CtrlK
BlogDocsLog inGet started
Tessl Logo
SkillPublic

github-pipeline-audit

Sweeps every surface of the MockServer GitHub repository and the build pipeline to confirm nothing is outstanding and everything is clean and up to date. Covers issues, pull requests, all three GitHub security-alert types, the Dependabot updater's own health, GitHub Actions, Buildkite, branches and worktrees, discussions, releases, and published-artifact parity. Use when the user says "check GitHub", "anything outstanding", "is everything clean", "audit the repo", "check the build pipeline", "housekeeping", or before cutting a release.

75

Quality

94%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide
SecuritybySnyk

Low

Low-risk findings worth noting

SKILL.md
Quality
Evals
Security

Quality

Content

85%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A highly actionable, well-sequenced audit runbook: every surface has an executable query, failure diagnosis is ordered by root cause, and validation discipline is stated as explicit rules. The main gaps are token efficiency at the margins (anecdotes and embedded version numbers) and the absence of any progressive disclosure — all reference-grade detail is inlined in a single long file.

Suggestions

Move the repo-specific lookup material — the Dependabot updater failure-cause table (section 4), the Buildkite log-reading recipes (section 6), and the per-channel release-parity checks (section 9) — into one-level-deep reference files under references/, keeping SKILL.md as a checklist that signals when to load each.

Trim or relocate time-sensitive evidence ("186 commits behind", "Twenty Spring alerts", the 5.15.0 vs 9.1.0 search.maven.org note) into a short 'known stale patterns' section so the main flow stays lean and undated.

The trigger-phrase-style guidance in the body's rules (e.g., the untrusted-input and commit-gate pointers) is valuable but could be compressed to a two-line pointer list, since the referenced .opencode/rules files already carry the detail.

DimensionReasoningScore

Conciseness

The body is dense with non-obvious, repo-specific knowledge (exact gh/bk invocations, token-scope quirks, stale-alert patterns) and wastes almost no tokens on concepts Claude already knows. Minor trimmable material remains: practice anecdotes ("a checkout 186 commits behind", "Twenty Spring alerts were exactly this") and inline version numbers (5.15.0 vs 9.1.0) that are not quarantined in an old-patterns section. It sits at 'efficient with minor instances that could be trimmed' rather than 'every token earns its place'.

4 / 5

Actionability

Nearly everything is copy-paste executable: complete gh api commands with jq projections, the Dependabot dismissal PATCH with the 280-character cap and valid reasons listed, a symptom→cause→fix table for updater failures, per-channel release-parity curl checks, and a concrete report template. Specific examples cover the common cases.

5 / 5

Workflow Clarity

Steps are explicitly sequenced with rationale ("Check the checkout is current — do this FIRST"; diagnosis order where "each rules out the next"), and validation is enforced throughout: "Never report a surface as clean without running its query", prove non-applicability before dismissing, verify worktrees for gitignored planning files and live sessions before removal. The batch/dismissal operations carry their evidence-recording feedback loops, so no cap applies.

5 / 5

Progressive Disclosure

Section structure is strong (numbered surfaces, rules, report format) and cross-skill pointers (issue-review, pipeline-investigation, release-management) are clearly signaled, but there is no bundle at all and ~340 lines of reference-grade detail — the Dependabot failure-cause table, Buildkite log-reading recipes, per-channel parity checks — all live inline where they could be split into one-level-deep reference files. This fits 'content that should be separate is inline' better than 'most content is appropriately placed'.

3 / 5

Total

17

/

20

Passed

Description

100%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

An exemplary description: concrete and comprehensive about what it covers, explicit about when to trigger it with natural user phrasings, third-person, and tightly scoped to a specific repo and pipeline. No fluff or over-claims.

DimensionReasoningScore

Specificity

The description enumerates the full audit surface concretely — "issues, pull requests, all three GitHub security-alert types, the Dependabot updater's own health, GitHub Actions, Buildkite, branches and worktrees, discussions, releases, and published-artifact parity" — with comprehensive coverage and no generic filler. It matches the anchor for multiple specific concrete actions with comprehensive coverage rather than the anchor below, which requires minor gaps.

5 / 5

Completeness

It explicitly answers both parts: what it does ("Sweeps every surface of the MockServer GitHub repository and the build pipeline to confirm nothing is outstanding and everything is clean and up to date") and when to use it ("Use when the user says..."). Voice is third person throughout, matching the top anchor with concrete trigger phrases.

5 / 5

Trigger Term Quality

Trigger phrases are natural user utterances with good synonym coverage: "check GitHub", "anything outstanding", "is everything clean", "audit the repo", "check the build pipeline", "housekeeping", "before cutting a release". This matches the comprehensive-coverage anchor, not the good-coverage-with-missing-terms anchor below.

5 / 5

Distinctiveness Conflict Risk

The description is pinned to a specific repository and a GitHub/build-pipeline audit niche with distinct trigger phrases, so it is unlikely to fire for unrelated skills. Clear niche with minimal conflict risk.

5 / 5

Total

20

/

20

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository

mock-server/mockserver-monorepo

Path

.opencode/skills/github-pipeline-audit/SKILL.md

Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.