Works with the AI tools you already use
Claude Code
Cursor
Codex CLI
GitHub Copilot
Gemini CLI+20 moreClaude CodeCursorCodex CLIGitHub CopilotGemini CLI
OpenClaw
Manus
Grok+17 agentsRepository Bootstrap
1
That folder either never makes it to GitHub, or it does, and the secrets go with it, silently, in the first commit.
$6.99
0 installsSecurity scanned
Repository Bootstrap
Example session with this skill installed
/repo-bootstrap kitties-project
- Read your context and instructions
- Compiled the repository bootstrap
- Generated the data export
------------------------------------------------------------
STEP 1 — Target folder
------------------------------------------------------------
$ARGUMENTS = "kitties-project"
Using it directly, no confirmation needed.
------------------------------------------------------------
STEP 2 — Scan and assess current state
------------------------------------------------------------
kitties-project/
├── scrape_shelters.py
├── instagram_poster.R
├── db_import.js
├── match_algorithm.py
├── notion_key.txt
├── .env
├── cats_photos_dump.csv (12.4 MB)
├── config.py
└── utils/
└── legacy_helpers.py
**Languages detected:** Python, R, JavaScript
All 6 source files read in full.
**State checks**
.git/ — not present (fresh bootstrap)
README.md — not present
.gitignore — not present
config/config.json — not present
------------------------------------------------------------
STEP 3 — Credentials, sensitive links & resource IDs found
------------------------------------------------------------
# | File:line | Pattern | Type
---|---------------------------------|--------------------------------------------------------------------------|----------------------
1 | scrape_shelters.py:14 | PETFINDER_API_KEY = "pf_live_9f2a...c71b" | hardcoded secret
2 | scrape_shelters.py:22 | read_sheet("https://docs.google.com/spreadsheets/d/1BxiMV...../edit") | sensitive link (Google Sheet)
3 | instagram_poster.R:8 | IG_TOKEN <- "EAAG...redacted...Zx" | hardcoded secret
4 | instagram_poster.R:11 | notion_key <- readLines("notion_key.txt") | credential file on disk
5 | db_import.js:5 | mongodb://kittyadmin:Wh1skers!23@cluster0.mongodb.net/shelter | inline auth (connection string)
6 | db_import.js:19 | https://console.aws.amazon.com/s3/buckets/kitties-photo-backup?... | sensitive link (cloud console)
7 | db_import.js:27 | Authorization: Bearer xoxb-4736...redacted...q1 | inline auth header (Slack bot token)
8 | match_algorithm.py:6 | AIRTABLE_BASE_URL = "https://airtable.com/appK7z2.../tblAdopters" | sensitive link (Airtable base)
9 | match_algorithm.py:9 | SHELTER_WORKSPACE_ID = "8f14e45f-...-3f2b1a7c4b9d" | hardcoded resource ID (UUID)
10 | .env | PETFINDER_API_KEY=, IG_TOKEN= (duplicates of #1 / #3) | credential-shaped file
Skipped (placeholder, correctly not flagged):
config.py:3 — API_KEY = "your-key-here"
------------------------------------------------------------
STEP 4 — Proposed config/config.json
------------------------------------------------------------
```json
{
"petfinder_api_key": "",
"google_sheet_url": "",
"ig_token": "",
"notion_key": "",
"mongodb_uri": "",
"aws_s3_console_url": "",
"slack_bot_token": "",
"airtable_base_url": "",
"shelter_workspace_id": ""
}
```
All 6 source files edited to load via:
Python — json.load(open("config/config.json"))
R — jsonlite::fromJSON("config/config.json")
JS — JSON.parse(fs.readFileSync("config/config.json"))
notion_key.txt deleted after confirming its value was captured in config.
------------------------------------------------------------
STEP 5 — .gitignore (created)
------------------------------------------------------------
config/config.json
.env
notion_key.txt
cats_photos_dump.csv
__pycache__/
*.pyc
venv/
node_modules/
.Rproj.user/
.DS_Store
------------------------------------------------------------
STEP 6 — README.md (created)
------------------------------------------------------------
# kitties-project
**A shelter-cat pipeline:** scrapes adoptable-cat listings from Petfinder,
logs them to a Google Sheet, posts photos to Instagram, imports records
into MongoDB with an S3 photo backup, and runs an adopter-matching
algorithm against an Airtable base.
## Setup
- Requirements/install commands for Python, R, and Node dependencies
- config/config.json — all 9 keys explained, with where to obtain each
- External services called: Petfinder API, Google Sheets, Instagram
Graph API, MongoDB Atlas, AWS S3, Slack, Airtable
## Usage
- Real invocation examples per script (arguments/flags), derived from
the actual code paths
------------------------------------------------------------
PRE-COMMIT CHECKS → issues.md (first pass)
------------------------------------------------------------
# Issues
_Last checked: 2026-08-31_
## Critical
- **[C1] Merge conflict markers left in source** — utils/legacy_helpers.py:41-47
contains <<<<<<<, =======, >>>>>>> from an unresolved merge. Resolve before
committing.
- **[C2] Credential-shaped file still staged** — .env matched the staged set
even after migration; confirm it's listed in .gitignore and run
`git restore --staged .env`.
## Warnings
- **[W1] Very large staged file** — cats_photos_dump.csv is 12.4 MB. Move to
.gitignore or Git LFS; a raw data dump shouldn't live in git history.
- **[W2] Broken import reference** — db_import.js:2 does
require('./helpers/mongo_utils') but that path doesn't exist (actual file
is utils/legacy_helpers.py, wrong language too).
- **[W3] Broken import reference** — match_algorithm.py:3 imports
`from adopter_scoring import score` but no adopter_scoring.py exists
anywhere in the tree.
## Info
- **[I1] TODO / FIXME comments** — 7 found: scrape_shelters.py:31,58,
instagram_poster.R:19, db_import.js:12,44, match_algorithm.py:22,35.
**RESULT:** run stopped here. Two Critical issues unresolved — no commit
message proposed yet.
------------------------------------------------------------
FOLLOW-UP — Criticals resolved, second pass
------------------------------------------------------------
**Imagined fixes applied**
- utils/legacy_helpers.py:41-47 — merge conflict manually resolved,
kept the newer branch's implementation of clean_photo_filename()
- .env — unstaged (`git restore --staged .env`), confirmed already
covered by .gitignore, re-verified nothing else credential-shaped
is staged
Pre-commit checks re-run against the staged set:
# Issues
_Last checked: 2026-08-31_
## Warnings
- **[W1] Very large staged file** — cats_photos_dump.csv is 12.4 MB.
- **[W2] Broken import reference** — db_import.js:2.
- **[W3] Broken import reference** — match_algorithm.py:3.
## Info
- **[I1] TODO / FIXME comments** — 7 found (see above).
No Critical issues remain. Warnings/Info don't block — proceeding.
------------------------------------------------------------
STEP 7 — Git init and first commit
------------------------------------------------------------
$ git init
Initialized empty Git repository in kitties-project/.git/
$ git add .
$ git status
new file: .gitignore
new file: README.md
new file: config/config.json
new file: scrape_shelters.py
new file: instagram_poster.R
new file: db_import.js
new file: match_algorithm.py
new file: config.py
new file: utils/legacy_helpers.py
(cats_photos_dump.csv, notion_key.txt, .env — correctly absent, ignored/deleted)
**Proposed commit message**
"Initial commit"
>> Awaiting explicit user approval before running git commit <<
(imagined) user approves the exact message above.
$ git commit -m "Initial commit"
[main (root-commit) a1b2c3d] Initial commit
9 files changed, 412 insertions(+)
------------------------------------------------------------
STEP 8 — Propose GitHub push (never auto-run)
------------------------------------------------------------
$ gh auth status
Logged in to github.com as callitmagic
$ git remote -v
(none)
$ gh api user --jq .login
callitmagic
$ gh repo view callitmagic/kitties-project
(not found — no existing repo under that name)
No local remote, repo doesn't exist yet on GitHub → fresh-bootstrap case.
Asked (imagined AskUserQuestion): private or public? → user picks private.
Proposed (NOT run):
gh repo create kitties-project --private --source=. --remote=origin
git push -u origin main
------------------------------------------------------------
STEP 9 — Summary
------------------------------------------------------------
README.md: created
.gitignore: created (10 rules)
config/config.json: created — 9 keys migrated
(petfinder_api_key, google_sheet_url, ig_token, notion_key, mongodb_uri,
aws_s3_console_url, slack_bot_token, airtable_base_url,
shelter_workspace_id)
notion_key.txt: deleted (superseded by config)
**Pre-commit issues:** 0 Critical, 3 Warnings, 1 Info (see issues.md history above)
**Commit status:** committed (a1b2c3d, "Initial commit")
**GitHub push:** proposed, not yet run
gh repo create kitties-project --private --source=. --remote=origin
git push -u origin main
============================================================
END OF SIMULATED TRANSCRIPT
============================================================
repository-bootstrap.csv
CSV · data export
Example file from a real run - the skill writes it into your workspace.
Connects securely to your tools. The creator never sees your data.
What you get
Extract hardcoded API keys into a secure JSON config file automaticallyGenerate a professional README.md based on actual code analysisPrevent sensitive private links from being pushed to public repositoriesScaffold .gitignore files tailored to the specific languages in the folder
About this skill
The problem
Personal projects and prototypes usually start as a folder full of scripts with API keys, database IDs, and private Google Sheet or Notion links pasted directly into the code — because writing a README, a .gitignore, and a config file all take time you don't want to spend before you've even proven the idea works. That folder either never makes it to GitHub, or it does, and the secrets go with it, silently, in the first commit.
What it does
- Reads every source file in the target folder to understand what the project actually does, then writes a README covering setup, the config file's keys, and how to run each entry point.
- Greps every file for hardcoded credentials, inline auth headers, high-entropy or known-prefix secret strings, standalone credential files, private links (Google Sheets, Docs, Drive, Notion, Airtable, cloud-provider consoles), and hardcoded resource or environment IDs like database or workspace IDs.
- Migrates every finding into a structured config/config.json, rewrites the source to load from it instead, and deletes any now-redundant standalone credential file — only after confirming the value made it into the config.
- Builds or extends a .gitignore to cover the config file and any remaining credential-shaped files, runs git init and pre-commit checks (unmigrated secrets, merge-conflict markers, oversized files, broken imports), writes any findings to issues.md, and proposes a commit message and the GitHub repo-create/push commands for your approval.
Why this beats prompting it yourself
A one-off prompt to "clean this up for GitHub" tends to catch the obvious api_key = "..." pattern and miss the rest — a Google Sheet ID buried in a URL, a bare UUID constant assigned to CHANNEL_ID, a credential file the script quietly reads from disk. This skill runs the same fixed checklist every time, blocks the commit until critical issues are resolved, and never prints the actual secret values it finds, even to explain them.
Use cases
- Turning a personal script or prototype folder into a repo you're ready to make public without leaking the API keys you were testing with.
- Getting a folder that already has scattered credentials and private links cleaned up and structured before the first commit, not after a leak.
- Re-running the bootstrap on a folder you started earlier to catch anything a manual setup missed, without disturbing an existing README or .gitignore.
- Preparing a project for a teammate or buyer to clone and run, where the setup instructions and config structure need to be self-explanatory.
How to install
Works the same in every agent - Claude, Cursor, Codex, Copilot and 20+ more.
~30 seconds
- 1
Download the ZIP
Free skills download straight away. Paid skills unlock right after purchase.
- 2
Unzip into your skills folder
Every agent reads skills from one folder on your machine. Drop the unzipped folder in there.
- 3
Ask your agent to use it
Restart the agent if it was already running. It picks the skill up automatically - no config needed.
Skills folder by agent
Click the path to copy it. Create the folder if it does not exist yet.
Reviews
No reviews yet
Be one of the first to try it. Every listed skill passes our trust checks below.
Security scanned
Passed our 8-point scan before listing
Fresh listing
Recently published to Agensi
30-day refund
Not a fit? Get your money back
Trust & safety
Security scanned
Verified clean 4 days ago
- Passed all security checks, Safe to install
Listed4 days ago