Commit, Push & PR Skill

Evidence shows the skill documents security-aware practices: avoiding `git add -A` and `git add .` to prevent accidental staging of sensitive files; explicit user confirmation mechanisms ('Asking the user' section and branch creation decisions); treating unknown PR state as unknown rather than assuming none; using a temp file for PR body to prevent empty content; and surfacing conflicts to the user rather than auto-resolving. No malicious behavior or gross overreach detected. Deductions: publisher identity unverified (affects trust but not a fixed penalty), privacy and data handling not directly disclosed in skill (requires PRIVACY.md), permissions and confirmations numerous but not covering all external effects (e.g., network access and dependency security).

Evidence shows detailed and self-consistent steps with conditional branches handling abnormal cases (detached HEAD, fork checkout, fetch failure, etc.) and explicit instructions on interpreting non-zero exit statuses. Multiple reference files (branch-creation, pr-description-writing, stack-submit) support key paths. No obvious contradictions or errors. Deductions: static review cannot execute verification; skill relies on many external commands (git, gh) and network dependencies, actual reliability untested; no test suite or CI coverage specific to this skill itself.

Skill clearly describes usage scenarios ('Commit, push, and open a PR') and modes (description-only, description-update, full workflow) with parameters (mode:pipeline, archive, branding, babysit). Boundaries clear: when user wants just a description, full workflow is not executed. Trigger description explicit. Environment fit: skill primarily depends on git and gh CLI and GitHub platform; for mainland China users, GitHub and gh may be inaccessible, but skill runs locally and does not rely on overseas services as core functionality. Deductions: non-GitHub environments (e.g., GitLab) not explicitly stated as out of scope; trigger conditions depend on user intent understanding, potential false triggers; no Chinese support documentation, though skill itself is in English, potential language barrier for Chinese users (FollowSkills serves Chinese users, noted).

Skill documentation structured clearly with step-by-step modes, parameter explanations, and references to reference files. Progressive disclosure present (description separate from details). Examples included via description. Known limitations disclosed (treating non-zero exit as unknown not no PR). License info from repo MIT license, version in package.json (3.21.4), but skill itself lacks version and changelog. Deductions: no independent version or changelog for the skill, relying on repo-level; no troubleshooting section though error handling detailed; maintenance responsibility not explicit within skill (only in README and SECURITY.md), update path depends on whole repo.

Based on documentation, skill appears to achieve its core task: create commits, push, open PR, with detailed guidance ensuring correctness (e.g., avoid `git add -A`, use `--body-file`). Output described as PR URL and body. Marginal value: saves manual time and provides consistent PR description writing guidance. Deductions: static review cannot verify actual output is directly usable; skill complexity high, may need adjustments; alternatives (direct git commands) low cost, so marginal value exists but limited.

Evidence primarily from skill documentation and repository metadata (CI, tests exist), but no actual execution tests for this skill found. CI and tests exist but may not cover skill key paths. No third-party verification records. Claimed benefits ('make each unit of engineering work easier') articulated but unverified. Deductions: static review cannot execute skill; minimal independent verifiable evidence, only test existence in repo but possibly not specific to this skill.