Skills setup-template
📦

setup-template

Content revision r1 High Risk ⚙️ External commands🌐 Network access📁 Filesystem access🔑 Env variables

Align TypeScript Repositories with Their Template

Template-derived repositories can retain missing GitHub settings and incomplete migration work even when builds pass. This skill guides repository setup and evidence-based comparisons against the template.

Supports: Claude Codex Code(CC)
Maintain this Skill? Claim it ⚠️ 38 Poor

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request
Review the Skillstore skill "setup-template" from https://skillstore.io/skills/masseater-setup-template.md and its manifest at https://skillstore.io/api/skills/masseater-setup-template/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/masseater-setup-template.md Signed manifest GET /api/skills/masseater-setup-template/manifest Signed lockfile GET /api/skills/masseater-setup-template/lockfile

Test it

Using "setup-template". Illustrative assessment with a missing hook and an unsuccessful verification task.

Expected outcome:

  • Migration status: incomplete.
  • Git hooks: incomplete. The configured hook directory does not match the expected template location.
  • Verification: incomplete. The verification task failed; include the actual task output as evidence.
  • Next steps: correct the hook configuration and investigate the failed task before repeating the assessment.

Using "setup-template". Illustrative setup review where an existing ruleset requires tests before merging.

Expected outcome:

  • Existing protection: tests must pass before merging.
  • Template difference: the proposed ruleset requires only the up-to-date check.
  • Decision needed: preserve the existing test requirement rather than replacing it with weaker protection.
  • No settings changed.

Security Audit

High Risk
v1 • 10/24/2026 Open versioned report

Most static alerts are false positives from Markdown, Japanese text, or expected GitHub operations; installation and verification execute repository-controlled code. Check mode also applies remote configuration despite the stated inspection-only boundary. The prescribed ruleset replacement can remove stronger protections, while the template criteria place verification after merging rather than before.

4
Files scanned
244
Lines analyzed
1
Review items
0
False positives ignored

Confirmed security concerns (2)

High
usecases/setup.md:47-58usecases/setup.md:65-74references/typescript-template.md:79-83
Template Alignment Can Weaken Pre-Merge Protections
Setup replaces a same-named ruleset with deletion, force-push, and up-to-date protections only. The reference requires verification after main pushes and treats PR verification as obsolete, potentially removing stronger checks and allowing unverified changes onto main.
The replacement payload lists only freshness as a required status check, and the reference explicitly excludes PR verification. Existing stronger protections are not preserved.
Medium
SKILL.md:17usecases/check.md:9usecases/setup.md:9-42
Inspection Mode Applies Remote Configuration Changes
SKILL.md says inspection must not repair issues, but check step 5 directs the agent to apply the setup procedure. That procedure registers secrets and changes Actions permissions, merge settings, and branch rulesets, creating remote side effects during a requested assessment.
The check procedure explicitly directs configuration alignment, contradicting the stated inspection-only boundary. The referenced setup commands perform authenticated remote writes.
Capability review items (1)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium
SKILL.md:43
Ruby/shell backtick execution
- `vp install` と `vp run verify` を実行する。verify が落ちたら、落ちたタスクとその出力を最初の欠けとして扱う
Although the backticks are Markdown, the prose explicitly directs execution of vp install and vp run verify. Repository-controlled scripts can run with agent privileges without a preceding trust review.

Risk Factors

⚙️ External commands (8)
SKILL.md:8 SKILL.md:10 SKILL.md:30 SKILL.md:43 SKILL.md:51 SKILL.md:52 usecases/setup.md:57 usecases/setup.md:58
🌐 Network access (1)
SKILL.md:8
📁 Filesystem access (1)
usecases/check.md:7
🔑 Env variables (2)
usecases/setup.md:14 usecases/setup.md:22
Audited by: codex
Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report
Security Assessment

Copy report link

https://skillstore.io/skills/masseater-setup-template/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/masseater-setup-template/security.svg)](https://skillstore.io/skills/masseater-setup-template?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/masseater-setup-template?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/masseater-setup-template/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/masseater-setup-template.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
Academic citations (APA · BibTeX · CFF)

APA citation

masseater. (2026). setup-template security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/masseater-setup-template/audits/1

BibTeX citation

@techreport{masseater-masseater-setup-template-2026, author = {masseater}, title = {setup-template security audit report (audit version 1)}, institution = {Skillstore}, year = {2026}, number = {1}, url = {https://skillstore.io/skills/masseater-setup-template/audits/1}, note = {Author version unspecified} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "setup-template security audit report (audit version 1)" version: "unspecified" type: report authors: - name: "masseater" date-released: "2026-10-24" url: "https://skillstore.io/skills/masseater-setup-template/audits/1" identifiers: - type: other value: "skillstore:masseater-setup-template:audit:1" description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium
41
Architecture
85
Maintainability
87
Content
65
Community
83
Spec Compliance

What You Can Build

Initialize a Template-Derived Repository

Configure repository automation, deployment identifiers, secret names, and branch settings after creating a repository from the template.

Assess an AI-Assisted Migration

Compare the migrated repository with template elements and collect evidence for missing hooks, ineffective checks, and leftover configuration.

Review Automation Configuration

Compare GitHub settings and CI behavior with template expectations while identifying differences that require explicit policy decisions.

Try These Prompts

Review Setup Requirements 
List the setup steps for this template-derived repository. Identify required tools, permissions, and secret names without changing files or GitHub settings.
Configure an Approved Repository 
Prepare setup for [owner/repository]. Show proposed changes and existing protections first. Request approval before writes and use interactive secret entry.
Assess Migration Completeness 
Assess this migration against the template. Override setup-in-check behavior: report differences without repairs. Request approval before installation or verification, then provide evidence.
Compare Template and Security Policy 
Compare [owner/repository] with the template and our policy: [requirements]. Identify weaker rules, missing verification, and unsupported exceptions. Propose changes without applying them.

Best Practices

  • Confirm the target repository and review existing permissions and rulesets before approving setup changes.
  • Enter credentials through secure interactive prompts, and review repository scripts before running installation or verification.
  • Preserve stronger organizational protections and retain command evidence for every migration judgment.

Avoid

  • Treating the default check workflow as read-only despite its setup step.
  • Replacing stronger branch protections solely to match the template.
  • Declaring migration complete because builds pass without checking hooks, automation, and obsolete configuration.

Frequently Asked Questions

Which repositories does this skill target?
It targets repositories derived from masseater/typescript-template. Other repositories require confirmation of applicable steps before work begins.
What tools and permissions are needed?
GitHub CLI authentication and sufficient repository permissions are needed for setup. Local checks also use Vite+ and project-specific tooling.
Does check mode change anything?
Yes. It runs installation and verification and directs GitHub setup. Explicitly prohibit remote writes when requesting an assessment only.
How should I provide secrets?
Use GitHub CLI interactive prompts or approved secret management. Avoid placing secret values in chat, reports, or committed files.
Does template alignment guarantee secure branch protection?
No. The prescribed model relies on freshness checks before merging and verification afterward. Preserve stronger requirements from your organizational policy.
Are newer template features automatically migration defects?
No. The skill separates later template additions from missing migration elements and requires reasons for elements that do not apply.

Developer Details

Author

masseater

License

MIT

Skillstore revision

r1

Version notice

The author did not declare a version.

Repository

https://github.com/masseater/skills/tree/4810c8f1186a229ca57d2f278c0a94f0fc862fec/skills/setup-template

Ref

965badf91ae3b8f9a49183f5a56d91de6efc51ad

Maintenance freshness

10/24/2026

Usage

0 downloads · 0 views

File structure

📁 references/

📄 typescript-template.md

📄 SKILL.md

📁 usecases/

📄 check.md

📄 setup.md

More from masseater

View all

Related Skills

View all