repyyDocs
WebsiteDocsGitHub ↗

repyyDocumentationAgent skill

Optional agent skill

Make the safe first move.Before code runs.

The repyy agent skill gives a coding agent a repeatable instruction set for preflighting unfamiliar repositories. It asks the agent to scan first, preserve the target as data, explain the evidence, and stop when coverage is incomplete.

InstructionsChanges agent behaviorSeparateDoes not install the CLIPrivateReports stay local
Install the skill and CLI separately

The skill is guidance for an agent. You still need a repyy executable from a verified release, package, or trusted local build.

Install the skill

Run one of these commands in your terminal. The interactive form lets the skills tool prompt you; the global form installs instructions for Codex without prompts.

Interactive install
npx skills add Kevin-Umali/repyy --skill repyy
Codex, global
npx skills add Kevin-Umali/repyy --skill repyy -g -a codex -y
Before you run it

Install Node.js and npm so npx is available, install Git and keep it on PATH, and allow network access to fetch the published skill. Git and network are needed for this skill installation, even though a local repyy scan needs neither.

Neither command installs dependencies from a repository you plan to scan. Install repyy separately using the installation guide, then confirm it with repyy version.

What the skill tells an agent to do

  1. Confirm the user is allowed to inspect every target, especially private repositories.
  2. Check the installed scanner, intelligence snapshot age, and rule provenance offline.
  3. Scan every requested target together where possible and save bounded JSON.
  4. Render a local HTML report from that JSON without rescanning source.
  5. Read coverage, blocking findings, locations, context, confidence, and remediation before suggesting execution.
Recommended first pass
repyy scan --format json --output repyy.scan.json TARGET...
Reviewable offline report
repyy report repyy.scan.json --format html --output repyy.report.html

The agent should treat SCAN INCOMPLETE as unresolved and state that NO FINDINGS is not proof of safety. It should not paste credential-shaped evidence into chat.

Use Docker when you need a process boundary

The skill includes an opt-in Docker path for local folders and HTTPS remotes. Prepare Docker and the exact signed, digest-pinned image for the installed repyy release before asking the agent to scan.

Docker scan
repyy scan TARGET --sandbox=docker --format html --output repyy.report.html

Docker rejects SSH URLs and --keep-workdir. Missing Docker or a missing release-matched image is a preflight error; the skill must never accept a silent host fallback. Read the isolation guide for image verification and manual VM workflows.

Understand the limits

Target codeThe agent must not run, import, evaluate, build, test, or install target dependencies before review.
NetworkLocal scans need no network. Remote host scans use Git; Docker separates HTTPS fetch from network-disabled analysis.
ReportsHTML reports are local artifacts. They make no requests but still contain paths and redacted evidence.
IntelligenceUpdates are explicit. The agent should not run repyy intel update unless the user asks.

The skill is a workflow guardrail, not a guarantee that a repository is safe. A human still decides whether to execute code, install dependencies, or continue in an isolated environment.

Read the source instructions

The repository copy of the skill ↗ is the canonical reference for agent behavior. Keep it aligned with the installed CLI and review it when upgrading repyy.