More screenshots

    Works with the AI Agents you already use

    Claude CodeClaude CodeCursorCursorCodex CLICodex CLIMuseMuseDotsDots+21 more

    RepoSensei

    1

    Professional GitHub CI/CD audits any GitHub repo and sets up tokenless, tag-driven releases, SHA-pinned CI, branch protection, and AI PR reviewers. Asks before every change.

    Free

    6 uses5.0 (1 review)
    RepoSensei

    RepoSensei

    Example session with this skill installed

    My Python repo only runs tests after merging, and I publish to PyPI with a token stored in GitHub. Audit my setup and help me automate releases properly.

    • Read your context and instructions
    • Compiled the reposensei

    I scanned the repository (Python, public, 10 version tags). Your pipeline ships to PyPI correctly, but it does so on every merge to master, with a long-lived token, from actions that can change underneath you.

    PIPELINE MATURITY: example/repo (public, Python)

    AreaLevelEvidence
    CI0/4ci.yml runs on push to master only, never on pull requests
    Releases & versioning2/410 semver tags, but a merge to master is what publishes
    Publishing & credentials1/4PYPI_API_TOKEN secret passed to twine upload
    Supply-chain security0/4actions on mutable tags (@v4, @v5), no permissions block, no Dependabot
    Contribution governance1/4CONTRIBUTING.md exists; no PR or issue templates.
    Labels & release notes1/4no .github/release.yml, no label check
    Repository health1/4SECURITY.md exists; no CHANGELOG or Code of Conduct

    Overall: Level 0. A pipeline is only as trustworthy as its weakest link, and
    tests that run after merging can't stop a bad change.

    Three changes that give the biggest improvement for the least effort:

    1. Run CI on pull requests and make it a required check.
    2. Publish from a version tag with trusted publishing, then delete the stored token.
    3. Pin every action to a commit SHA and turn on Dependabot.

    Here is the publish job I'd generate. It gets no token, runs only after the build
    and a draft release succeeds, and only this job can request the identity token:

    publish-pypi:
  needs: [build, draft-release]
  environment:
    name: pypi
    url: https://pypi.org/p/your-package
  permissions:
    id-token: write
  steps:
    - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8
      with: { name: dist, path: dist/ }
    - uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33 # release/v1

    Next steps

    1. Approve the plan, and I'll write the workflow files. Nothing changes until you do.
    2. You add one trusted publisher on pypi.org (project, workflow release.yml, environment pypi). I'll give you the exact values.
    3. Rehearse with a pre-release tag such as v1.5.0-rc.1 before the first real release.
    CONTRIBUTING.md

    Connects securely to your tools. The creator never sees your data.

    About this skill

    Manual releases, missing CI checks, and long-lived publish tokens waste time and invite supply-chain attacks. RepoSensei scans your GitHub repository, scores its maturity, and replaces manual chores with a tested, automated pipeline, explaining each change in plain language so you understand what you're shipping. It detects your stack and applies proven patterns instead of making you write the YAML.

    The patterns come from the release process behind marm-memory, an open-source MCP server with 400+ GitHub stars and 96k+ installs across PyPI and Docker. Before listing, I ran the skill on a second real repository and shipped a release through the pipeline it generated: no stored token, with signed build provenance.

    What it does

    • Automates releases. Tag-driven workflows with draft-first publishing, release notes generated from PR labels, and a changelog.
    • Removes stored secrets. Trusted publishing (OIDC) for PyPI, npm, crates.io, RubyGems, and NuGet, with the exact registry-side steps for each. Also covers Docker Hub, GHCR, Maven Central, Go, and GitHub Release binaries.
    • Hardens CI. Runs checks on every pull request, pins actions to commit SHAs, scopes permissions to least privilege, adds Dependabot, and validates workflows with actionlint.
    • Protects your main branch. A single required check, rulesets, and label checks so nothing merges half-reviewed.
    • Sets up AI PR reviewers. Answer one questionnaire and get the right config file for each reviewer you choose: CodeRabbit, GitHub Copilot, Codex, Claude, Greptile, Sourcery, or PR-Agent. It tells you honestly which tools are free for your repo and which aren't.
    • Standardizes governance. CONTRIBUTING.md, PR and issue templates, SECURITY.md, a Code of Conduct, CODEOWNERS, and AGENTS.md rules for AI-assisted contributions.
    • Scores maturity. A seven-area scorecard (CI, releases, publishing, supply chain, governance, labels, repository health) with a before-and-after view.

    How it works

    1. Scan. A bundled script inventories your language, workflows, versions, and existing review agents.
    2. Score. You get a maturity report showing exactly where the gaps are.
    3. Interview. A short set of questions about who maintains the repo and how releases work, with defaults if you want them.
    4. Plan. A layered proposal in the right order, with security fixes first, before any publishing logic.
    5. Apply. After your approval, it writes the files. It never commits for you and never touches a secret value. For settings and accounts, it gives you the exact command or the page to click.
    6. Verify. It checks workflows with actionlint and walks you through a first release.

    Works with

    GitHub Actions and GitHub repositories. It includes stack recipes for Python, Node, Rust, Go, Java, .NET, Ruby, Dart, and Docker, plus a generic release flow for any language.

    Why this beats prompting it yourself

    Secure CI/CD needs OIDC, permission scoping, SHA pinning, and injection-safe workflows. A general prompt gets some of these wrong and drifts between sessions. This skill ships tested templates, a fixed order of operations, a scanner script, and a 177-test suite, and it checks action versions against the live GitHub API instead of guessing from memory.

    Use cases

    • Move from manual twine upload or npm publish to tokenless, tag-driven publishing.
    • Prepare a messy repository for going public: contribution rules, templates, security policy.
    • Harden an existing pipeline against script injection and stale or unpinned actions.
    • Add AI code review to a repo that's drowning in PRs, without paying for tools you don't need.

    Known limitations

    • GitHub only. No GitLab, Bitbucket, or other hosts.
    • You do the account steps yourself: creating secrets, installing review-agent GitHub Apps, and registry-side trusted-publisher setup. The skill gives the exact steps.
    • Settings that live on GitHub (rulesets, immutable releases) are shown to you with the command and applied only on your confirmation.
    • AI reviewer pricing and free tiers change often. The skill states the date it checked the facts, and you should confirm on the tool's own page.
    • The reviewer config templates follow each tool's current docs but haven't been exercised on every tool.
    • Scripts need Python 3. The gh CLI makes version lookups faster; without it, they run offline and flag what to verify.

    How to use

    1. 1

      Connect your agent to the Agensi MCP

      Copy the prompt and paste it into Claude, ChatGPT, Cursor or any agent that supports MCP. It sets up the connection for you. Manual setup

    2. 2

      Sign in to Agensi

      Your agent shows a sign-in link. Sign in and click Allow.

    3. 3

      Ask for what you need

      Your agent loads this skill and uses it on your task. It always asks before any payment.

    Reviews

    5.0
    1 review
    5
    1
    4
    0
    3
    0
    2
    0
    1
    0

    This skill has been used 6 times.

    Trust & safety

    Security scan

    Security scan passed 18 days ago

    • Free with an Agensi account

    Requires

    GitHub
    Pypi
    Crates
    Nuget
    Rubygems
    Maven
    Docker
    Ghcr
    Pub
    Python

    Listed18 days ago

    What's inside

    Frequently Asked Questions