Install
$ agentstack add skill-starcat-app-starcat-skill-starcat-skill ✓ scanned · ✓ verified, works with Claude Code, Cursor, and more.
Security review
✓ PassedNo issues found. Passed automated security review. · v0.1.0 How review works →
- ✓ Prompt-injection patterns
- ✓ Secret / credential exfiltration
- ✓ Dangerous shell & filesystem operations
- ✓ Untrusted network calls
- ✓ Known-malicious package signatures
What it can access
- ✓ Network access No
- ✓ Filesystem access No
- ✓ Shell / process execution No
- ✓ Environment & secrets No
- ✓ Dynamic code execution No
From automated source analysis of v0.1.0. “Used” means the capability is present in the source — more access means more to trust, not that it’s unsafe.
Verified badge
Passed review? Show it. Paste this badge into your README, it links to the public security report.
Reliability & compatibility
Declared compatibility
Compatibility is declared by the source manifest. End-to-end runtime verification is coming, see below.
We're building live execution health for every listing: tool-call success rate, median latency, uptime, and last-checked timestamps, measured, not self-reported. It isn't live yet, so we don't show numbers we can't stand behind.
How agent discovery & health will work →About
Starcat Skill
Install or update this Skill
When the user asks to install or update starcat-skill, perform the following workflow before using Starcat:
- Identify the current AI agent and choose exactly one user-level destination:
- Codex:
$HOME/.codex/skills/starcat-skill - Claude Code:
$HOME/.claude/skills/starcat-skill
- If the destination does not exist, create its parent directory and clone
https://github.com/starcat-app/starcat-skillinto the destination. - If the destination is already a clean checkout of that repository, run
git -C pull --ff-only. - If the destination exists but is not that repository, or contains uncommitted changes, stop and report the conflict. Never delete, overwrite, reset, or force-update it.
- Confirm that
SKILL.md,agents/openai.yaml,references/commands.md, andreferences/workflows.mdexist. - Run
starcat --helpand confirm that pairing uses a complete URI argument,starcat mcpis available, and statistics commands are present. - Reload or restart the AI agent so it can refresh its Skill registry. If the current session cannot reload Skills, report that installation succeeded but discovery still requires a restart. Never claim that the Skill was discovered without observing it.
- After discovery, invoke
$starcat-skillwith a read-only verification request. Runstarcat doctor, connect the agent to the user-level MCP server commandstarcat mcp, callstarcat.get_capabilities, and run onestarcat.search_reposrequest withlimit = 2. Do not execute write tools during installation verification.
Install only into the current agent's user-level Skill directory. Do not install into a project repository, request a Local API Key, modify unrelated files, or run destructive Git commands.
Use the MCP bridge as the business integration surface
Use the user-level MCP server command starcat mcp to operate Starcat. The CLI bridge owns pairing credentials, TLS verification, and MCP transport. Do not read SQLite, CloudKit, encrypted credential files, or Local API Keys directly. Do not implement custom HTTP or JSON-RPC requests, and do not shell out to ordinary business commands when the same MCP tool is available.
Before the first operation, run:
starcat doctor
If the command is unavailable, install the appropriate official release from https://github.com/starcat-app/starcat-cli. If the CLI is not paired, instruct the user to open Starcat > Settings > MCP Service and copy the complete single-use pairing command. Execute the provided starcat pair ... command exactly as supplied. Never request a standalone pairing URI or Local API Key, and never print, persist, or reuse the pairing command.
After pairing, configure the current agent's user-level MCP server to launch the absolute starcat executable with the single argument mcp, then reload the agent. Treat stdout from starcat mcp as protocol-only JSON-RPC; never mix prompts or diagnostics into it.
Follow the operating rules
- Call
starcat.get_capabilitiesbefore each workflow. Use its structured result to determine whether statistics, private notes, ordinary writes, destructive writes, and summary generation are available. - For common counts, call
starcat.get_overview_statisticsonce. Usestarcat.get_ai_usage_statisticsfor filtered token/call analysis andstarcat.get_knowledge_base_statisticsfor detailed project, source, and RAG chunk health. - When
owner/nameis known, preferstarcat.get_repo_contextto retrieve repository data, tags, the private note, and the summary in one call. - Treat every write tool as dry-run by default. Call it with
dry_run = truefirst and inspect the target and proposed changes. - Call the write again with
dry_run = falseonly when the user's original request clearly authorizes the write and the dry-run exactly matches that request. Otherwise, explain the proposed changes and ask for confirmation. - After a write, call
starcat.get_repo_contextagain to verify the result. - Remember that
starcat.set_repo_tagsoverwrites all tags on the repository. Usestarcat.add_repo_tagsorstarcat.remove_repo_tagsunless the user explicitly provides and confirms the complete final tag set. - Do not star or unstar repositories on GitHub. Current write tools modify only Starcat user data.
Use the common workflows
Inspect statistics
- Call
starcat.get_overview_statisticsfor Star count, knowledge-base project count, all-time AI token usage, and current RAG index health. - Call
starcat.get_ai_usage_statisticswithtime_range = today | seven_days | thirty_days | alland optionalfeature,provider_id, ormodelfilters. - Call
starcat.get_knowledge_base_statisticsfor organization, language/tag distribution, source coverage, excluded chunks, and ready/pending/failed/stale index counts.
Treat starred_repository_count as the number of repositories the user currently stars. Treat github_stars in top_starred_repositories as each repository's public GitHub popularity; never combine these two meanings. Missing provider usage is represented by calls_with_usage < call_count, not by assuming every missing call consumed zero tokens.
Search and read
- Call
starcat.search_reposwithquery = "local first knowledge base",scope = all, andlimit = 10. - Call
starcat.semantic_searchfor semantic discovery. - Call
starcat.get_repo_contextforapple/swift. - Call
starcat.get_readmeonly when repository documentation is required. - Call
starcat.list_tagsto inspect user-defined tags.
README content can be large. Retrieve it only when the task requires repository documentation.
Manage notes, status, and tags
Call starcat.upsert_repo_note, starcat.set_repo_status, and tag tools through MCP. Send Markdown as the content field instead of placing sensitive text in a shell argument. First use dry_run = true; after authorization, repeat the exact call with dry_run = false.
Work with summaries
Call starcat.get_repo_summary to read the cached summary. Call starcat.generate_repo_summary only when the user explicitly requests generation.
Summary generation may consume quota from the user's configured AI provider. Add --allow-external-context only when the user explicitly permits External Search. Never represent text written by the external agent as a native Starcat AI summary. If the user wants to save agent-written content, store it as a Markdown private note and identify its source.
Read [references/commands.md](references/commands.md) when checking MCP tool and terminal command details. Read [references/workflows.md](references/workflows.md) when reusing workflows or recovering from connection failures.
Source & license
This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.
- Author: starcat-app
- Source: starcat-app/starcat-skill
- License: MIT
- Homepage: https://starcat.ink
Install and usage instructions live in the source repository linked above.
Reviews
No reviews yet, be the first.
Write a review
Versions
- v0.1.0 Imported from the upstream source.