| name | adopt-external |
| description | Use when reviewing an external repo or article to adopt practices into DOTS โ security-vet first, map novel vs duplicative, port (never install), review, commit your changes. |
| allowed-tools | Read, Write, Edit, Bash, WebFetch, WebSearch |
Adopt External Repo / Article
Evaluate an external repo or article and fold the genuinely-useful parts into DOTS โ without importing bloat or risk. Thin entry point; the full procedure, principles, and accumulated gotchas live in docs/ai-includes/external-repo-adoption.md โ read it first.
Trigger
User shares a repo/article "to see what we can adopt." One source at a time.
The cycle
Nine phases โ read the full procedure in the doc before starting: Identify โ Security-pass-FIRST โ Map novel-vs-duplicative โ Tiered recommendation โ Implement (port, never install) โ Adversarial review โ Fix + RCA โ Commit MINE only โ Push.
See external-repo-adoption.md ยง The cycle for each phase in detail. (This skill stays thin and points to the doc rather than restating it โ per external-skill-ports.md "Don't amplify a rule โ point to it".)
Top gotchas
- Never install the external plugin โ it's prompt-injection-by-design (SessionStart injects high-authority context) + context tax + conflicts with our curated setup. Port text instead.
- Calibrate, don't blind-port โ a rule correct upstream can be wrong here (e.g. DOTS mandates fail-open hooks).
- Most of a general operator repo is irrelevant or duplicative for a C#/.NET Bannerlord mod. Be honest and critical.
- Right-size the fan-out โ if the README makes the verdict obvious (clearly out-of-domain โ skip), do a light inline pass; don't spin up a multi-agent workflow to confirm the obvious.
- Verify load-bearing security claims yourself before relaying a subagent's read โ a subagent verdict is a hypothesis (
evidence-over-claims.md A.4).
- After porting config/hooks, run
/security-scan on our own result.
- When DESCRIBING security patterns in the skill/docs you author, avoid embedding literal trigger strings (they can self-flag
/security-scan) โ describe the category or use audit-allow:.
Pair with
/security-scan โ runs at the end of the implement phase.
/deep-review, /review-codex โ for the adversarial-review phase on C# changes.
external-skill-ports.md, evidence-over-claims.md, simplicity-criterion.md โ the rules this cycle leans on.