wizard skill

Generates an interactive bash script that walks a human through manual steps such as provisioning, credentials and CI secrets, writing values to .env and GitHub secrets.

Our verdict Recommended

A practical idea executed with a reusable template and sensible limits (the agent does not run the wizard or invent steps).

What the wizard skill does

wizard is for procedures only a person can perform: provisioning infrastructure, collecting credentials, clicking through an unfamiliar third-party dashboard, or running a one-off migration. The agent first reads the repo (.env.example, README, docker-compose, framework config and every secrets or vars reference in GitHub workflows) to list the stages and the values each produces, confirms that list with you, and traces the exact path for each stage, such as which URL to open and where a value is shown. It must not invent steps it does not know.

It then copies template.sh and writes only the stage section. The template library is fixed and provides stage-by-stage progress with screen clearing, confirmation gates, cross-platform URL opening including WSL, hidden entry for secrets, idempotent .env updates, gh secret and gh variable writes, and a closing summary. The agent verifies with bash -n and shellcheck if available, makes the script executable and does not run it end to end itself, because it opens browsers and asks for secrets. Wizards are ephemeral by default and committed only if you want a repeatable setup. The skill is about 4.7 KB plus the template script.

Good for

  • Onboarding steps that involve dashboards, API keys and CI secrets
  • One-off migrations or cutovers that need a guided checklist
  • Replacing long setup instructions in a README

Not for

  • Steps the agent can perform itself
  • Fully automated, non-interactive provisioning

Depth 3/5

A 4.7 KB SKILL.md plus a substantial shell template library, but no tests or evals.

Dependencies and costs

  • bash
  • Optional: GitHub CLI (gh) for writing secrets and variables
  • shellcheck is used for verification if present
  • Telemetry: none found.

How a wizard session runs, step by step

The skill splits the work into four phases. Each phase ends with a stated "done when" condition, which tells you when the agent is ready to move on.

  1. Scope the procedure. For a setup task, the agent reads .env, .env.example, .env.*, the README, docker-compose*, framework config and .github/workflows/*. For a migration or cutover, it works out the current state, the target state and the irreversible actions between them. It then shows you the ordered stages. You can add, drop or reorder them. This phase is done when the agent knows three things about every captured value: where you get it, where it is written (.env, a GitHub secret, both, or nowhere, since some stages are pure actions), and whether it is secret or public.
  2. Map each stage's journey. The agent writes the click path for each stage, for example "Dashboard → Developers → API keys → Reveal test key → copy". If it does not know the current UI or the exact command, it should ask you or check the docs. This phase is done when a stranger could follow every stage.
  3. Author the wizard. The agent copies template.sh to the target path and replaces the example stage with one stage per step, in dependency order. It also sets TOTAL_STAGES to match the number of stages.
  4. Verify and hand off. The agent runs syntax and lint checks, makes the script executable and tells you how to run it.

Example requests that fit the skill's description:

  • "Write a wizard that walks me through creating the API keys this repo needs and puts them in .env and GitHub secrets."
  • "I need to move this project from one hosting setup to another. Build a wizard for the cutover, with a confirmation before anything irreversible."
  • "Our README setup section is long. Turn it into a wizard we can commit."

You will get better results if you correct the stage list in phase 1. That is the point where the agent asks you to confirm, and every later phase builds on that list.

Template helpers and the rules for writing stages

The skill folder holds three files: SKILL.md, agents/openai.yaml and template.sh. Everything above the STAGES marker in template.sh is the same library in every wizard. The skill tells the agent never to hand-edit it. The agent writes only the stage section, using these helpers:

Helper Purpose in a stage
stage Starts a new stage and clears the screen so only the current step shows
say / step Prints instructions to the person running the script
open_url Opens a page in the browser, including under WSL
ask Reads a visible, non-secret value
ask_secret Reads a value with hidden entry
write_env Writes a value into .env without duplicating it
set_secret / set_var Writes a GitHub secret or variable through gh
pause / confirm Waits for the person, or asks for confirmation before continuing

The skill also sets rules for using these helpers:

  • Open the URL before asking for the value that page shows.
  • Use ask_secret for anything secret.
  • Call write_env for every value that should persist.
  • Use set_secret only for values CI actually needs, not for every captured value.
  • Call confirm before any irreversible action.
  • Keep each stage to one focused task. The screen clears at each stage, so anything the person still needs from an earlier stage will be gone.

Prerequisites and checking a generated wizard

A wizard is a bash script, so you need bash. The GitHub CLI (gh) is optional and only matters for stages that write secrets or variables. Without it, values can still go to .env. If shellcheck is installed, the agent runs it during verification. If not, the agent relies on bash -n alone.

The agent does not run the finished wizard itself. Instead it traces the script statically. Every value from the scoping phase must be captured and end up where that phase said it would. Every set_secret name must exactly match a secrets.* reference in the CI workflows. You can repeat that check yourself before you run anything. Open the stage section, list each set_secret name, and search .github/workflows/ for the same names. A mismatch means CI will look for a secret the wizard never created.

The template's comments describe how ask behaves on re-runs. It offers the existing .env value as the default, so pressing Enter keeps it. Together with idempotent .env writes, this makes it reasonable to run a wizard a second time after you fix one stage. The same comment says ask fails at end of input when it gets nothing. Run the script in an interactive terminal, not with piped or redirected input.

If you commit a wizard as the repeatable setup path, the skill suggests linking it from the README. That way the next person runs the script instead of asking an AI to explain the setup again.

Security review

Review before installing

Skill for generating interactive bash wizards that walk you through manual setup steps such as collecting API keys and setting CI secrets. The shared template reads and writes your .env file and can set GitHub Actions secrets for the current repo through gh, and the agent authors the stages and URLs for each wizard, so read a generated wizard before you run it. The template itself makes no hidden network calls.

Worth knowing

  • Relies on a CLI or package we could not reviewset_secret and set_var call the GitHub CLI (gh secret set, gh variable set) using your gh login; gh is not part of the skill.template.sh:157
  • Makes network requestsPushes values you type (for example a Stripe secret key in the example stage) to GitHub Actions secrets for the current repo via gh, and opens dashboard URLs such as dashboard.stripe.com in your browser.template.sh:158

What we checked

The skill folder (3 files) on Oct 29, 2026. Not a full review: it relies on code outside the repository: gh (GitHub CLI) invoked by set_secret / set_var.

NVIDIA SkillSpector static scan: 2 pattern hits (Privilege Escalation 1, MCP Least Privilege 1). The SkillSpector credential hit (template.sh:106) is a comment about reading the existing .env value as an input default; the 'no tool scope' hit is because the template reads and writes env files. Secrets are read with hidden input, written only to the local .env and to the repo's own GitHub secrets, and are not sent to any other host.

A review, not a certification. Skills change after we check them — read the files before installing.

License

MIT — commercial use allowed (stated for the parent repository).

Can it run unattended?

Not really. Wizards exist for steps that need a human present.

Alternatives

Cloudflare Skills

cloudflare/skills

Cloudflare's official 19-skill pack for building on Workers, Durable Objects, the Agents SDK, Cloudflare One and more, with an optional bundled MCP server.

Recommended Check first Depth 4/5

Supabase Agent Skills

supabase/agent-skills

Supabase's official skills: a general Supabase skill for Auth, RLS, CLI and MCP, and a Postgres best-practices skill with 34 rule files.

Recommended Check first Depth 3/5

Neon Agent Skills

neondatabase/agent-skills

Neon's official skills for Lakebase Postgres and its Auth, Functions, Object Storage, AI Gateway and Realtime services, with branch-first workflows and evals.

With caveats Broad access Depth 4/5

Superpowers

obra/superpowers

A 15-skill development methodology that makes coding agents clarify the goal, write a plan, work through it with subagents and verify before calling it done.

Recommended Check first Depth 3/5

FAQ

What is the wizard skill?

wizard is a Matt Pocock skill that creates an interactive bash script for manual setup procedures. The script opens each URL, tells you what to copy, stores values in .env or GitHub secrets, and confirms each stage.

How do I install the wizard skill?

Install mattpocock/skills with claude plugin install mattpocock-skills@claude-plugins-official or npx skills@latest add mattpocock/skills, then ask for a wizard for the procedure you need.

Is the wizard skill safe?

The skill tells the agent not to run the generated script itself. You should read the generated script before running it, since it can write secrets to .env and GitHub.

Where do wizard scripts get saved?

They are ephemeral by default, saved to a scratch or scripts path and deleted after the job. You commit one only if you want a repeatable setup path in the repo.

Can I customize the library part of template.sh?

The skill says no. The library above the STAGES marker should stay identical in every wizard, and the agent only writes the stage section. Changes belong in the stages, built from the provided helpers.

What happens if I run a wizard a second time?

According to the template's comments, ask offers the value already in .env as the default, and pressing Enter keeps it. .env writes are idempotent, so re-running a wizard after fixing one stage should not duplicate entries.

Do I need the GitHub CLI to use the wizard skill?

Only for stages that write GitHub secrets or variables through set_secret or set_var. Stages that write to .env or that are pure actions need only bash.

Sources: GitHub repository; install counts from skills.sh via Best Skills (CC BY 4.0). Review based on the published SKILL.md.