auto-repo-setup

What the source does

• FilesystemNone observedNo reads or writes in the source
• NetworkNone observedNo outbound calls in the source
• ShellNone observedNo commands run in the source
• DependenciesPinnedNothing floats
• SecretsNone foundNo keys in source

Five audit layers

Gates applied: no behavioural pass.

AGENTS.md

Audit 0.4.1 · source sha 7bc03e6c5819 · 21 Oct 2026Report an issue or request a re-scan

• Publisherdaymade GitHub userOwner of the repository this skill is read from
• Source folderdaymade/claude-code-skills/auto-repo-setupThe exact folder we audited
• LicenceMITAs the repository states it
• Commit pinned for this verdict7bc03e6c5819A new audit runs when the source changes
• Repository statusNot archivedPushed today
• Sandboxed runNot runSkills are read, not executed; layer L4 is skipped

Its description: Diagnoses and repairs repository setup and guarded Git workflows for Claude Code or Codex — environment repair, startup sync, hook auditing, collaborator handoff. Use when a repo won't run, a teammate onboards, hook…

---
name: auto-repo-setup
description: >-
  Diagnoses and repairs repository setup and guarded Git workflows for Claude Code or Codex —
  environment repair, startup sync, hook auditing, collaborator handoff. Use when a repo won't run,
  a teammate onboards, hook output duplicates, or commit/push/conflict needs guarding. Not for
  lost-commit recovery (use git-safety-net), GitHub ops (use github-ops), or history scrubbing (use
  github-sensitive-data-cleanup).
argument-hint: "[repository path]"
---

# Auto Repo Setup

Make the repository usable without changing the user's normal way of working.
Treat setup as an evidence-driven repository task, not as a special interface for
people with a particular job title.

## Entry router

Classify the request before changing anything. Do not combine modes merely because
they all contain the word "setup".

| User outcome | Mode | First action |
|---|---|---|
| "It won't run", missing dependency, new machine | Environment repair | Read project instructions and detect the actual stack |
| "Sync before we work", "pull the latest" | Session routine | Use project instructions or execute the user's natural-language request |
| Repeated or unexpected hook output | Hook diagnosis | Count registrations and firing sessions before editing configuration |
| A teammate needs a repeatable handoff | Repository handoff | Audit existing onboarding and fill only the missing operational contract |
| Commit, push, conflict, leaked secret/history | Git safety | Read [references/git_safety.md](references/git_safety.md) before mutation |
| Behavior must happen before the first prompt | Startup automation | Read [references/startup_automation.md](references/startup_automation.md) and pass its hook gate |

## Operating principles

1. **Do not infer competence from role.** Match the user's demonstrated altitude.
   A collaborator can tell an agent "sync the remote first"; do not invent a
   launcher, shortcut, or wizard unless the user asked for one.
2. **Use the least mechanism that satisfies the outcome.** Prefer, in order:
   direct Agent instruction → project instruction → explicit command → lifecycle
   hook. A hook is not a more professional version of a sentence.
3. **Inspect authority before producing.** Read the current user request, then
   project instructions, onboarding/runbooks, manifests, lockfiles, and actual
   command output. Do not make ONBOARDING.md, Python, uv, ffmpeg, or .env mandatory
   for repositories that do not declare them.
4. **Preserve user work.** Never auto-stash, merge, rebase, force, discard, or
   overwrite local changes to make setup look successful. Already-authorized
   delivery of this task's isolated changes may use the repository's declared
   scoped workflow under [Authorized shared-checkout delivery](references/git_safety.md#authorized-shared-checkout-delivery);
   this does not authorize integrating unrelated local commits or shared WIP.
5. **Define a falsifiable success state.** "Dependencies installed" is not enough;
   run the project's real smoke test or startup command and verify the observable
   result.
6. **Keep diagnosis read-only until the cause is known.** Installation, config
   edits, hook registration, commits, and external writes require the authority
   implied by the user's request; destructive or public actions require explicit
   approval.

## Workflow A — Environment repair

### A1. Read the project map

Read only files that exist, in this order:

1. AGENTS.md and AGENTS.override.md
2. CLAUDE.md and scoped project rules
3. ONBOARDING.md or the repository's named setup/runbook
4. README.md
5. Manifests, lockfiles, task runners, CI, and container configuration
6. Existing Claude/Codex settings only when the request concerns agent behavior

If no onboarding guide exists, infer the setup path from authoritative manifests
and exercised commands. Do not stop to ask whether to create documentation unless
a durable handoff is part of the request.

### A2. Run a read-only capability inventory

Use the bundled scripts/check_env.py against the repository root when a Python
3.10+ runner is already available. It detects the declared ecosystem and checks
only the relevant toolchain; it does not install dependencies or read secret
values. If Python is itself the missing prerequisite, perform the same read-only
manifest inventory directly instead of installing Python merely to run the audit.

~~~bash
uv run python scripts/check_env.py --repo <repo-root>
uv run python scripts/check_env.py --repo <repo-root> --json
~~~

Treat the inventory as evidence, not as the project setup specification. A custom
runbook or CI workflow can require tools the generic inventory cannot infer.

Expected result:

- exit 0: all toolchains inferred from manifests are available;
- exit 1: one or more inferred prerequisites are missing;
- exit 2: the repository or its metadata could not be inspected safely.

### A3. Repair the root cause

For each failed requirement:

1. Capture the exact command, exit code, stdout, and stderr.
2. Trace the failure to the declaring source: project guide, manifest, lockfile,
   configuration, or runtime log.
3. Apply the smallest project-consistent repair.
4. Re-run the failed check before moving on.

Do not restart, reinstall everything, or switch package managers as a first move.
Do not print .env or credential contents; verify presence and behavior without
echoing values.

### A4. Verify the product path

Run the project's documented smoke test, build, or start command. If none exists,
derive one from CI/task-runner configuration and label the derivation. Verify the
observable result, not merely a zero exit code.

Report:

- what was broken and the evidence;
- what changed;
- the exact verification and result;
- any remaining user action or blocked authority.

## Workflow B — Routine Git sync

For "sync before work", prefer a short project instruction shared by the agents
that use the repository. The routine is:

1.

Excerpt, first 6,000 characters of SKILL.md, verbatim from the audited commit. It is text from someone else’s repository, quoted so you can judge it before your agent reads it.

1. 2026-10-21
   ✓SAFE B 89 / 100

   first audit · source 7bc03e6c5819

Questions about auto-repo-setup

• github.com/daymade/claude-code-skills/tree/main/auto-repo-setup — the audited source at commit 7bc03e6c5819 and every finding aboveObserved · 21 Oct 2026

Spotted something wrong? Report a correction · Methodology