github-repo-deploy — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited github-repo-deploy (MCP Server) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
One-line CLI alternatives to the dashboards you click through 50× a year.
Open-source Claude Code Skills that turn manual dashboard work into idempotent, declared-intent reconcile loops. Built and dogfooded by InSync Tech for Aria Code — open-sourced so you can run them solo too.
# Manual: 45 minutes clicking through Stripe dashboard
# With aria-skills:
aria stripe-sync --apply --prod --write-env| Skill | What it replaces | Time saved per use |
|---|---|---|
| stripe-sync | Stripe dashboard: products + prices | 30-60 min |
| cloudflare-dns-deploy | Cloudflare dashboard + nginx + certbot ceremony | 15-30 min |
| el-agent-deploy | ElevenLabs ConvAI dashboard: tools + system prompts + phone bindings | 10-20 min |
| marketplace-publish | vsce + Expo EAS submit ceremony across 3 marketplaces | 20-40 min per release |
| partnership-email-blast | Manual partner outreach: per-recipient personalization + tracking | 1+ hours per campaign |
| vendor-billing-action | Spreadsheet + scattered vendor portals; triple-gated live payments | 30+ min per renewal |
| sprint-scaffold | The meta-skill: Filing Cabinet + Flowstate scaffolding for new sprints | n/a (workflow pattern) |
| question-economy | Re-answering the same preferences every session; Claude learns your defaults | compounds — fewer questions over time |
More skills shipping as we build them. Track at downloads.ariacode.io/skills.
Every skill in this repo follows the same shape:
This isn't novel infrastructure — it's the Terraform / Pulumi pattern applied to every external service you'd otherwise click through a UI for. The novelty is packaging it as Claude Skills so an LLM can drive it on your behalf.
git clone https://github.com/iansteitz1-eng/aria-skills ~/aria-skills
# Link the skills you want into Claude Code's skill directory:
ln -s ~/aria-skills/stripe-sync ~/.claude/skills/stripe-sync
ln -s ~/aria-skills/cloudflare-dns-deploy ~/.claude/skills/cloudflare-dns-deploy
ln -s ~/aria-skills/el-agent-deploy ~/.claude/skills/el-agent-deploy
# Install Python deps (each skill lists what it needs):
pip install -r stripe-sync/requirements.txt
pip install -r cloudflare-dns-deploy/requirements.txt
pip install -r el-agent-deploy/requirements.txtThen in Claude Code, the skills appear in your available-skills list. Or run the underlying Python scripts directly — they're self-contained.
Each skill is driven by a YAML file you author. Examples live in each skill's directory. Credentials read from environment variables (never committed). See per-skill READMEs.
Solo (this repo) — clone, install, run. Your YAML + your credentials + your machine. Free forever. MIT-licensed.
Hosted ([Aria Code](https://staycool.ai/aria-code)) — same skills, but Aria runs them on your behalf with:
Free tier · BYOK (bring your own Anthropic / OpenAI / Google key) · no credit card required.
→ [Try Aria Code](https://staycool.ai/aria-code)
Worth calling out because these are research-adjacent and we ship them in production:
| Pattern | Where you'll see it |
|---|---|
| Declared-intent reconcile | Every skill — YAML is intent; script compares to live state |
| Triple-gated live actions | vendor-billing-action's pay subcommand (shipping soon) — requires --apply + --prod + --confirm-amount matching |
| Mode separation | mode: test in YAML guards production keys; switching to mode: live requires explicit --prod flag |
| Idempotent state matching by metadata, not name | stripe-sync matches Stripe products by metadata.aria_sku, not display name — declared intent is the source of truth |
| Hash-chained audit log | Every state change in Aria's hosted version emits a splat; full chain is verifiable post-hoc |
| User-scoping | In hosted mode, every query filters by user_email resolved from session — no cross-tenant access by construction |
These aren't theoretical. They run today.
Apache 2.0. Use freely. Star the repo if you find it useful — that's how we find each other in this space.
PRs welcome. Especially: new skills for vendors we haven't covered (Linear, Notion, GitHub, Vercel, Render, Fly.io, etc.).
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.