- Least privilege: `contents: read`, no secrets to forks, no privileged checkout of a pull-request target. Run untrusted pull-request code only sandboxed without secrets or a writable token; containers reduce risk but are not an absolute sandbox.
- Baseline with a pinned secrets scanner (e.g. a verified-ref Gitleaks action), a secrets-permissions review, and a human read-only repository-safety review. Never claim an action detects prompt injection. Run deterministic scanners only when installed and approved, fetch external evidence only when safe, invent nothing.
- Retire a check only when proven redundant or obsolete; preserve required check names or explicitly warn that branch rules depend on them and need a separate manual change, since branch protection does not manage checks.
View the complete source on GitHub

Skills included

  • github-ci-advisor
  • github-repository-bootstrap
  • repository-security-review

Repository facts

License
MIT
Created
Sep 5, 2026
Last pushed
Oct 13, 2026
Forks
4
Open issues
19
Project activity
Active

Before you install

Network or broad shell

Automated signals, not a guarantee

Checked Nov 5, 2026

Not fully analyzed: some files were too long, unreadable or missing. This never lowers the level.

Show 1 note
  • skills/github-repository-bootstrap/SKILL.md:1 Analysis incomplete: Referenced executable target unavailable; not analyzed
Show all 94 signals by file

skills/github-repository-bootstrap/assets/config.schema.json

  • Network accessline 1
    {   "$schema": "https://json-schema.org/draft/2020-12/schema",
  • Network accessline 2
    "$schema": "https://json-schema.org/draft/2020-12/schema",
  • Network accessline 3
    "$id": "https://example.invalid/github-project-bootstrap/config.schema.json",

skills/github-repository-bootstrap/assets/templates/code-safety.yml

  • Dangerous shell operationline 97
    run: rm -rf -- "$RUNNER_TEMP/quorb-code-safety"

skills/github-repository-bootstrap/assets/templates/project-issue-sync.yml

  • Access to secretsline 156
    [Credential-related source omitted]

skills/github-repository-bootstrap/scripts/bootstrap.mjs

  • Executable scriptline 1
    #!/usr/bin/env node

skills/github-repository-bootstrap/scripts/code-safety-renderer.mjs

  • Executable scriptline 1
    Executable file

skills/github-repository-bootstrap/scripts/code-safety-state.mjs

  • Executable scriptline 1
    Executable file

skills/github-repository-bootstrap/scripts/command-transport.mjs

  • Executable scriptline 1
    Executable file

skills/github-repository-bootstrap/scripts/fixed-template-paths.mjs

  • Executable scriptline 1
    Executable file

skills/github-repository-bootstrap/scripts/fixed-template-renderer.mjs

  • Executable scriptline 1
    Executable file

skills/github-repository-bootstrap/scripts/fixed-template-state.mjs

  • Executable scriptline 1
    Executable file

skills/github-repository-bootstrap/scripts/lib.mjs

  • Executable scriptline 1
    Executable file

skills/github-repository-bootstrap/scripts/project-sync-renderer.mjs

  • Executable scriptline 1
    Executable file

skills/github-repository-bootstrap/scripts/template-state.mjs

  • Executable scriptline 1
    Executable file

skills/github-repository-bootstrap/tests/actionlint-fixtures.mjs

  • Executable scriptline 1
    Executable file

skills/github-repository-bootstrap/tests/advisor.test.mjs

  • Executable scriptline 1
    Executable file

skills/github-repository-bootstrap/tests/code-safety-default.test.mjs

  • Executable scriptline 1
    Executable file

skills/github-repository-bootstrap/tests/code-safety-install.test.mjs

  • Executable scriptline 1
    Executable file
  • Network accessline 60
    "add",       "origin",       "https://github.com/acme-org/widgets.git",
  • Network accessline 61
    "origin",       "https://github.com/acme-org/widgets.git",     ]);
  • Network accessline 62
    "https://github.com/acme-org/widgets.git",

skills/github-repository-bootstrap/tests/code-safety-model.test.mjs

  • Executable scriptline 1
    Executable file

skills/github-repository-bootstrap/tests/code-safety-renderer.test.mjs

  • Executable scriptline 1
    Executable file

skills/github-repository-bootstrap/tests/command-transport.test.mjs

  • Executable scriptline 1
    Executable file

skills/github-repository-bootstrap/tests/fixed-template-collisions.test.mjs

  • Executable scriptline 1
    Executable file

skills/github-repository-bootstrap/tests/fixed-template-paths.test.mjs

  • Executable scriptline 1
    Executable file

skills/github-repository-bootstrap/tests/fixed-template-renderer.test.mjs

  • Executable scriptline 1
    Executable file
  • Network accessline 174
    "add",       "origin",       "https://github.com/acme-org/widgets.git",
  • Network accessline 175
    "origin",       "https://github.com/acme-org/widgets.git",     ]);
  • Network accessline 176
    "https://github.com/acme-org/widgets.git",
  • Network accessline 490
    },     };     const origin = "https://github.com/acme-org/widgets.git";
  • Network accessline 491
    };     const origin = "https://github.com/acme-org/widgets.git";     const repositoryRoot = execFileSync("git", [
  • Network accessline 492
    const origin = "https://github.com/acme-org/widgets.git";

skills/github-repository-bootstrap/tests/gitleaks-fixtures.mjs

  • Executable scriptline 1
    Executable file

skills/github-repository-bootstrap/tests/helpers/native-cli-fixtures.mjs

  • Executable scriptline 1
    Executable file

skills/github-repository-bootstrap/tests/helpers/project-cli-fixtures.mjs

  • Executable scriptline 1
    Executable file

skills/github-repository-bootstrap/tests/helpers/project-sync-fixtures.mjs

  • Executable scriptline 1
    Executable file

skills/github-repository-bootstrap/tests/helpers/workflow-vm.mjs

  • Executable scriptline 1
    Executable file

skills/github-repository-bootstrap/tests/intake.test.mjs

  • Executable scriptline 1
    Executable file

skills/github-repository-bootstrap/tests/lib.test.mjs

  • Executable scriptline 1
    Executable file
  • Network accessline 123
    fs.mkdirSync(bin);     execFileSync("git", ["init", repository], { stdio: "ignore" });     execFileSync("git", ["-C", repository, "remote", "add", "origin", "https://github.com/acme/widgets.git"]);
  • Network accessline 124
    execFileSync("git", ["init", repository], { stdio: "ignore" });     execFileSync("git", ["-C", repository, "remote", "add", "origin", "https://github.com/acme/widgets.git"]);     fs.writeFileSync(configPath, JSON.stringify(minimal));
  • Network accessline 125
    execFileSync("git", ["-C", repository, "remote", "add", "origin", "https://github.com/acme/widgets.git"]);
  • Network accessline 708
    test("repository binding accepts only exact supported GitHub HTTPS and SSH origins", () => {   for (const origin of [     "https://github.com/egdev6/particle-studio.git",
  • Network accessline 709
    for (const origin of [     "https://github.com/egdev6/particle-studio.git",     "https://github.com/egdev6/particle-studio/",
  • Network accessline 710
    "https://github.com/egdev6/particle-studio.git",
  • Network accessline 711
    "https://github.com/egdev6/particle-studio/",
  • Network accessline 719
    }   for (const origin of [     "https://token@github.com/egdev6/particle-studio.git",
  • Network accessline 720
    for (const origin of [     "https://token@github.com/egdev6/particle-studio.git",     "https://@github.com/egdev6/particle-studio.git",
  • Network accessline 721
    "https://token@github.com/egdev6/particle-studio.git",
  • Network accessline 722
    "https://@github.com/egdev6/particle-studio.git",
  • Network accessline 723
    "https://github.com/egdev6/particle-studio.git?ref=main",
  • Network accessline 724
    "https://github.com/egdev6/particle-studio.git#readme",
  • Network accessline 725
    "https://gitlab.com/egdev6/particle-studio.git",
  • Network accessline 726
    "https://github.com/egdev6/particle-studio/extra",
  • Network accessline 727
    "https://github.com/egdev6/",
  • Network accessline 728
    "https://github.com//particle-studio",
  • Network accessline 729
    "https://github.com/egdev6/particle-studio.git.backup",

skills/github-repository-bootstrap/tests/lifecycle-issues.test.mjs

  • Executable scriptline 1
    Executable file

skills/github-repository-bootstrap/tests/lifecycle-pull-requests.test.mjs

  • Executable scriptline 1
    Executable file

skills/github-repository-bootstrap/tests/native-cli-fixture-isolation.test.mjs

  • Executable scriptline 1
    Executable file

skills/github-repository-bootstrap/tests/project-sync-guards.test.mjs

  • Executable scriptline 1
    Executable file
  • Access to secretsline 36
    [Credential-related source omitted]

skills/github-repository-bootstrap/tests/project-sync-renderer.test.mjs

  • Executable scriptline 1
    Executable file

skills/github-repository-bootstrap/tests/project-sync-runtime.test.mjs

  • Executable scriptline 1
    Executable file
  • Access to secretsline 28
    [Credential-related source omitted]

skills/github-repository-bootstrap/tests/project-sync-vm.test.mjs

  • Executable scriptline 1
    Executable file
  • Access to secretsline 89
    [Credential-related source omitted]

skills/github-repository-bootstrap/tests/runner.test.mjs

  • Executable scriptline 1
    Executable file

skills/github-repository-bootstrap/tests/template-state.test.mjs

  • Executable scriptline 1
    Executable file

skills/github-repository-bootstrap/tests/template-verification.test.mjs

  • Executable scriptline 1
    Executable file

skills/github-repository-bootstrap/tests/workflow-inventory.test.mjs

  • Executable scriptline 1
    Executable file

skills/github-repository-bootstrap/tests/workflow-policy.test.mjs

  • Executable scriptline 1
    Executable file
  • Network accessline 20
    const GITLEAKS_VERSION = "8.30.1"; const GITLEAKS_URL = "https://github.com/gitleaks/gitleaks/releases/download/v8.30.1/gitleaks_8.30.1_linux_x64.tar.gz";
  • Network accessline 21
    const GITLEAKS_URL = "https://github.com/gitleaks/gitleaks/releases/download/v8.30.1/gitleaks_8.30.1_linux_x64.tar.gz";
  • Network accessline 26
    const ACTIONLINT_VERSION = "1.7.12"; const ACTIONLINT_URL = "https://github.com/rhysd/actionlint/releases/download/v1.7.12/actionlint_1.7.12_linux_amd64.tar.gz";
  • Network accessline 27
    const ACTIONLINT_URL = "https://github.com/rhysd/actionlint/releases/download/v1.7.12/actionlint_1.7.12_linux_amd64.tar.gz";
  • Network accessline 266
    if (!security.includes(GITLEAKS_URL)) problems.push("gitleaks download URL must be an independent literal");   if (!security.includes(GITLEAKS_SHA256)) problems.push("gitleaks SHA-256 must be an independent literal");   if (!security.includ
  • Network accessline 267
    if (!security.includes(GITLEAKS_SHA256)) problems.push("gitleaks SHA-256 must be an independent literal");   if (!security.includes("curl --fail")) problems.push("the download must fail the step on HTTP errors");   if (/\|\s*(?:ba)?sh\b/.te
  • Network accessline 268
    if (!security.includes("curl --fail")) problems.push("the download must fail the step on HTTP errors");

skills/github-repository-bootstrap/tests/workflow-vm.test.mjs

  • Executable scriptline 1
    Executable file

skills/repository-security-review/SKILL.md

  • Network accessline 19
    - Stay inside the repository; do not search outside it, follow symlinks out of it, or query environment variables or secrets. - Detect contextual signals, not keywords alone: `eval` or `exec` of encoded payloads, download piped to a shell,
  • Network accessline 19
    - Stay inside the repository; do not search outside it, follow symlinks out of it, or query environment variables or secrets. - Detect contextual signals, not keywords alone: `eval` or `exec` of encoded payloads, download piped to a shell,
  • Network accessline 19
    - Stay inside the repository; do not search outside it, follow symlinks out of it, or query environment variables or secrets. - Detect contextual signals, not keywords alone: `eval` or `exec` of encoded payloads, download piped to a shell,
  • Network accessline 20
    - Detect contextual signals, not keywords alone: `eval` or `exec` of encoded payloads, download piped to a shell, lifecycle hooks, shell-startup edits, secret printing or exfiltration, permission escalation, unpinned actions, secrets reacha
  • Network accessline 20
    - Detect contextual signals, not keywords alone: `eval` or `exec` of encoded payloads, download piped to a shell, lifecycle hooks, shell-startup edits, secret printing or exfiltration, permission escalation, unpinned actions, secrets reacha
  • Network accessline 20
    - Detect contextual signals, not keywords alone: `eval` or `exec` of encoded payloads, download piped to a shell, lifecycle hooks, shell-startup edits, secret printing or exfiltration, permission escalation, unpinned actions, secrets reacha
  • Dangerous shell operationline 21
    - Distinguish legitimate content: `AGENTS.md` instructions are not automatically an attack, secret-shaped test fixtures are not real credentials, and a quoted `curl | sh` in docs is not execution.
  • Dangerous shell operationline 21
    - Distinguish legitimate content: `AGENTS.md` instructions are not automatically an attack, secret-shaped test fixtures are not real credentials, and a quoted `curl | sh` in docs is not execution.
  • Dangerous shell operationline 21
    - Distinguish legitimate content: `AGENTS.md` instructions are not automatically an attack, secret-shaped test fixtures are not real credentials, and a quoted `curl | sh` in docs is not execution.
  • Network accessline 21
    - Distinguish legitimate content: `AGENTS.md` instructions are not automatically an attack, secret-shaped test fixtures are not real credentials, and a quoted `curl | sh` in docs is not execution.
  • Network accessline 21
    - Distinguish legitimate content: `AGENTS.md` instructions are not automatically an attack, secret-shaped test fixtures are not real credentials, and a quoted `curl | sh` in docs is not execution.
  • Network accessline 21
    - Distinguish legitimate content: `AGENTS.md` instructions are not automatically an attack, secret-shaped test fixtures are not real credentials, and a quoted `curl | sh` in docs is not execution.

How the signals fit together

Facts from a static read of the files at the pinned commit. They describe what the code does, not why.

Some files could not be read; the facts below still hold.

Signal confidence: 89 facts

and 39 more

Works with

Agent compatibility, from the files in this repository
AgentStatusEvidenceInstall to
Claude CodeCompatibleStandard SKILL.md skills/github-ci-advisor/SKILL.md.claude/skills/<skill-name>/
CodexCompatibleStandard SKILL.md skills/github-ci-advisor/SKILL.md.agents/skills/<skill-name>/
CursorCompatibleStandard SKILL.md skills/github-ci-advisor/SKILL.md.cursor/skills/<skill-name>/
Gemini CLICompatibleStandard SKILL.md skills/github-ci-advisor/SKILL.md.gemini/skills/<skill-name>/
GitHub CopilotCompatibleStandard SKILL.md skills/github-ci-advisor/SKILL.md.github/skills/<skill-name>/
OpenCodeCompatibleStandard SKILL.md skills/github-ci-advisor/SKILL.md.opencode/skills/<skill-name>/
  • Native The repository ships a manifest, folder or frontmatter field for this agent.
  • Compatible A standard SKILL.md that this agent can read.
  • Unknown No evidence either way.

Derived automatically from paths, manifests and frontmatter. Not tested on each agent.

You might also use

dannote/dot-pi

Curated Pi package with extensions, skills, prompt shortcuts, and rules

57GitHub stars

Suge8/friedbun

我的 AI 编程配置，一句话装好 · My AI coding setup, installed in one message

12GitHub stars

geekjourneyx/namelens

Agent Skill for researching and stress-testing open-source project names, from collision checks to launch-ready decisions.

11GitHub stars

DietrichGebert/ponytail

Makes your AI agent think like the laziest senior dev in the room. The best code is the code you never wrote.

185.8kGitHub stars

tt-a1i/archify

Create validated architecture, workflow, sequence, data-flow, lifecycle/state, ERD, class, tree, timeline, and waterfall diagrams as explorable standalone HTML with dark/light the…

94.2kGitHub stars

KKKKhazix/khazix-skills

数字生命卡兹克开源的 AI Skills 合集 | Agent Skills: leader（帮你定义目标）, neat-freak 洁癖, hv-analysis, khazix-writer & more — Claude Code, Codex & 40+ agents

22kGitHub stars