yangshu2087/repo-codex-bootstrap
.agents/skills/repo-codex-bootstrap/SKILL.md
Add or refresh repository-level Codex scaffolding such as .codex/config.toml and AGENTS.md. Use when a repo needs lightweight Codex defaults, repo-specific instructions, or a repeatable project bootstrap.
development
Updated Apr 16, 2026
$ install --global
skillsauthnpx skillsauth add yangshu2087/Codex repo-codex-bootstrapInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Apr 16, 2026, 3:36 PM18.6s1 file scanned
SKILL.md
- name:
- repo-codex-bootstrap
- description:
- Add or refresh repository-level Codex scaffolding such as .codex/config.toml and AGENTS.md. Use when a repo needs lightweight Codex defaults, repo-specific instructions, or a repeatable project bootstrap.
Repo Codex Bootstrap
Use this skill when a repository is missing Codex project scaffolding or its local instructions have drifted.
Workflow
- Inspect the repository before writing anything:
git status --short- top-level files and directories
- existing
.codex/orAGENTS.md
- Infer the repository purpose from local files, not from the directory name alone.
- Add the smallest useful project config:
- usually
approval_policy = "on-request" - usually
sandbox_mode = "workspace-write" - only add extra keys when the repo clearly needs them
- usually
- Write
AGENTS.mdwith repo-specific rules:- what the repo is for
- what not to do here
- how to verify changes in this repo
- Avoid copying a generic wall of text into every repo. A short, accurate repo guide is better than a long template.
- After changes, rerun the narrowest relevant verification commands and report the exact files added or updated.
Team conventions
- Shared team skills live in
/Users/yangshu/Codex/.agents/skills. - Project-level instructions should complement ancestor instructions, not restate them verbatim.
- When a rule applies to every repo, prefer the shared ancestor
AGENTS.md. Use repoAGENTS.mdonly for local specifics.
Related Skills
yangshu2087/terrashark
development
VerifiedTrustedCommunity
Use when explicitly reviewing, generating, refactoring, or migrating Terraform/OpenTofu IaC and checking failure modes such as identity churn, secrets, blast radius, CI drift, or compliance gates.
SKILL.mdUpdated Apr 16, 2026
yangshu2087/stitch-ui-prompt-architect
development
VerifiedTrustedCommunity
Use when the user explicitly mentions Google Stitch and wants a structured Stitch-ready UI prompt or prompt refinement from rough product/design ideas.
SKILL.mdUpdated Apr 16, 2026
yangshu2087/stitch-react-components
development
VerifiedTrustedCommunity
Use when the user explicitly mentions Google Stitch and asks to convert Stitch designs into Vite, CRA, or generic React components.
SKILL.mdUpdated Apr 16, 2026
yangshu2087/stitch-nextjs-components
development
VerifiedTrustedCommunity
Use when the user explicitly mentions Google Stitch and asks to convert Stitch designs into Next.js App Router components.
SKILL.mdUpdated Apr 16, 2026