菜单
Use when implementing GitHub webhooks, repository sync, installation auth, or repo-content ingestion. Enforces GitHub App-first integration, least privilege, webhook signature verification, installation-token caching, and connector-only scope inside Pocket CFO.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
Use for active docs, CFO Wiki docs, local-dev docs, eval docs, benchmark docs, roadmap, START_HERE, or docs that guide future Codex threads.
Use for proof bundles, evidence summaries, alert cards, monitoring results, reporting outputs, approval cards, validation ladders, or shipped-claim truthfulness.
Use when a task is complex, spans multiple files or packages, or needs a step-by-step execution document. Create or update a Finance Plan in plans/ that follows PLANS.md exactly, uses the F0-F6 roadmap, and remains live during implementation.
Use for F6 planning or implementation involving monitors, alert cards, thresholds, investigation missions, policy/control ownership, recurring checks, or demo replays.
Use for any Pocket CFO task that creates, updates, audits, or executes Finance Plans, active roadmap docs, phase handoffs, or plan truthfulness. Do not use to widen scope beyond the current active plan.
Use for implementation or planning tasks that touch module boundaries, route design, schema, runtime, approvals, reporting, monitoring, or package-level architecture.
基于 SOC 职业分类
| name | github-app-integration-guard |
| description | Use when implementing GitHub webhooks, repository sync, installation auth, or repo-content ingestion. Enforces GitHub App-first integration, least privilege, webhook signature verification, installation-token caching, and connector-only scope inside Pocket CFO. |
Pocket CFO is not GitHub-first anymore. GitHub remains useful, but only as an optional connector.
This skill keeps the integration secure, modular, and out of the product center.
Use this skill when touching:
Do not use this skill when touching:
webhook-routes.ts for Fastify transport onlysignature.ts for webhook verificationauth.ts for JWT and installation-token logicclient.ts for GitHub API operationsrepository.ts for local persistenceservice.ts for orchestration-facing behaviorBefore finishing, verify: