What is portfolio-auto?

A workflow that keeps a portfolio website’s project list in sync with GitHub repositories, which are hosted code projects. It can inspect repositories, take screenshots of deployed projects, create project entries, and update the site’s data file or Supabase database.

Use it to add new repositories, refresh changed projects, exclude forks or archived repositories, and update either a static portfolio or one backed by Supabase.

It removes the need to copy repository details and screenshots into a portfolio by hand. It also tracks previous syncs so unchanged repositories can be skipped.

portfolio-auto — Skill for Claude Code and Codex by EliasOulkadi

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent

npx skills add EliasOulkadi/shokunin --skill portfolio-auto

Clone the repo

git clone --depth 1 https://github.com/EliasOulkadi/shokunin

Made for: Claude Code, Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/eliasoulkadi/shokunin/portfolio-auto/github.svg)](https://agentmods.dev/skills/eliasoulkadi/shokunin/portfolio-auto)

Your own site

<a href="https://agentmods.dev/skills/eliasoulkadi/shokunin/portfolio-auto"><img src="https://agentmods.dev/badge/skills/eliasoulkadi/shokunin/portfolio-auto/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/skills/eliasoulkadi/shokunin/portfolio-auto"><img src="https://agentmods.dev/badge/skills/eliasoulkadi/shokunin/portfolio-auto.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 77 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 2,483 The whole file, excluding the scripts and references it only reads on demand.

Security scan B 2 findings. A grade says what 26 rules found in the file — not that it is safe. Third-party audits

NVIDIA SkillSpector warn 7 Sept 2026

SkillSpector: 6 findings, up to high

These are SkillSpector’s own severities. On a checked sample its high-severity flags on skills were ~96% false positives — a documented command, a public API, a “never do X” rule — so we show them as a caution to read, not a verdict. Why →

high Privilege Escalation · line 135
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
high Privilege Escalation · line 220
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Fix: Remove references to credential paths. Use environment variables or secrets managers. For docs, use placeholder paths (e.g., /path/to/config). Never load .env or token files in production code paths.
medium Data Exfiltration · line 97
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
medium MCP Rug Pull · line 138
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Fix: Pin the version: npx @scope/[email protected]
medium Data Exfiltration · line 156
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Fix: Verify the destination URL is trusted and necessary. Remove or replace with documented APIs. Ensure no secrets, tokens, or PII are transmitted.
medium Excessive Agency · line 228
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Fix: Add human-in-the-loop confirmation for destructive, irreversible, or high-impact operations. Never auto-execute commands that modify files, send data, or alter system state.

How audits are shown

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00077	$0.02483
Opus 5.5	$0.00031	$0.00993
Sonnet 5.5	$0.00015	$0.00497
Haiku 4.5	$0.00008	$0.00248

Measured 2mo ago against content hash 0bc7f287ed56, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade B, and why

portfolio-auto scanned grade B with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2mo ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Sends data to an external URLmediumData exfiltration

A POST to an outside endpoint may be telemetry or may be exfiltration; either way the mod talks to somewhere, and you should know where.

const res = await fetch('https://your-site.com/api/projects', { method: 'POST',

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

r = requests.get(f"https://api.github.com/user/repos?per_page=100&page={page}&sort=updated", headers=headers)

.pack/skills/portfolio-auto/SKILL.md · 234 lines

How it starts

The opening of the file, as written. The whole thing — 234 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Note: last-sync.json state file is auto-created on first successful sync. Ignore "missing file" warnings on first run.

Portfolio Auto-Sync

Automatically sync GitHub repositories to your portfolio website.

Workflow

Step 1: Gather configuration

Ask the user:

GitHub username: (default from git config)
Portfolio type: static (projects-data.js) or supabase (API)
Portfolio directory: Path to portfolio project
Filters: Exclude repos (archived, forks, specific names)

Step 2: Fetch repos via GitHub API

GET /users/{username}/repos?per_page=100&sort=updated&direction=desc

Extract: name, description, html_url, homepage, language, topics, updated_at

Filter out:

Forks (unless user opts in)
Profile repos ({username}/{username})
Archived repos

Step 3: Detect changes

Compare against last-sync.json (stored in skill directory).

New repos: Not in last sync → full process
Updated repos: updated_at changed → re-screenshot
Unchanged repos: Skip

Step 4: Capture screenshots

For repos with a homepage or deploy URL:

const { chromium } = require('playwright');
const browser = await chromium.launch({ headless: true });
const page = await browser.newPage();
await page.setViewportSize({ width: 1280, height: 800 });
await page.goto(process.env.URL, { waitUntil: 'networkidle', timeout: 15000 });
await page.screenshot({ path: `/tmp/portfolio-${name}.png`, fullPage: false });
await browser.close();

Save to portfolio's screenshot directory.

Step 5: Update portfolio data

Static (projects-data.js)

{
  title: '{repo.name}',
  description: 'Auto-generated: {description}',
  tech: '{language},{topics}',
  github_url: '{html_url}',
  live_url: '{homepage || ""}',
  featured: false
}

Supabase

const res = await fetch('https://your-site.com/api/projects', {
  method: 'POST',
  headers: { 'Content-Type': 'application/json', 'Authorization': 'Bearer {token}' },
  body: JSON.stringify(projectData)
});

Read the full file on GitHub · 234 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

2mo ago First seen · 234 lines · 77 tokens per session scan B 0bc7f287ed56

Subscribe to this mod's changes

portfolio-auto is a skill published in the GitHub repository EliasOulkadi/shokunin (112 stars, last pushed 1mo ago), licensed MIT. It adds 77 tokens to every session and 2,483 once invoked, about $0.0003 per session on Opus 5.5. A static security scan graded it B with 2 findings (sends data to an external url, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Claude Code Git and workflow Marketing and SEO ai-agent-skills ai-engineering chromadb mcp-server opencode

portfolio-auto next to 6 skills from other repositories
Mod	Type	Stars	Last push	Licence	Scan	Tokens	Works with
portfolio-autoEliasOulkadi/shokunin	Skill	112	1mo ago	MIT	B	77	Claude Code, Codex
orchard-releaserohitg00/ai-engineering-from-scratch	Skill	77k	yesterday	MIT	A	11	Claude Code, Codex
worktreesalvinunreal/oh-my-opencode-slim	Skill	10k	yesterday	MIT	A	23	Claude Code, Codex
om-auto-continue-propen-mercato/skills	Skill	272	yesterday	MIT	A	69	Claude Code, Codex
cmux-dev-workflowmanaflow-ai/cmux	Skill	29k	yesterday	none	A	38	Codex
om-auto-merge-triageopen-mercato/skills	Skill	272	yesterday	MIT	A	65	Claude Code, Codex
om-merge-buddyopen-mercato/skills	Skill	272	yesterday	MIT	A	63	Claude Code, Codex

portfolio-auto