Content
68%Weight 40%Scale 1-5Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
A compact, largely executable reference for authenticating and calling the GitHub API as the bot app, with a real helper script and a sensible 401-retry loop. Its main weaknesses are validation gaps around the destructive actions it advertises (push, merge, PR creation) and a couple of off-topic sections (ShitRat preamble, Receipts) that add confusion without adding instruction.
Suggestions
Add verification checkpoints for the destructive actions the skill lists (create-pr, push-commit, merge-pr): e.g., after creating a PR, capture and report the PR URL from the API response; after pushing, verify the ref via a follow-up GET before declaring success.
Trim or move the tangential content: the ShitRat preamble and the Receipts section (OTel / Brain .svx) either belong in a short 'Scope / deprecated patterns' note or should be cut, since they don't instruct the reader how to operate the GitHub API.
Replace placeholder endpoints ('repos/OWNER/REPO/...', 'repos/endpoint') with one concrete end-to-end example (e.g., creating a PR on a named repo with the token) so the curl pattern is copy-paste ready, and consider moving the pagination loop into scripts/ as a helper.
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | Largely lean and operational (token command, curl pattern, secrets table, pagination loop), but the opening ShitRat paragraph ("Discover actual app access; old repository counts are not authority") and the Receipts section's OTel / Brain ".svx" tangents are trimmable noise that don't serve the API task. | 4 / 5 |
Actionability | Mostly executable: a real token-generation script (scripts/github-token.sh exists), a concrete curl header pattern, and a working pagination bash loop. Minor gaps — "repos/OWNER/REPO/..." and "repos/endpoint" are placeholder pseudocode rather than a fully copy-paste-ready example, and SKILL_DIR must be substituted. | 4 / 5 |
Workflow Clarity | The auth workflow has a good feedback loop ("Generate a new one if a request returns 401"), but the skill explicitly covers destructive operations — "push-commit", "merge-pr", "create-pr" — with no verification steps (e.g., confirm PR URL, check merge status, verify CI after push), so validation gaps cap this at 3 per the destructive-operations guideline. | 3 / 5 |
Progressive Disclosure | Well-organized sections (Authentication, Secrets, Bot Identity, Pagination) and a correctly-resolved one-level-deep reference to scripts/github-token.sh, which exists. Slightly above the under-50-line simple-skill threshold, and the pagination loop and secrets list are candidates for scripts/references files; good but not perfectly split. | 4 / 5 |
Total | 15 / 20 Passed |