Create Repo Agent
Purpose
Build repo agents that can run unattended without granting the model broad write credentials, arbitrary shell, or uncontrolled network access. The default architecture is a read-only audit job that produces a validated patch artifact plus a separate publisher job that owns GitHub writes.
Use this skill together with the domain skill for the files the agent will maintain. For example, a pricing agent must also use add-model-price.
Required Reading
For every repo agent task, read these references before designing or editing:
references/security-standards.mdreferences/workflow-blueprint.md when implementing or changing a GitHub Actions workflowreferences/review-checklist.md before final review or PR publication
Workflow
- Define the exact maintenance objective, allowed files, external sources, expected no-change behavior, and PR ownership.
- Choose the least-capable runtime: prefer a scheduled/manual GitHub Action with read-only repository checkout and no write credentials in the LLM step.
- Encode the prompt with explicit allowed edit surfaces, hard constraints, source-evidence requirements, and structured output.
- Give the agent only scoped file tools, domain-scoped fetch tools, and exact deterministic validator commands.
- Validate the diff independently of the agent, including untracked files, path allowlists,
git diff --check, line-count limits, and domain-specific validators.
- Publish from a separate job or step after validation, using a bot credential only for branch push and PR create/update.
- If self-improvement is allowed, constrain it to named workflow or skill-reference files and require security invariants to remain unchanged.
- Run agent setup checks when
.agents/** changes, then publish a normal human-reviewable PR.
Non-Negotiables
- Never expose a write-capable GitHub token, PAT, GitHub App token, OIDC token, SSH key, cloud credential, or package-publishing token to the LLM agent step.
- Never rely on prompt instructions as the only security boundary. Enforce file and command limits outside the agent.
- Never stage a directory wholesale. Stage only the validated file list.
- Never ignore untracked files in diff validation.
- Never let self-improvement bypass the same diff allowlist and human PR review as normal edits.
- Never grant arbitrary
Bash, curl, wget, gh, git push, package-manager, interpreter, environment-dump, or process-inspection tools to the LLM agent.
- Never add
id-token: write unless the agent truly needs OIDC and the trust relationship is reviewed explicitly.
1---2name: create-repo-agent3description: Design, implement, review, or harden Langfuse repo-owned autonomous agents. Use for LLM-powered GitHub Actions, scheduled or dispatched agents, agent-created PRs, prompts, allowlists, tokens, untrusted content, or self-updating instructions.4---5
6# Create Repo Agent
7
8## Purpose
9
10Build repo agents that can run unattended without granting the model broad write credentials, arbitrary shell, or uncontrolled network access. The default architecture is a read-only audit job that produces a validated patch artifact plus a separate publisher job that owns GitHub writes.
11
12Use this skill together with the domain skill for the files the agent will maintain. For example, a pricing agent must also use `add-model-price`.
13
14## Required Reading
15
16For every repo agent task, read these references before designing or editing:
17
181. `references/security-standards.md`
192. `references/workflow-blueprint.md` when implementing or changing a GitHub Actions workflow
203. `references/review-checklist.md` before final review or PR publication
21
22## Workflow
23
241. Define the exact maintenance objective, allowed files, external sources, expected no-change behavior, and PR ownership.
252. Choose the least-capable runtime: prefer a scheduled/manual GitHub Action with read-only repository checkout and no write credentials in the LLM step.
263. Encode the prompt with explicit allowed edit surfaces, hard constraints, source-evidence requirements, and structured output.
274. Give the agent only scoped file tools, domain-scoped fetch tools, and exact deterministic validator commands.
285. Validate the diff independently of the agent, including untracked files, path allowlists, `git diff --check`, line-count limits, and domain-specific validators.
296. Publish from a separate job or step after validation, using a bot credential only for branch push and PR create/update.
307. If self-improvement is allowed, constrain it to named workflow or skill-reference files and require security invariants to remain unchanged.
318. Run agent setup checks when `.agents/**` changes, then publish a normal human-reviewable PR.
32
33## Non-Negotiables
34
35- Never expose a write-capable GitHub token, PAT, GitHub App token, OIDC token, SSH key, cloud credential, or package-publishing token to the LLM agent step.
36- Never rely on prompt instructions as the only security boundary. Enforce file and command limits outside the agent.
37- Never stage a directory wholesale. Stage only the validated file list.
38- Never ignore untracked files in diff validation.
39- Never let self-improvement bypass the same diff allowlist and human PR review as normal edits.
40- Never grant arbitrary `Bash`, `curl`, `wget`, `gh`, `git push`, package-manager, interpreter, environment-dump, or process-inspection tools to the LLM agent.
41- Never add `id-token: write` unless the agent truly needs OIDC and the trust relationship is reviewed explicitly.
langfuse