Source profileQuality 91/100

event4u-app/agent-config/src/skills/context-authoring/SKILL.md

context-authoring

Use when filling knowledge-layer context files — auth-model, tenant-boundaries, data-sensitivity, deployment-order, observability — interactive template walkthrough.

Source repository stars
7
Declared platforms
0
Static risk flags
1
Last source update
2026-07-28
Source checked
2026-07-28

Decision brief

What it does—and where it fits

Use when filling knowledge-layer context files — auth-model, tenant-boundaries, data-sensitivity, deployment-order, observability — interactive template walkthrough.

Best for

  • A new project has been scaffolded and the agents/settings/contexts/ files are still
  • The user asks "help me fill in the auth model context", "set up tenant
  • A reviewer skill (authz-review, data-flow-mapper, migration-safety,

Not for

  • Tasks that require unconfirmed production actions or broad system permissions.
  • Environments where the pinned source and install steps cannot be inspected.

Compatibility matrix

Platform support, with evidence labels

PlatformStatusEvidenceWhat to check
CodexNot declaredNo explicit evidencePortability before use
Claude CodeNot declaredNo explicit evidencePortability before use
CursorNot declaredNo explicit evidencePortability before use
Gemini CLINot declaredNo explicit evidencePortability before use
Open the compatibility checker

Installation

Inspect first. Install second.

The source command is displayed only when detected. A safe inspection prompt is always available so your agent can explain every action before execution.

Source-detected install commandSource
npx skills add https://github.com/event4u-app/agent-config --skill "src/skills/context-authoring"
Safe inspection promptEditorial

Inspect the Agent Skill "context-authoring" from https://github.com/event4u-app/agent-config/blob/0adf49a8ae84b0ff6e2de8759eea43257e020eff/src/skills/context-authoring/SKILL.md at commit 0adf49a8ae84b0ff6e2de8759eea43257e020eff. List every install step, command, network request, credential, file read/write, external action, and rollback step. Explain whether it fits my task. Do not install or execute anything until I approve.

Workflow

What the source asks the agent to do

  1. 01

    Procedure: context-authoring

    1. List agents/settings/contexts/ — which of the five files exist? Which still contain the HTML comment? 2. Ask the user which file to work on. Use numbered options:

    List agents/settings/contexts/ — which of the five files exist? Which still containAsk the user which file to work on. Use numbered options:If multiple files are stubs, default to the order above — auth-model is
  2. 02

    Step 0: Inspect

    1. List agents/settings/contexts/ — which of the five files exist? Which still contain the HTML comment? 2. Ask the user which file to work on. Use numbered options:

    List agents/settings/contexts/ — which of the five files exist? Which still containAsk the user which file to work on. Use numbered options:If multiple files are stubs, default to the order above — auth-model is
  3. 03

    Step 1: Harvest evidence before asking

    For the chosen file, pull what the codebase already reveals before asking the user. Record the file:line citations — they become the authoritative source when the user is unsure.

    For the chosen file, pull what the codebase already reveals before asking the user. Record the file:line citations — they become the authoritative source when the user is unsure.Start the walkthrough by showing the harvested evidence — the user only has to confirm or correct, not invent from scratch.
  4. 04

    Step 2: Walk the template section by section

    1. Open the template and treat every HTML comment as a question for the user. Do NOT fabricate answers to skip a section. 2. Present each section as:

    Open the template and treat every HTML comment as a question for thePresent each section as:If the user picks "TBD", insert an HTML comment --
  5. 05

    Step 3: Preserve the file contract

    1. Remove the top-of-file comment only after at least one section has been authored — an untouched file must stay recognisable as a stub. 2. Keep every heading the template ships with. Reviewer skills grep for exact section names ( Known exceptions, Known alerts, etc.). 3. Do NO…

    Remove the top-of-file comment onlyKeep every heading the template ships with. Reviewer skills grep forDo NOT add new top-level sections. The template surface is the

Permission review

Static risk signals and limitations

Writes files

medium · line 97

The documentation asks the agent to create, modify, or delete local files.

Remove the top-of-file `<!-- Template shipped by ... -->` comment only

Evidence record

Why each signal appears

EvidenceSourceComputedTestedEditorial
SignalValueEvidence typeMeaning
Quality score91/100ComputedDocumentation, specificity, maintenance, and trust rules
Repository stars7SourceRepository attention, not individual Skill quality
Compatibility0 platformsSourceDeclared in the catalog source record
Usage guideautomated source guideEditorialGenerated or reviewed according to the visible evidence level

Pinned source

Provenance and original SKILL.md

Repository
event4u-app/agent-config
Skill path
src/skills/context-authoring/SKILL.md
Commit
0adf49a8ae84b0ff6e2de8759eea43257e020eff
License
MIT
Collected
2026-07-28
Default branch
main
View the original SKILL.md

context-authoring

When to use

Use this skill when:

  • A new project has been scaffolded and the agents/settings/contexts/ files are still template stubs from event4u/agent-config.
  • The user asks "help me fill in the auth model context", "set up tenant boundaries", or similar knowledge-layer work.
  • A reviewer skill (authz-review, data-flow-mapper, migration-safety, multi-tenant-boundary-review, secrets-and-config-review) reports "I cannot proceed — agents/settings/contexts/<file>.md is still a template".
  • After a significant architecture change that invalidates one of the five context files.

Do NOT use when:

  • Writing a regular roadmap or feature doc — use agent-docs-writing.
  • Creating a generic context document that does not map to one of the five knowledge-layer templates — use context-create.
  • Filling in the engineering-memory YAML files (domain-invariants.yml, etc.) — use /memory-add.

The five files

FileWhat it answersWho reads it
auth-model.mdRoles, permission model, impersonation, known exceptionsauthz-review, judge-security-auditor, threat-modeling
tenant-boundaries.mdTenancy type, scope propagation, known cross-tenant pathsmulti-tenant-boundary-review, blast-radius-analyzer, judge-security-auditor
data-sensitivity.mdField classification, masking rules, log-safe typesdata-exposure-review, data-flow-mapper, logging reviewers
deployment-order.mdMigration strategy, feature flags, rollback planmigration-safety, judge-bug-hunter, release reviewers
observability.mdError tracking, log channels, metrics, known alertsdeploy reviewers, bug-analyzer, incident mode

The templates ship in .agent-src.uncondensed/templates/contexts/ and are copied into agents/settings/contexts/ by the installer.

Procedure: context-authoring

Step 0: Inspect

  1. List agents/settings/contexts/ — which of the five files exist? Which still contain the <!-- Template shipped by event4u/agent-config. --> HTML comment?

  2. Ask the user which file to work on. Use numbered options:

    > 1. auth-model.md — roles, permissions, impersonation
    > 2. tenant-boundaries.md — tenancy type and scope propagation
    > 3. data-sensitivity.md — field classification and masking
    > 4. deployment-order.md — migrations, flags, rollback
    > 5. observability.md — errors, logs, metrics, alerts
    
  3. If multiple files are stubs, default to the order above — auth-model is the prerequisite for tenant-boundaries; both feed data-sensitivity.

Step 1: Harvest evidence before asking

For the chosen file, pull what the codebase already reveals before asking the user. Record the file:line citations — they become the authoritative source when the user is unsure.

FileHarvest from
auth-model.mdPolicy classes, Gate definitions, permission seeders, role enums, @can directives, middleware
tenant-boundaries.mdBase query scopes, connection-switching middleware, tenant-resolution service, global scopes, .env vars like TENANT_*
data-sensitivity.mdORM hidden-field config (Eloquent $hidden / $casts, Symfony #[Ignore], Prisma select defaults, SQLAlchemy __init__ filters), Sentry beforeSend, logging redaction helpers, API serialisers / resources, export commands
deployment-order.mddatabase/migrations/, feature-flag config (Pennant / LaunchDarkly), deploy scripts, CI workflow, rollback runbooks in docs/
observability.mdconfig/logging.php, Sentry init, dashboard links in READMEs, alert rules in Terraform/Grafana dashboards

Start the walkthrough by showing the harvested evidence — the user only has to confirm or correct, not invent from scratch.

Step 2: Walk the template section by section

  1. Open the template and treat every HTML comment as a question for the user. Do NOT fabricate answers to skip a section.

  2. Present each section as:

    **Section:** <heading>
    **Template asks:** <what the comment says>
    **Evidence I found:** <file:line references or "none">
    **Proposed content:** <draft or "I need your input">
    
    > 1. Accept the draft
    > 2. Edit — tell me what's wrong
    > 3. I don't know — mark as "TBD" with a follow-up task
    
  3. If the user picks "TBD", insert an HTML comment <!-- TBD: <question> --> at that spot — never a fabricated value. Reviewer skills key on the comment to warn about incomplete sections.

Step 3: Preserve the file contract

  1. Remove the top-of-file <!-- Template shipped by ... --> comment only after at least one section has been authored — an untouched file must stay recognisable as a stub.
  2. Keep every heading the template ships with. Reviewer skills grep for exact section names (## Known exceptions, ## Known alerts, etc.).
  3. Do NOT add new top-level sections. The template surface is the contract — extend existing sections, file a proposal via learning-to-rule-or-skill to expand the template upstream.

Step 4: Validate

  1. Run ./scripts-run src/scripts/check_portability — project-specific content is expected here, but the check catches accidental copy of other projects' identifiers.
  2. Run ./scripts-run src/scripts/check_references — cross-file links between the five contexts must resolve.
  3. Confirm with the user: "is this accurate enough that a reviewer should treat it as the source of truth?" — anything less and a <!-- TBD --> marker stays.

Output format

  1. agents/settings/contexts/<file>.md updated with project-specific content; every section either authored or explicitly marked <!-- TBD: ... -->.
  2. A short summary comment back to the user: which sections are complete, which are TBD, and which downstream reviewer skills are now unblocked.
  3. Optional: a proposal stub in agents/learnings/ for any template gap the user hit (missing section, ambiguous field) — feeds the curated self-improvement pipeline via learning-to-rule-or-skill.

Gotcha

  • The model tends to fabricate plausible roles, fields, or alerts when harvesting comes up empty. Do NOT. An <!-- TBD: ... --> marker is always better than a made-up entry — reviewer skills trust this file.
  • The model tends to collapse the template once it starts editing, losing the HTML comments that explain why a section exists. Preserve them until the section is authored — they are the authoring prompt.
  • data-sensitivity.md is the highest-leverage file and also the one most likely to be skipped as "boring". Prioritise it after auth-model — missing entries here become production leaks, not review nits.
  • Do not treat this skill as a form-filler. If a project is single-tenant, tenant-boundaries.md SHOULD be deleted, not stubbed — the checklist explicitly says so at the top of the file.

Path conventions when a context cites another context

If the context file declares its own load_context: (chain reasoning), use logical names rooted at the source — contexts/<area>/<file>.md for package material or agents/settings/contexts/<file>.md for project-local material. The .agent-src.uncondensed/ prefix is rejected by the schema regex and by scripts/lint_load_context.ts. Body links to docs/guidelines/... use the verbatim ../../docs/... relative form. Canonical reference: rule-writing § 3b and docs/contracts/load-context-schema.md.

Frugality Standards

Apply the Frugality Charter to every context file you author.

Examples in this artifact:

  • Per the charter's index nature, context files are reviewer fuel — they hold mechanics, not Iron-Law obligations.
  • Per the cite-don't-restate principle, when a section mirrors a rule, link the rule and stop.
  • Per the act-skip-narration rule, lookup tables open the section; explanatory prose follows only if the table is ambiguous.

Pre-save self-check:

  1. Does the context file restate Iron-Law text instead of linking the rule?
  2. Does any section open with "This document explains…" instead of the lookup material?
  3. Are placeholders (<add me>, TBD) shipped instead of actual content?
  4. Are the cited rules linked with stable anchors (verified to exist)?

Do NOT

  • Do NOT copy content between projects. Every context file is local to its repo. Reuse of another project's roles, tenants, or alerts is a portability violation and a security risk.
  • Do NOT commit TBD-heavy files without flagging them in the PR description. Reviewer skills will downgrade confidence, but a human reviewer should know the contexts are partial.
  • Do NOT rename or restructure the template sections. Reviewer skills grep for exact headings.

Alternatives

Compare before choosing