Create Repo Agent

Create Repo Agent

Purpose

Build repo agents that can run unattended without granting the model broad write credentials, arbitrary shell, or uncontrolled network access. The default architecture is a read-only audit job that produces a validated patch artifact plus a separate publisher job that owns GitHub writes.

Use this skill together with the domain skill for the files the agent will maintain. For example, a pricing agent must also use add-model-price.

Required Reading

For every repo agent task, read these references before designing or editing:

1. references/security-standards.md
2. references/workflow-blueprint.md when implementing or changing a GitHub Actions workflow
3. references/review-checklist.md before final review or PR publication

Workflow

1. Define the exact maintenance objective, allowed files, external sources, expected no-change behavior, and PR ownership.
2. Choose the least-capable runtime: prefer a scheduled/manual GitHub Action with read-only repository checkout and no write credentials in the LLM step.
3. Encode the prompt with explicit allowed edit surfaces, hard constraints, source-evidence requirements, and structured output.
4. Give the agent only scoped file tools, domain-scoped fetch tools, and exact deterministic validator commands.
5. Validate the diff independently of the agent, including untracked files, path allowlists, git diff --check, line-count limits, and domain-specific validators.
6. Publish from a separate job or step after validation, using a bot credential only for branch push and PR create/update.
7. If self-improvement is allowed, constrain it to named workflow or skill-reference files and require security invariants to remain unchanged.
8. Run agent setup checks when .agents/** changes, then publish a normal human-reviewable PR.

Non-Negotiables

• Never expose a write-capable GitHub token, PAT, GitHub App token, OIDC token, SSH key, cloud credential, or package-publishing token to the LLM agent step.
• Never rely on prompt instructions as the only security boundary. Enforce file and command limits outside the agent.
• Never stage a directory wholesale. Stage only the validated file list.
• Never ignore untracked files in diff validation.
• Never let self-improvement bypass the same diff allowlist and human PR review as normal edits.
• Never grant arbitrary Bash, curl, wget, gh, git push, package-manager, interpreter, environment-dump, or process-inspection tools to the LLM agent.
• Never add id-token: write unless the agent truly needs OIDC and the trust relationship is reviewed explicitly.