Agent skill

Integration Rule Engine

by aozyildirim in aozyildirim/Agena

A declarative routing engine that turns ticket / error attributes (reporter, label, project, area path, error class, environment) into a tag + AI agent + priority assignment, so cross-source…

MITAuto-check passedSecurity

Install Integration Rule Engine

skills CLI
$ npx skills add aozyildirim/Agena --skill integration-rule-engine -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install aozyildirim/Agena integration-rule-engine --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/aozyildirim/Agena.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/agena/integration-rule-engine .claude/skills/integration-rule-engine && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
integration-rule-engine
GitHub stars
102
Token cost
~976 tokens
SKILL.md length
360 words
Files
1
Skills in repo
5
Repo updated
First seen
Licence
MIT

At a glance

A declarative routing engine that turns ticket / error attributes (reporter, label, project, area path, error class, environment) into a tag + AI agent + priority assignment, so cross-source…

  • Works in 5 steps: Single rule table with provider + match… → Match clause — matches a single field… → Action clause — what happens when the… → …
  • Tasks that involve Web application vulnerabilities
  • SKILL.md covers How to apply this pattern, Example rules and Notes
  • Instructions only: no scripts, shell commands, URLs or credentials in SKILL.md

What it does

Integration Rule Engine is an agent skill from aozyildirim/Agena. A declarative routing engine that turns ticket / error attributes (reporter, label, project, area path, error class, environment) into a tag + AI agent + priority assignment, so cross-source workflows ("security tickets always go to the OWASP reviewer") stay out of code and in user-editable rules.

Its SKILL.md is about 980 tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.

It sits in Security, covering Web application vulnerabilities. The repository describes itself as: Agentic AI platform with pixel agent technology — autonomous code generation, PR automation & multi-tenant SaaS. The licence is MIT.

When your agent uses it

  • Tasks that involve Web application vulnerabilities

Example prompts

  • “security tickets always go to the OWASP reviewer”
  • “/integration-rule-engine”

Workflow steps

5 steps, taken from the first numbered list in SKILL.md.

  1. Single rule table with provider + match (JSON) +
  2. Match clause — matches a single field with one operator. Common
  3. Action clause — what happens when the rule matches
  4. Evaluate at import time, not at agent run time. Stamp the action
  5. First-match-wins with explicit priority. A rule with higher

What it can do on your machine

Read from SKILL.md and the folder at commit 63db0e2. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    No scripts in the folder and no shell commands in SKILL.md (its code samples are yaml).

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    No URLs in SKILL.md.

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names no API keys, tokens, secrets or passwords.

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Integration Rule Engine loads about 976 tokens when it runs. Until then it costs about 81 tokens; SKILL.md has 360 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~81
When it runs · the whole SKILL.md, loaded when a task matches
~976

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from aozyildirim/Agena at commit 63db0e2, republished under its MIT licence (© aozyildirim). 360 words, ~976 tokens.

Download SKILL.mdSave it as .claude/skills/integration-rule-engine/SKILL.md (or your agent's skills folder).
name
integration-rule-engine
description
A declarative routing engine that turns ticket / error attributes (reporter, label, project, area path, error class, environment) into a tag + AI agent + priority assignment, so cross-source workflows ("security tickets always go to the OWASP reviewer") stay out of code and in user-editable rules.
tags
routing, jira, sentry, azure-devops, ai-agent, declarative
publisher
agena

Integration Rule Engine

When a Sentry / NewRelic / Jira / Azure DevOps event lands, you want to auto-tag it, route it to the right AI reviewer agent, and bump priority based on attributes — without rebuilding the routing logic in code per source. The Integration Rule Engine collapses all that into one rule table.

How to apply this pattern

  1. Single rule table with provider + match (JSON) + action (JSON) + priority (rule precedence) + is_active. Same shape across providers; the matcher just checks the appropriate attributes.

  2. Match clause — matches a single field with one operator. Common operators:

    OperatorUse
    equalsreporter is exactly security@yourco.com
    containstag list contains security
    inreporter in (security@yourco.com, secops@yourco.com)
    regexerror class matches ^TypeError|^IntegrityError$
    prefixarea path starts with Project\Backend\
  3. Action clause — what happens when the rule matches:

    • tag: add a tag string to the imported task (e.g. security_review)
    • preferred_agent_role: which reviewer agent to route through (e.g. security_developer)
    • priority: override priority (critical, high, etc.)
    • target_repo: override the default repo mapping for this task
  4. Evaluate at import time, not at agent run time. Stamp the action into the task's metadata so downstream agents and the UI see the same routing without re-evaluating.

  5. First-match-wins with explicit priority. A rule with higher priority gets evaluated first; a single rule wins per import.

Example rules

yaml
# Security tickets reported by the security team go to the
# OWASP-aware reviewer with critical priority
- provider: jira
  match: { field: reporter, op: in, values: [security@yourco.com] }
  action:
    tag: security_review
    preferred_agent_role: security_developer
    priority: critical

# Sentry errors in the payments project always route to a senior
# backend reviewer
- provider: sentry
  match: { field: project, op: equals, value: payments }
  action:
    tag: payments
    preferred_agent_role: senior_backend
    priority: high

# Azure DevOps work items in a specific area path
- provider: azure_devops
  match: { field: area_path, op: prefix, value: "Project\\Frontend" }
  action:
    tag: frontend
    preferred_agent_role: a11y_reviewer
Show full SKILL.md (145 more words)Show less

Notes

  • Declarative > imperative. Don't sprinkle if reporter == X branches across import code. The whole point is letting non-engineers edit routes from a UI.
  • Same engine for every provider. Sentry, NewRelic, Jira, Azure DevOps imports all flow through the same rule evaluator. Adding a new provider becomes "expose its attributes to the matcher" instead of "rewrite routing".
  • Audit the route. Every applied rule should leave a trail on the task: which rule fired, which fields matched. Important when a reviewer asks "why did this end up with security_review?"
  • Preferred Agent Role stamped on description metadata is a clean hand-off to the review service. The reviewer-resolution code then honours that without needing to re-evaluate the rule.
  • Test rules before publishing: provide a "dry run" mode where the rule editor shows which past tickets / errors would have matched. Catches greedy regex disasters before they fire on real imports.

© aozyildirim, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

Just SKILL.md in skills/agena/integration-rule-engine of aozyildirim/Agena.

Open the folder on GitHubat commit 63db0e2

Compare with similar skills

Integration Rule Engine next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Integration Rule Engine compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Integration Rule Engine this skillaozyildirim/Agena102—~976Automated safety check: PassMIT
Security And Hardeningpenpot/penpot61k6 repos~4.7kAutomated safety check: NotesMPL-2.0
Security Auditoreigent-ai/eigent15k—~1.8kAutomated safety check: NotesApache-2.0
Security Reviewjewbetcha/opentrace11618 repos~3.1kAutomated safety check: NotesMIT
Strix Code Vulnerability Scanusestrix/strix67k—~1.1kAutomated safety check: PassApache-2.0
Code Audit3stoneBrother/code-audit8921 repos~2.7kAutomated safety check: PassNone

Similar skills

  • Hardens code against vulnerabilities. An agent skill from penpot/penpot.

    61k GitHub starsUsed in 6 repos~4.7k tokens
    SecurityAuto-check: notes
  • Security Auditor

    eigent-ai/eigent

    Audits source code, dependencies and config files for vulnerabilities and hardcoded secrets, using two bundled Python scanners and an OWASP Top 10 checklist.

    15k GitHub stars~1.8k tokensUpdated today
    SecurityAuto-check: notes
  • Security Review

    jewbetcha/opentrace

    A skill your agent uses when adding authentication, handling user input, working with secrets, creating API endpoints, or implementing payment/sensitive features.

    116 GitHub starsUsed in 18 repos~3.1k tokens
    SecurityAuto-check: notes
  • Runs a Strix white-box security review that reads the source, then exploits what it finds in a sandbox so each reported issue has a proof-of-concept.

    67k GitHub stars~1.1k tokensUpdated today
    SecurityAuto-check passed
  • Code Audit

    3stoneBrother/code-audit

    Professional code security audit skill covering 55+ vulnerability types.

    892 GitHub starsUsed in 1 repo~2.7k tokens
    SecurityAuto-check passed
  • Triages findings from a Strix pentest by severity, fixes each root cause with a minimal change, and re-runs Strix to confirm the exploit no longer works.

    67k GitHub stars~1.5k tokensUpdated today
    SecurityAuto-check passed

More from aozyildirim/Agena

  • Cross Source Correlation

    aozyildirim/Agena

    Correlate near-in-time events across PR merges, deploys, monitoring (Sentry/NewRelic/Datadog/AppDynamics) and ticket trackers (Jira/Azure DevOps) into confidence-scored clusters that answer "which…

    102 GitHub stars~756 tokensUpdated today
    Auto-check passed
  • Owasp Reviewer Prompt

    aozyildirim/Agena

    A paranoid OWASP-Top-10-aware system prompt for AI code review that traces data flow, treats every input as malicious, maps each finding to an OWASP category, and outputs a structured Summary /…

    102 GitHub stars~978 tokensUpdated today
    Auto-check passed
  • Review Backlog Killer

    aozyildirim/Agena

    Detect pull requests aging past warn / critical thresholds, score severity, and nudge reviewers via Slack DM, channel, email, or directly as a PR comment — with one-time auto-escalation when a PR…

    102 GitHub stars~802 tokensUpdated today
    Auto-check passed
  • Stale Ticket Triage

    aozyildirim/Agena

    Replace the weekly "look at every ticket older than X days" meeting with a scheduled AI scan that picks close / snooze / keep per ticket plus a one-sentence reason, so a PM can bulk-approve in 90…

    102 GitHub stars~714 tokensUpdated today
    Auto-check passed

Categories

Questions about Integration Rule Engine

What does Integration Rule Engine do?

A declarative routing engine that turns ticket / error attributes (reporter, label, project, area path, error class, environment) into a tag + AI agent + priority assignment, so cross-source…. Integration Rule Engine is an agent skill from aozyildirim/Agena. A declarative routing engine that turns ticket / error attributes (reporter, label, project, area path, error class, environment) into a tag + AI agent + priority assignment, so cross-source workflows ("security tickets always go to the OWASP reviewer") stay out of code and in user-editable rules.

When should I use Integration Rule Engine?

Integration Rule Engine fits situations like: tasks that involve Web application vulnerabilities.

How do I install Integration Rule Engine in Claude Code?

Run `npx skills add aozyildirim/Agena --skill integration-rule-engine -a claude-code`. Or copy the skill folder (skills/agena/integration-rule-engine in aozyildirim/Agena) into .claude/skills/integration-rule-engine in your project. Claude Code loads it when a task matches its description.

How do I install Integration Rule Engine in Codex?

Run `npx skills add aozyildirim/Agena --skill integration-rule-engine -a codex`. Or copy the skill folder (skills/agena/integration-rule-engine in aozyildirim/Agena) into .agents/skills/integration-rule-engine in your project. Codex loads it when a task matches its description.

Can I use Integration Rule Engine in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add aozyildirim/Agena --skill integration-rule-engine -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/integration-rule-engine, .gemini/skills/integration-rule-engine, .github/skills/integration-rule-engine and .opencode/skills/integration-rule-engine in your project.

What does Integration Rule Engine need to run?

SKILL.md names no scripts, command-line tools or credentials: Integration Rule Engine is instructions for the agent only.

Does Integration Rule Engine access the network?

SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.

Is Integration Rule Engine safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does Integration Rule Engine use?

Integration Rule Engine is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Integration Rule Engine use?

About 976 tokens (SKILL.md is roughly 3.9k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.

What are the alternatives to Integration Rule Engine?

Skills that share tags, products or a category with Integration Rule Engine: Security And Hardening (penpot/penpot, 61k stars), Security Auditor (eigent-ai/eigent, 15k stars), Security Review (jewbetcha/opentrace, 116 stars) and Strix Code Vulnerability Scan (usestrix/strix, 67k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Integration Rule Engine?

aozyildirim (a GitHub user) maintains it in aozyildirim/Agena, which has 102 GitHub stars. The repository holds 5 skills in this directory. The repository was last updated on October 9, 2026.

Source: aozyildirim/Agena on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.