Create Repo Agent

Agent Building

create-repo-agent

Create Repo Agent is an Agent Skill for agent building published in the langfuse/langfuse repository on GitHub: a SKILL.md instruction file an AI agent can load to do this task.

Use when designing, implementing, reviewing, or hardening Langfuse repo-owned autonomous agents, especially GitHub Actions that invoke Claude, Codex, or another LLM agent on a schedule or workflow_dispatch, create pull requests, update workflow prompts or allowlists, handle GitHub tokens/secrets, use untrusted web content, or self-improve repo agent instructions.

View on GitHub ↗

QUICK START

How to use this skill

Bring this guide into your coding agent with a prompt tailored to the tool you use.

Open your project in Codex.
Copy and paste the prompt below.
Review files and risks before approving any action.

Prompt to paste

Inspect the Agent Skill at https://github.com/langfuse/langfuse/blob/HEAD/.agents/skills/create-repo-agent/SKILL.md and all supporting files. Report provenance, permissions, scripts, dependencies, and security risks. Propose an exact installation into .agents/skills/create-repo-agent, but wait for my approval before writing files or running scripts.

Copying this prompt does not install or run the skill. Review third-party files before use.

Create Repo Agent

Purpose

Build repo agents that can run unattended without granting the model broad write credentials, arbitrary shell, or uncontrolled network access. The default architecture is a read-only audit job that produces a validated patch artifact plus a separate publisher job that owns GitHub writes.

Use this skill together with the domain skill for the files the agent will maintain. For example, a pricing agent must also use add-model-price.

Required Reading

For every repo agent task, read these references before designing or editing:

references/security-standards.md
references/workflow-blueprint.md when implementing or changing a GitHub Actions workflow
references/review-checklist.md before final review or PR publication

Workflow

Define the exact maintenance objective, allowed files, external sources, expected no-change behavior, and PR ownership.
Choose the least-capable runtime: prefer a scheduled/manual GitHub Action with read-only repository checkout and no write credentials in the LLM step.
Encode the prompt with explicit allowed edit surfaces, hard constraints, source-evidence requirements, and structured output.
Give the agent only scoped file tools, domain-scoped fetch tools, and exact deterministic validator commands.
Validate the diff independently of the agent, including untracked files, path allowlists, git diff --check, line-count limits, and domain-specific validators.
Publish from a separate job or step after validation, using a bot credential only for branch push and PR create/update.
If self-improvement is allowed, constrain it to named workflow or skill-reference files and require security invariants to remain unchanged.
Run agent setup checks when .agents/** changes, then publish a normal human-reviewable PR.

Non-Negotiables

Never expose a write-capable GitHub token, PAT, GitHub App token, OIDC token, SSH key, cloud credential, or package-publishing token to the LLM agent step.
Never rely on prompt instructions as the only security boundary. Enforce file and command limits outside the agent.
Never stage a directory wholesale. Stage only the validated file list.
Never ignore untracked files in diff validation.
Never let self-improvement bypass the same diff allowlist and human PR review as normal edits.
Never grant arbitrary Bash, curl, wget, gh, git push, package-manager, interpreter, environment-dump, or process-inspection tools to the LLM agent.
Never add id-token: write unless the agent truly needs OIDC and the trust relationship is reviewed explicitly.