Repository navigation
Conversation
…om a repository Lists the scan sources by priority, the runtime, build-time and skip classes, the secret-handling rules for env files and git remotes, and a vendor map whose every row was resolved against the live provider catalog. Region-split providers (Datadog, PostHog, Intercom) get their own section and Braintree was dropped because the catalog has no provider for it.
…n the detection reference
…ted class notes in the detection reference
…p unmapped catalog searches in the detection reference
…egister it The skill scans a repository for the providers it depends on, resolves them against the provider catalog, proposes a set and tracks it after confirmation. Four fixtures under examples/ carry the expected proposal, including one with planted instructions that must change nothing.
Frameworks and libraries are skip, never unmapped search terms; env files are read with two match-only grep commands; a file-existence signal is quoted as the path alone; Go modules and pip pins have an evidence form; only the project root's own git remote counts; the catalog column format is fixed and the fixtures compare on the provider id.
…he create loop and the get-user fallback
… prefix and a fixtures README for the discovery skill
… and a routing pointer between the two third-party skills
…he discovery skill AWS, Google Cloud, Microsoft Azure, Cloudflare and GitHub are proposed by component: the skill reads the provider tree, matches component names against service words and region values from the reference, and passes the matched ids to the create or update call. The django-aws fixture now expects S3 and RDS in Frankfurt.
…zure region rule and the missing map signals
… evidence under the proposal table
… shorter scoping step
…xisting-service create path in the scoping step
…y, never quote resource identifiers, and bound creates when the allowance is unknown
…egistry and Cloud Build signals as build-time, host normalisation, recursive env scan, search limit 10
…nv extraction rules - One combined component list per provider in a monorepo, never one update per app - Service-without-region rule follows each provider's tree shape; flat and single-parent trees select the matched component itself - Provider-level SDK signals that name no service are called out before narrowing - Whole-provider choice on a subset-tracked service becomes an update with null components - Confirmed updates keep running after the create limit stops - Env-file find commands carry the documented exclusions, and the hostname pipeline keeps only public suffixes the vendor map uses so non-host values never print - expected.md is named as the fixture oracle and excluded from scans
…vices-docs docs: describe fixture-based skill evaluation in CONTRIBUTING
…vices-step-3 feat: scope large providers to detected services and regions in the discovery skill
…vices-step-2 feat: add the discover-third-party-services skill with fixtures
…vices-step-1 docs: add the detection reference for discovering third-party services from a repository
|
Warning Review limit reached
This review includes 27 billable files and costs up to $6.75.
Reviews can continue after your included limit without a manual trigger. An admin must approve usage-based billing. Or wait 12 minutes for your next included review. View limit details
|
nordstern
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds the
discover-third-party-servicesskill: an agent scans the current repository for the third-party providers it depends on (cloud, hosting, payments, email, auth, AI APIs), resolves them against the provider catalog, proposes a table with evidence, and tracks the confirmed ones as third-party services. Large providers (AWS, Google Cloud, Microsoft Azure, Cloudflare, GitHub) are scoped to the detected services and regions through the component tree.Stacked from #25, #26, #27 and #28, all merged into this branch.
What is in it
skills/discover-third-party-services/SKILL.md: the flow (scan, map, resolve, dedupe, scope, propose, confirm, create, verify), what counts as confirmation, allowance and rate-limit handling, common mistakes.skills/discover-third-party-services/reference.md: scan sources, secret-handling rules (location-only env greps, host-only git remotes), vendor map by category checked against the live catalog in November 2026, region-split providers, component scoping tables.skills/discover-third-party-services/examples/: four fixture repositories withexpected.mdoracles (nextjs-vercel,django-aws,go-gcp,injectedfor prompt-injection resistance).llms.txt,AGENTS.md, regenerated.well-known/agent-skills/index.json, a Related pointer frommanage-third-party-services, and a CONTRIBUTING section on evaluating a skill with fixtures.Verification
node scripts/generate-agent-skills-index.mjs --checkpasses.expected.md.Merging publishes the skill at
uptimerobot.com/skills/discover-third-party-services/SKILL.md.