github-create

Files (5)

• SKILL.md
• MIT-LICENSE-TEMPLATE · assets/
• SECURITY.md · assets/
• go-release-workflow.yml · assets/
• readme-style.md · assets/

SKILL.md (first lines)

# GitHub Create

Create a new GitHub repository from the current local project with all the finishing touches.

## Key concerns

This skill creates **public, permanent artifacts**. Once pushed, content is effectively un-deletable - even amended or force-pushed content lingers in GitHub's object store for ~90 days, may be cached in search indexes, and may have been cloned by anyone watching. Treat every name and string going into a public repo as a one-way commitment.

**Two failure modes to guard against above the rest:**

1. **Identity leaks in the LICENSE** - joining the user's real name (from `userEmail` context, an email-to-name inference, `git config user.name` if unconfirmed, or tool output like `sentry auth whoami`) to a public handle in immutable git history. This is the single worst step this skill can take. **Step 5 is the procedure - never skip the memory lookup, never derive a name from email or tool output, always confirm before writing.**
2. **Private-project leaks in the README or code** - internal codenames, hostnames, project slugs, real issue IDs, or org names from the user's other work, surfacing in a public artifact. **Step 8 (Pre-commit leak scan) is non-skippable** and must run before any commit, even if the user has already reviewed the files.

Both failure modes arise from acting *unilaterally* on identity decisions. The corrective: show diffs before committing, run the leak scan before pushing, ask the user when in doubt. The cost of one extra question is always less than the cost of one preventable leak.

## Prerequisites

- `gh` CLI installed and authenticated (`agent-github auth-status` if the wrapper is installed, otherwise `gh auth status`)
- `git` initialised in the current directory
- Current directory has at least one commit

## Constrained wrappers: agent-commit and agent-github

Some users have the `agent-commit` and `agent-github` wrapper commands installed. They are narrow, agent-friendly routes: `agent-commit` commits only explicitly named files with a validated message, `agent-github` can only create and initially push one new repository, and both use a preview-then-token confirmation so nothing happens on the first invocation. Check for them early:

```bash
command -v agent-commit agent-github
```

- **Both found**: use them for the commit and publish steps below.
- **Not found**: mention it once, in passing - something like "No agent-commit/agent-github commands found - falling back to raw git/gh" - then use the native commands shown in each step. Do not pitch them or suggest installing anything. (They come from https://github.com/ohnotnow/agent-commit - only bring that up if the user asks what the commands are.)
- **One found**: use whichever is available for its step and fall back for the other.

On the native path, respect the user's git permissions. If `git add` or `git commit` is denied, tell the user what files need committing and give them the commands to run themselves. Do not retry denied commands or work around the restriction. Never use `git push --force`, `git reset`, or any destructive git operation on either path.

## Workflow

### Step 1: Verify environment

Check prerequisites and wrapper availability:

```bash
command -v agent-commit agent-github
git rev-parse --is-inside-work-tree
git log --oneline -1
```

For the auth check, use `agent-github auth-status` if the wrapper is present, otherwise `gh auth status`. The wrapper subcommand takes no arguments and forwards none, so gh's `--show-token` can never be reached through it.

Check remotes now rather than discovering them at publish time: `agent-github check-remote` if the wrapper is present, otherwise `git remote -v`. check-remote exits 0 when there are no remotes and publish can proceed; otherwise it lists each remote with a verdict, including a `fix: git remote remove NAME` line when a remote's GitHub repository returns 404. Show that output to the user and let them decide - a 404 cannot distinguish a deleted repository from lost access, so never remove a remote yourself. If an older installed wrapper refuses with "unknown command", fall back to `git remote -v`.

If not in a git repo, offer to run `git init` and create an initial commit.

If there are uncommitted changes or untracked files, warn the user and ask how they want them handled (commit them, `.gitignore` them, or move them aside). This matters most on the wrapper path: `agent-github` refuses to publish unless the working tree is completely clean, untracked files included.

### Step 2: Detect project type

Check for framework indicators to inform README generation, .gitignore review, and whether to offer a release workflow:

| File | Stack |
|------|-------|
| `composer.json` + `artisan` | Laravel |
| `composer.json` | PHP |
| `pyproject.toml` or `requirements.txt` | Python |
| `package.json` + `next.config.*` | Next.js |
| `package.json` + `nuxt.config.*` | Nuxt |
| `package.json` | Node.js / JavaScript |
| `Gemfile` + `config/routes.rb` | Rails |
| `go.mod` | Go |
| `Cargo.toml` | Rust |
| `*.sh` (main files) | Shell script |

Note the detected stack for later use.

### Step 3: Gather details

Ask the user these questions (suggest sensible defaults):

1. **Repository name** - suggest the current directory name. Accept or override.
2. **Owner** - with the wrapper, run `agent-github owners` to list the authenticated account and its organisations. Natively, run `gh api user/memberships/orgs --jq '.[].organization.login'` and present the options plus "personal account". If only one org exists, still ask (do not assume).
3. **Visibility** - public or private? Default: public.

With the owner and name settled, the repository URL is known before the repo exists: `https://github.com/<owner>/<repo>`, clone URL `https://github.com/<owner>/<repo>.git`. Use these when writing the README so clone instructions are copy/paste-able.

### Step 4: Handle README

Assess the current README situation:

1. **No README.md exists** - check if a `/readme` skill is available. If it is, tell the user: "There's no README yet. You could run `/readme` to generate a detailed one, or I can create a basic one now. Which do you prefer?" If no `/readme` skill exists, offer to create a basic one.
2. **README.md exists but is framework boilerplate** - detect boilerplate by checking for telltale phrases:
   - Laravel: "Laravel is a web application framework"
   - Rails: "This README would normally document"
   - Django: "Django project"
   - Create React App: "This project was bootstrapped with"
   - Vite: "This template provides a minimal setup"
   - Generic: file is under 5 lines or contains only a heading with no real content
   If boilerplate is detected, offer the same choice as above (dedicated skill or basic README).
3. **README.md exists and looks genuine** - skip. Do not offer to overwrite.

**Basic README generation**: If creating a basic README (no dedicated skill), use session context and project analysis to write a concise, accurate README covering:
- Project name and one-line description
- What it does (2-3 sentences)
- Prerequisites and quick start (adapted to detected stack), using the constructed clone URL from Step 3
- Usage examples if obvious from the code
- License reference if a LICENSE will exist

If the user has an `assets/readme-style.md` file in the skill directory, read it and follow its style guidance.

Do NOT include generic filler, badges, or sections with no real content.

After writing the readme, if the `/readme` skill was used, the humaniser agent runs automatically as part of that skill. If you created a basic readme manually instead, spawn the humaniser agent (from `~/.claude/agents/humaniser.md`) for an editorial pass, if available.

### Step 5: Handle LICENSE

Check if a `LICENSE` file exists in the project root. If one already exists, skip this step.

If no LICENSE exists, the attribution name must be determined carefully - this is the single highest-stakes string in the repo (see Key concerns at the top of this skill).

#### 5a. Search user-memories first, with broad queries

From ohnotnow/agentic-stuff, MIT.

More from ohnotnow/agentic-stuff