Run any Skill in Manus with one click

github-app-integration-guard

Stars3

Forks0

UpdatedApril 24, 2026 at 01:24

Use when implementing GitHub webhooks, repository sync, installation auth, or repo-content ingestion. Enforces GitHub App-first integration, least privilege, webhook signature verification, installation-token caching, and connector-only scope inside Pocket CFO.

Installation

Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.

Run Skill in Manus

Source

616xold

616xold/pocket-cfo

View GitHub Repository View Creator Repositories

Download

Run Skill in Manus

Related occupationsSOC

Based on SOC occupation classification

Software DevelopersComputer and Mathematical Occupations·SOC 15-1252

File Explorer

2 files

SKILL.md

readonly

name	github-app-integration-guard
description	Use when implementing GitHub webhooks, repository sync, installation auth, or repo-content ingestion. Enforces GitHub App-first integration, least privilege, webhook signature verification, installation-token caching, and connector-only scope inside Pocket CFO.

GitHub App Integration Guard

Pocket CFO is not GitHub-first anymore. GitHub remains useful, but only as an optional connector.

This skill keeps the integration secure, modular, and out of the product center.

Trigger when

Use this skill when touching:

webhook ingestion
GitHub App authentication
installation token generation or caching
repository-content sync
branch, commit, pull request, or check-run integration
GitHub-specific env vars or permissions
migration code that bridges legacy GitHub modules into a generic source-registry boundary

Do not use this skill when touching:

unrelated UI work
generic finance mission domain types
source-registry code with no GitHub dependency

Rules

Prefer a GitHub App over PAT-based flows.
Keep GitHub behind a connector boundary, not in the primary finance domain model.
Verify webhook signatures before processing payloads.
Scope installation tokens to the minimum repositories and permissions needed.
Cache installation tokens until expiry and refresh on demand.
Keep transport, auth, and repo operations in separate modules.
Make webhook handling idempotent.
Persist installation metadata and external ids explicitly.
Emit replay or outbox events for user-visible GitHub side effects.
Document any new app permissions and webhook subscriptions.
Do not let GitHub assumptions leak into mission intake, proof bundles, or the source-of-truth model.

Suggested module split

webhook-routes.ts for Fastify transport only
signature.ts for webhook verification
auth.ts for JWT and installation-token logic
client.ts for GitHub API operations
repository.ts for local persistence
service.ts for orchestration-facing behavior

Final checks

Before finishing, verify:

no webhook path performs business logic inline
app permissions are documented
installation tokens are not stored as long-lived secrets
repo access is installation-scoped
the active Finance Plan explains why GitHub work is needed for Pocket CFO
GitHub remains a connector, not the product identity

More from this repository

same repository

cfo-wiki-maintainer

616xold/pocket-cfo

Use for active docs, CFO Wiki docs, local-dev docs, eval docs, benchmark docs, roadmap, START_HERE, or docs that guide future Codex threads.

2026-04-243

evidence-bundle-auditor

616xold/pocket-cfo

Use for proof bundles, evidence summaries, alert cards, monitoring results, reporting outputs, approval cards, validation ladders, or shipped-claim truthfulness.

2026-04-243

execplan-orchestrator

616xold/pocket-cfo

Use when a task is complex, spans multiple files or packages, or needs a step-by-step execution document. Create or update a Finance Plan in plans/ that follows PLANS.md exactly, uses the F0-F6 roadmap, and remains live during implementation.

2026-04-243

f6-monitoring-semantics-guard

616xold/pocket-cfo

Use for F6 planning or implementation involving monitors, alert cards, thresholds, investigation missions, policy/control ownership, recurring checks, or demo replays.

2026-04-243

finance-plan-orchestrator

616xold/pocket-cfo

Use for any Pocket CFO task that creates, updates, audits, or executes Finance Plans, active roadmap docs, phase handoffs, or plan truthfulness. Do not use to widen scope beyond the current active plan.

2026-04-243

modular-architecture-guard

616xold/pocket-cfo

Use for implementation or planning tasks that touch module boundaries, route design, schema, runtime, approvals, reporting, monitoring, or package-level architecture.

2026-04-243

name	github-app-integration-guard
description	Use when implementing GitHub webhooks, repository sync, installation auth, or repo-content ingestion. Enforces GitHub App-first integration, least privilege, webhook signature verification, installation-token caching, and connector-only scope inside Pocket CFO.

GitHub App Integration Guard

Pocket CFO is not GitHub-first anymore. GitHub remains useful, but only as an optional connector.

This skill keeps the integration secure, modular, and out of the product center.

Trigger when

Use this skill when touching:

webhook ingestion
GitHub App authentication
installation token generation or caching
repository-content sync
branch, commit, pull request, or check-run integration
GitHub-specific env vars or permissions
migration code that bridges legacy GitHub modules into a generic source-registry boundary

Do not use this skill when touching:

unrelated UI work
generic finance mission domain types
source-registry code with no GitHub dependency

Rules

Prefer a GitHub App over PAT-based flows.
Keep GitHub behind a connector boundary, not in the primary finance domain model.
Verify webhook signatures before processing payloads.
Scope installation tokens to the minimum repositories and permissions needed.
Cache installation tokens until expiry and refresh on demand.
Keep transport, auth, and repo operations in separate modules.
Make webhook handling idempotent.
Persist installation metadata and external ids explicitly.
Emit replay or outbox events for user-visible GitHub side effects.
Document any new app permissions and webhook subscriptions.
Do not let GitHub assumptions leak into mission intake, proof bundles, or the source-of-truth model.

Suggested module split

webhook-routes.ts for Fastify transport only
signature.ts for webhook verification
auth.ts for JWT and installation-token logic
client.ts for GitHub API operations
repository.ts for local persistence
service.ts for orchestration-facing behavior

Final checks

Before finishing, verify:

no webhook path performs business logic inline
app permissions are documented
installation tokens are not stored as long-lived secrets
repo access is installation-scoped
the active Finance Plan explains why GitHub work is needed for Pocket CFO
GitHub remains a connector, not the product identity