first-commit
Start new projects and keep them up to date with first-commit workspace kits (project template + dependencies + agent skills + MCP servers + AGENTS.md rules, installed by `npx create-first-commit`). Use when the user wants to create a new app, landing, SaaS, API, mobile app or browser extension, or to add a library such as Sentry, PostHog, Stripe or Better Auth to an existing project, or when the project has a kits.lock file.
How do I install this agent skill?
npx skills add https://github.com/marlon-chaviano/first-commit --skill first-commitIs this agent skill safe to install?
- Gen Agent Trust Hubpass
The 'first-commit' skill is a project scaffolding tool that uses `npx create-first-commit` to initialize or update projects using pre-defined templates ('kits'). It fetches configurations and code from the developer's official domain or community repositories. The skill includes several security safeguards, such as requiring a 'dry-run' to show planned actions, obtaining explicit user consent before installation, and requiring additional flags for unverified community kits.
- Socketpass
No alerts
- Snykwarn
Risk: MEDIUM · 1 issue
What does this agent skill do?
first-commit
create-first-commit creates a project from a kit: a base project plus the dependencies, agent skills, MCP servers and AGENTS.md rules for the stack the user picks. Catalog and configurator: https://first-commit.dev.
When to use it
- New project in an empty folder ("make me a recipes app with Expo", "a landing with animations"): use a kit instead of scaffolding by hand.
- Existing project with
kits.lock: it came from a kit. Useupdateto get the kit's improvements andaddto add libraries, so the rules inAGENTS.mdstay in sync. - Adding a catalog library (Sentry, PostHog, Stripe, Resend, Better Auth, Kokonut UI, Motion…) to any project:
addwrites its config and its rule inAGENTS.md.
Create a project
- Pick the kit. If the first-commit MCP server is available, call
recommend_kitwith the user's description, thenget_kitfor the options. Otherwise:npx create-first-commit list— official kits.npx create-first-commit info <kit>— options and their values.
- Choose only the options the user asked for; keep the defaults for everything else. Options are flags:
--<option> <value>(comma-separated for multi options). - Show the plan and ask before running anything:
npx create-first-commit <kit> <folder> [options] --dry-run(or theplan_inittool). Installing runs commands and downloads packages. - After the user agrees: the same command without
--dry-runand with--yes(orinit_kitwithapproved: true). It takes a few minutes. - Read the new project's
AGENTS.mdand follow its "first steps": do the setup tasks you can, and tell the user which ones need them (API keys, accounts). Copy.env.exampleto.envbut never invent secret values.
Community kits (user/kit) that aren't verified ask for confirmation; with --yes they also need --allow-commands. Only add it if the user explicitly trusts that kit.
Maintain a project
npx create-first-commit update --dry-run, thennpx create-first-commit update --yes: new dependencies, skills, MCP servers and rules from the kit's latest version. Files the user changed are never overwritten; it lists them.npx create-first-commit add <library|owner/repo@skill> --yes: adds a catalog library with the right variant for the framework (Sentry for Next.js, Expo or Node).npx create-first-commit doctor: checks that the project still follows its rules (one component library, env vars, skills installed). Exit code 1 means errors; fix them or tell the user.
Rules
- The rules in
AGENTS.mdbetween<!-- kits:start -->and<!-- kits:end -->come from the kit: follow them (for example, "only use the chosen component library"). Don't edit that block by hand;updaterewrites it. - Don't install a second library for something the kit already chose (another component system, another auth). Use
add --forceonly if the user explicitly wants to switch.
How can the creator link this skill?
Add the canonical catalog link to the repository README so users can inspect current installs and available audits. The publishing guide covers the complete discovery path.
<a href="https://skillzs.dev/skills/marlon-chaviano/first-commit/first-commit">View first-commit on skillZs</a>