auto-skill-bootstrap

---
name: auto-skill-bootstrap
description: Deterministic helper to inventory existing project skills, detect missing capability coverage, search skills.sh via Skills CLI, and (optionally) install missing skills under a trust policy. Uses skills-manifest.json + state.json to stay idempotent across changing requirements.
---

# Auto Skill Bootstrap (project-level)

## What this is

This skill defines a **repeatable** workflow for:

- indexing already-present project skills into `skills-manifest.json`
- mapping the user request to **capabilities**
- finding gaps (capabilities not covered by existing skills)
- searching Skills CLI (`npx skills find ...`) for candidate skills
- filtering candidates by **trust policy**
- producing a short, structured “install plan”
- optionally installing skills (only under strict conditions)

The heavy lifting is done by deterministic scripts shipped with this skill.

## Files (state + inventory)

- Inventory of skills (generated): `.cursor/skills/skills-manifest.json`
- Bootstrap state (generated): `.cursor/skills/auto-skill-bootstrap/state.json`

## Hard rules

- **Never** install skills from unknown sources automatically.
- If multiple plausible candidates exist for a capability, **ask the user** to choose (multi-select).
- After any install/remove/update of skills, regenerate `skills-manifest.json` (do not edit JSON by hand).

## Deterministic commands

### 1) Rebuild skills manifest

Run inside the repo root:

```bash
python3 .cursor/skills/auto-skill-bootstrap/bin/update-manifest.py
```

### 2) Search for missing capability skills (no install)

```bash
python3 .cursor/skills/auto-skill-bootstrap/bin/auto-skill-bootstrap.py \
  --cap docker github devcontainers \
  --no-install
```

Outputs:
- `.cursor/skills/auto-skill-bootstrap/candidates.json` (grouped by capability)
- updates `.cursor/skills/auto-skill-bootstrap/state.json`

### 3) Optional: install (trust-policy only)

Only when **explicitly allowed** by the user or project policy.

```bash
python3 .cursor/skills/auto-skill-bootstrap/bin/auto-skill-bootstrap.py \
  --cap docker github \
  --install-allowlisted \
  --max-per-cap 1
```

## Trust policy

Trust rules live here and are deterministic:

- `.cursor/skills/auto-skill-bootstrap/trust-policy.json`

Default stance: allowlist only.

## When to run

- At the start of a new task (before deep work).
- Again when the user introduces new constraints/tech (“also add CI”, “needs k8s”, etc.).