CtrlK
BlogDocsLog inGet started
Tessl Logo
SkillPublic

github-gitlab

Work with GitHub and GitLab repositories through resident gh/glab/git auth on the agent computer.

Quality

70%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide
SecuritybySnyk

Low

Low-risk findings worth noting

Fix and improve this skill with Tessl

tessl review fix ./skills-seed/github-gitlab/SKILL.md
SKILL.md
Quality
Evals
Security

Quality

Content

88%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The body is an exceptionally disciplined operational policy: fully executable commands, approval gates on every write, explicit validation checkpoints around CI and merging, and a well-signaled bundled watcher script whose described behavior matches the actual code. Only minor tightening (repeated head-change caveats, possible offloading of the CI policy detail to a reference file) keeps it from full marks.

DimensionReasoningScore

Conciseness

The body is dense with non-obvious operational policy (credential selection, login-only-on-confirmed-rejection, watcher semantics) and wastes no tokens explaining what GitHub or git is — 'Efficient; minor instances of over-explanation that could be trimmed'. It is not a 5 because the CI section repeats the head-change discipline ('changed heads ... stop', then again 'After any push or head change, discard old success/review evidence') and some clauses ('Its name is an admin label, not a verified upstream username') could be tightened.

4 / 5

Actionability

Every section carries copy-paste-ready commands with explicit placeholders: 'gh repo view OWNER/REPO --json name,description,url,defaultBranchRef', 'glab mr create --repo GROUP/PROJECT --title "..." --description-file mr.md', and the full watcher invocation 'node "<skill dir>/scripts/watch-ci.mjs" --repo OWNER/REPO --pr NUMBER --head REVIEWED_HEAD_SHA' whose flags match the bundled script exactly. It is not a 4 because there are no real gaps — even the '<skill dir>' placeholder is explicitly told how to resolve.

5 / 5

Workflow Clarity

The multi-step flow is clearly sequenced (choose account → login only after confirmed rejection → inspect → checkout/edit → approval-gated writes → CI wait → merge) with explicit validation checkpoints: capture the head SHA before review, re-read checks and threads immediately before merging, discard stale evidence after any head change, and merge only with 'gh pr merge NUMBER --repo OWNER/REPO --squash --match-head-commit REVIEWED_HEAD_SHA'. Destructive operations (push, merge) are approval-gated and error-recovery semantics (which failures stop the watcher, read the status record not the exit code) are spelled out, matching the top anchor.

5 / 5

Progressive Disclosure

The single bundled file (scripts/watch-ci.mjs) is real, referenced one level deep with its exact invocation, and the body appropriately summarizes the script's semantics rather than inlining its logic — 'Good structure; most content is appropriately placed; references mostly clear'. It is not a 5 because the account-selection and CI-wait policy prose is long enough that a references/ file could carry part of it, and the sibling skills ('use-shared-credential', 'interactive-login') are cited by name only without paths.

4 / 5

Total

18

/

20

Passed

Description

40%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description correctly names the domain and tooling, but relies entirely on the generic verb 'Work with' with no concrete capabilities and no 'Use when...' trigger clause. Users mentioning pull requests, issues, or merge requests would not reliably surface this skill.

Suggestions

Add an explicit 'Use when...' clause, e.g. 'Use when the user mentions GitHub or GitLab, repos, issues, pull requests, or merge requests, or asks to clone or change code in a hosted repo.'

Enumerate concrete capabilities instead of 'Work with': inspect repos/issues/PRs/MRs, clone and make small changes, open PRs/MRs, wait on CI, and merge after gates pass.

Include natural trigger synonyms users actually say — 'pull request', 'PR', 'MR', 'merge request', 'issue', 'code review' — not just the product names.

DimensionReasoningScore

Specificity

The description names the domain concretely ("GitHub and GitLab repositories through resident gh/glab/git auth on the agent computer") but the only action verb is the generic "Work with" — no concrete operations like inspecting issues, opening PRs, or waiting on CI are listed. It matches the anchor 'Names the domain but actions are minimal or generic' (cf. "Processes PDF files"); it is not a 3 because no concrete actions are enumerated at all.

2 / 5

Completeness

The 'what' is vague ("Work with ... repositories") and there is no 'when' — no 'Use when...' clause or equivalent trigger guidance anywhere in the description, which the guidelines say caps completeness at 3. This lands on the anchor 'Has a vague what and no when'; it is not a 3 because even the what lacks concrete actions to make it clear.

2 / 5

Trigger Term Quality

Natural keywords present include "GitHub", "GitLab", "repositories", "git", and "auth", which users would genuinely say. However the common work-object terms — "pull request", "PR", "merge request", "issue", "code review" — are all missing, matching 'Some relevant keywords but missing common variations or synonyms'; it is not a 4 because the missing terms are the primary triggers for this skill, not just a few stragglers.

3 / 5

Distinctiveness Conflict Risk

Naming both hosted providers plus resident gh/glab/git auth on the agent machine carves a fairly clear niche distinct from generic git/VCS skills ('Mostly distinct; minor overlap risk with closely related skills'). It is not a 5 because no explicit trigger phrases are given, leaving some overlap risk with a general git or repo-management skill.

4 / 5

Total

11

/

20

Passed

Validation

93%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

CriteriaDescriptionResult

frontmatter_unknown_keys

Unknown frontmatter key(s) found; consider removing or moving to metadata

Warning

Total

15

/

16

Passed

Repository

yc-software/qm

Path

skills-seed/github-gitlab/SKILL.md

Reviewed

Table of Contents

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.