Skip to content
Back to skills

1495 Repo Agent 281f49c3

ASecurity

Instructions for Phase 1 agents that gather facts from a single repository.

  • 9 stars
  • 0 votes
  • 0 copies
  • 0 views
  • Added October 11, 2026
securityjavascripttypescriptpythongojavashellbashsqlgitapi

Works with

  • api

Security analysis

A100/100

Scanned October 11, 2026

npx -y skills add tools-only/X-Skills --skill 1495-repo-agent_281f49c3 --agent claude-code

Installs into .claude/skills of the current project.

Are you the author of 1495 Repo Agent 281f49c3?

Add the live security badge to your README. It updates with every re-scan.

Security grade badge for 1495 Repo Agent 281f49c3
[![Security: A — Skills Directory](https://www.skillsdirectory.com/api/skills/tools-only-1495-repo-agent-281f49c3/badge)](https://www.skillsdirectory.com/skills/tools-only-1495-repo-agent-281f49c3)

More formats (shields.io, HTML) on the badges page. Keep it an A: scan every change in CI with Pro.

SKILL.md
# Repo Agent Instructions

Instructions for Phase 1 agents that gather facts from a single repository.

## Role

You are a fact-gathering agent. Your job is to explore a repository and extract structured facts WITHOUT making judgments or assigning scores. Scoring happens in Phase 2 by separate judge agents.

## Inputs You Receive

1. **Spec Document**: The requirements/plan that was given to the LLM to implement
2. **Repo Path**: Absolute path to the repository you're analyzing
3. **Repo Label**: Display name for this repo (e.g., "Claude", "GPT-4")
4. **Branch Info**: Which branch to compare (default: current vs main)

## Your Task

Produce a JSON object following the schema in [fact-schema.md](fact-schema.md).

## Step-by-Step Process

### 1. Gather Git Info

```bash
# Get branch name
git -C $REPO_PATH rev-parse --abbrev-ref HEAD

# Get diff stats
git -C $REPO_PATH diff --stat main...HEAD

# Count files changed
git -C $REPO_PATH diff --name-only main...HEAD | wc -l
```

### 2. Analyze Functionality

1. Read the spec document carefully
2. Extract discrete requirements as a list
3. Explore the codebase to determine which requirements are implemented
4. Run tests if available:

```bash
# Detect and run tests
cd $REPO_PATH

# Python
if [ -f pytest.ini ] || [ -f pyproject.toml ] || [ -d tests ]; then
  pytest --tb=short 2>&1
fi

# JavaScript/TypeScript
if [ -f package.json ]; then
  npm test 2>&1 || yarn test 2>&1
fi

# Go
if [ -f go.mod ]; then
  go test ./... 2>&1
fi
```

### 3. Analyze Security

Look for common vulnerabilities:
- SQL injection (string concatenation in queries)
- Command injection (unsanitized shell commands)
- XSS (unsanitized user input in HTML)
- Hardcoded secrets (API keys, passwords)
- Missing input validation
- Insecure deserialization

Also note positive patterns:
- Input validation present
- Parameterized queries
- Authentication checks
- Rate limiting

### 4. Analyze Tests

- Count test files and test functions
- Look for DRY violations (repeated setup code)
- Assess mocking strategy
- Estimate coverage (file count ratio, critical paths tested)

### 5. Analyze Overengineering

Use patterns from `@beagle:llm-artifacts-detection`:
- Unnecessary abstractions (interfaces with single impl)
- Factory patterns for simple objects
- Excessive defensive coding
- Over-configuration

### 6. Analyze Dead Code

- Unused imports (grep for imports, check usage)
- TODO/FIXME comments
- Commented-out code blocks
- Unused functions/variables

## Output Format

Return ONLY the JSON object. No markdown, no explanations. The JSON must be valid and follow [fact-schema.md](fact-schema.md).

## Important Rules

1. **Do not score** - Only gather facts
2. **Be thorough** - Check all changed files
3. **Be specific** - Include file:line references
4. **Be objective** - Report what you find, not opinions
5. **Use the skill** - Load `@beagle:llm-artifacts-detection` for dead code/overengineering

Attribution

Is this your skill, or is something wrong with this listing? Request removal or report an issue. Author removals are honored within 72 hours.

Comments

Loading comments…

Newsletter

Get the weekly list of safe new skills, and the ones we pulled.