From 66af67c10f7827d4c31b73008e86cd10a214e126 Mon Sep 17 00:00:00 2001 From: Jakob Heuser Date: Wed, 11 Nov 2026 18:27:35 -0800 Subject: [PATCH] chore(agents): add Cloudflare's security-audit skill through dotagents Declare cloudflare/security-audit-skill (MIT) in agents.toml and trust that one repository. dotagents installs it gitignored alongside the other managed skills. The skill ships CommonJS validators at its top level, so ESLint now ignores its install directory, which would otherwise break `pnpm lint`. Closes #567 --- agents.toml | 6 +++++- dotagents.md | 7 ++++--- eslint.config.js | 6 ++++++ 3 files changed, 15 insertions(+), 4 deletions(-) diff --git a/agents.toml b/agents.toml index 5253dd528..f66e2d073 100644 --- a/agents.toml +++ b/agents.toml @@ -3,7 +3,7 @@ agents = ["claude"] [trust] github_orgs = [ "taskless" ] -github_repos = [ "getsentry/skills", "getsentry/dotagents" ] +github_repos = [ "getsentry/skills", "getsentry/dotagents", "cloudflare/security-audit-skill" ] [[skills]] name = "dotagents" @@ -16,3 +16,7 @@ source = "getsentry/skills" [[skills]] name = "pr-writer" source = "getsentry/skills" + +[[skills]] +name = "security-audit" +source = "cloudflare/security-audit-skill" diff --git a/dotagents.md b/dotagents.md index 59e54e38a..4ec589cfa 100644 --- a/dotagents.md +++ b/dotagents.md @@ -35,7 +35,7 @@ before you edit one. **Managed by dotagents.** Declared in `agents.toml`, installed on demand, and listed in `.agents/.gitignore` (which dotagents writes). Editing one in place accomplishes nothing, because the next install overwrites it. Today that is -`dotagents`, `code-review`, and `pr-writer`. +`dotagents`, `code-review`, `pr-writer`, and `security-audit`. **Committed to this repository.** Everything else under `.agents/skills/` is tracked in git and reviewed like any other source. Two of them started as @@ -93,7 +93,7 @@ exclude = [ That installs three skills: `code-simplifier`, `iterate-pr`, and `worktrees-pnpm`. Without the exclusions the same entry resolves to 14, because the wildcard reaches every tracked skill. Only tracked ones appear either way, -since the dotagents-managed three are gitignored and never reach a clone. +since the dotagents-managed four are gitignored and never reach a clone. `exclude` takes literal skill names. A pattern such as `"openspec-*"` is refused when the config is validated (`skills.0: Invalid input`), because an @@ -159,6 +159,7 @@ Credit where it is owed, and a pointer for anyone tracking upstream changes. | -------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------- | | `code-review`, `pr-writer` | [getsentry/skills](https://github.com/getsentry/skills) | Managed by dotagents, unmodified | | `dotagents` | [getsentry/dotagents](https://github.com/getsentry/dotagents) | Managed by dotagents, unmodified | +| `security-audit` | [cloudflare/security-audit-skill](https://github.com/cloudflare/security-audit-skill) (MIT) | Managed by dotagents, unmodified | | `iterate-pr` | [getsentry/skills](https://github.com/getsentry/skills/tree/main/skills/iterate-pr) (Apache-2.0) | Forked and substantially modified | | `code-simplifier` | [getsentry/skills](https://github.com/getsentry/skills), which credits [Anthropic's code-simplifier](https://github.com/anthropics/claude-plugins-official/blob/main/plugins/code-simplifier/agents/code-simplifier.md) | Vendored copy | | `openspec-*` | [openspec](https://github.com/Fission-AI/OpenSpec) (MIT) | Generated by the openspec CLI | @@ -178,7 +179,7 @@ if you want none of that. ```toml [trust] github_orgs = [ "taskless" ] -github_repos = [ "getsentry/skills", "getsentry/dotagents" ] +github_repos = [ "getsentry/skills", "getsentry/dotagents", "cloudflare/security-audit-skill" ] ``` A source outside that list is refused rather than fetched. Widen it diff --git a/eslint.config.js b/eslint.config.js index b09879ef0..1fba22b4b 100644 --- a/eslint.config.js +++ b/eslint.config.js @@ -51,6 +51,12 @@ export default tseslint.config( // worth doing, but it is a separate change — the rules that would apply // are not these ones. ".agents/skills/*/scripts/", + // Third-party skills that dotagents installs (see `agents.toml`). They + // are gitignored and replaced on every install, so there is nothing here + // to fix. Most are prose, but `security-audit` ships zero-dependency + // CommonJS validators at its top level, which the type-aware rules + // cannot parse and which would otherwise fail `pnpm lint` locally. + ".agents/skills/security-audit/", // Taskless rule fixtures. A rule's `tests/` holds inputs written to be // flagged, and a rule about source comments needs `.ts` fixtures // specifically — Vale picks its comments-only tier by extension. They are