---
title: "Autodetect skills in a public GitHub repo"
method: POST
path: "/v1/authored-skills/from-github"
tags: ["authored-skills"]
---

# Autodetect skills in a public GitHub repo

`POST /v1/authored-skills/from-github`

## Request

- Base URL: `https://api.patricia.app` (the document declares no server; this is the origin it was published from)
- URL: `https://api.patricia.app/v1/authored-skills/from-github`
- Auth: HTTP bearer

Point at a PUBLIC github.com repo to autodetect every manifest.yaml in it. Patricia downloads the repo tarball over an SSRF-hardened, size-capped fetch (github hosts only, no redirects, private/internal addresses blocked, DNS-rebind-proof IP pinning), reads it safely in memory, and returns the skills it found with friendly validation results. No skill is created: pick a valid one and author it via /authored-skills/from-github/author.

## Headers

- `X-Tenant-Id` string, nullable

## Request body

- GithubImportRequest: Point the autodetect at a public GitHub repo. Patricia SSRF-hardened-fetches its tarball.
  - `repo_url` string, required: A public github.com repository URL, e.g. https://github.com/acme/skills.
  - `ref` string, nullable: Optional branch/tag/commit; defaults to the repo HEAD.

## Response `200`

Successful Response

- GithubAutodetectResponse: The skills found in a public GitHub repo.
  - `owner` string, required
  - `repo` string, required
  - `ref` string, nullable
  - `candidates` GithubSkillCandidate[]
    - `path` string, required: The repo directory the manifest lived in ('(root)' at the top level).
    - `valid` boolean, required
    - `slug` string, nullable
    - `title` string, nullable
    - `delivery_mode` string, nullable
    - `errors` string[]
    - `manifest` object, nullable
    - `skill_md` string, nullable
    - `semver_is_derived` boolean, required: A hint that the source omitted manifest.yaml, so Patricia derived the version. A wrong value can only change the version for a new import. It cannot bypass a gate. The author route still validates and compiles the manifest.
    - `import_outcome` 'activates' | 'needs_approval' | 'refused': The result that an imported skill will have for the current caller.

## Other responses

- `400`: Bad request
- `401`: Unauthorized
- `403`: Forbidden. Inspect response body `code` for the specific reason (for example: PERMISSION_DENIED, EMAIL_NOT_VERIFIED, TENANT_ACCESS_REQUIRED, ROLE_UNRESOLVED)
- `409`: Conflict
- `422`: Validation error

---

[API](https://skmtc.dev/patricia/apis/patricia-api.md) · [All operations](https://skmtc.dev/patricia/apis/patricia-api/llms.txt) · [OpenAPI document](https://skmtc.dev/patricia/apis/patricia-api/revisions/0dfb44495ea1?raw)