repo2skill

Extracts a reusable code pattern from the current repo and authors a portable, validated Agent Skill. Use when you want to capture a logging setup, CI/CD pipeline, observability stack, async messaging pattern, frontend component library, feature-flag middleware, or any other repeatable engineering pattern so it can be replayed across other repos. Produces: a standard-conformant SKILL.md, parameterized code templates in assets/templates/, a PARAMETERS.md documenting every placeholder, then runs validate-skill.sh, scan-leaks.sh, and dry-run-replay.sh as a tiered quality gate. Output is ready to publish via references/publishing.md.

Regression fixture for dry-run-replay header-skip drift.

A clean skill containing a git commit SHA, a UUID, and an embedded base64 image asset — none of which are secrets and none must trip the scanner.

Sets up structured logging for a service using a configurable log level and service name. Produces a logger.config file ready for ingestion by your logging pipeline. Works with any service that reads configuration from a flat config file.

A skill that accidentally contains an AWS access key — should be caught by the scanner.

A skill containing bare base64 secrets ending in equals-sign padding, which must not evade the entropy detector.

A clean skill with no secrets or sensitive identifiers. Uses only normal configuration values and parameterized placeholders.

A skill with compound credential keys like SECRET_KEY and CLIENT_SECRET that must be matched by the generic-credential detector.

A skill with connection strings carrying embedded credentials, which must be caught and have the credential redacted.

A skill that contains a source-repo service name that should have been parameterized.

A skill with a high-entropy random base64 credential embedded — should be caught by entropy heuristic.

A skill bundling a .env file with uppercase secret keys that must be caught case-insensitively.

A skill that accidentally contains a GitHub personal access token — should be caught by the scanner.

A skill that accidentally contains a Google API key — should be caught by the scanner.

A skill that accidentally contains a 64-character hex encryption key — should be caught by the hex detector.

Fixture for scan-leaks:ignore annotation test — secret annotated with scan-leaks:ignore must be suppressed.

Fixture for scan-leaks:ignore annotation test — same secret WITHOUT annotation must be caught.

A skill that accidentally contains a JWT token — should be caught by the scanner.

A skill that accidentally contains a private key PEM block — should be caught by the scanner.

A skill whose prose describes secret handling without bundling any real credential. Use when documenting how secrets flow through a service.

A skill that accidentally bundles a real credential assignment. Use as a regression fixture to confirm the prose guard does not over-suppress real secrets.

A skill where a real high-entropy secret shares a line with an allowlisted asset reference, which must not suppress detection.

A skill that accidentally contains a Slack bot token — should be caught by the scanner.

A skill that accidentally contains a Stripe live secret key — should be caught by the scanner.

Fixture skill whose template contains a non-uppercase placeholder ({{lower_token}}) with no matching PARAMETERS.md row. Used to verify the residual-token check is independent of inner-content casing (RT-1).

Fixture skill with a placeholder in the template that has no Example value in PARAMETERS.md. Used to test residual-token detection.

Fixture skill with a placeholder in PARAMETERS.md that never appears in any template. Used to test orphan parameter detection.

Creates a pre-built monitoring dashboard wired to the standard metric names produced by the instrumentation skill. Use when you want a ready-to-use dashboard for a service that has already been instrumented with the instrumentation skill.

Adds structured metric collection stubs to a service, exporting counters and histograms under a consistent naming scheme. Use when you want to instrument a service with metrics that follow a standard naming convention so they can be consumed by a shared dashboard.

Sets up a full observability stack with instrumentation and dashboards for a service. Use when you want to add structured metrics collection and a pre-built dashboard to a new service so it is observable from day one.

A minimal but fully valid skill used as the happy-path fixture for validate-skill tests.

Skill with a concrete template file containing placeholders but no PARAMETERS.md. Use when testing that concrete templates with missing PARAMETERS.md still fail bijection.

Skill with perfectly matched template placeholders and PARAMETERS.md entries.

Skill with a PARAMETERS.md placeholder that never appears in any template.

Skill documenting a parameter whose name contains the substring Placeholder. A substring-based header skip would wrongly drop it and report it as undocumented.

Skill whose assets/templates/ contains only *.tmpl scaffolding files (uninstantiated). Use when testing bijection exclusion of .tmpl files.

Skill with a template placeholder not documented in PARAMETERS.md.

This skill references a file in references/ that does not exist.

---

xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx