fix(skills): pin CLI and remove retired entries - #185
Conversation
|
Warning Review limit reached
Next review available in: 51 minutes You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. 📝 WalkthroughSummary by CodeRabbit
WalkthroughThe Makefile now pins the skills CLI to version 1.5.20. The skill catalog lists 33 published skills. The lockfile removes deprecated entries, updates hashes, and corrects skill paths. ChangesSkills catalog and tooling refresh
Estimated code review effort: 2 (Simple) | ~10 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches 💡 1⚔️ Resolve merge conflicts 💡
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@SKILLS.txt`:
- Around line 118-119: Resolve the four conflicting entries in the
mattpocock/skills list—code-review, tdd, teach, and triage—so they do not
collide with the sources locked in skills-lock.json. Use source-qualified
identifiers or an explicitly supported precedence mechanism, or remove those
entries if unsupported, while preserving the remaining published skills.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: ddd5e3e0-2780-4d21-ad20-e8058090dab8
📒 Files selected for processing (3)
MakefileSKILLS.txtskills-lock.json
| # mattpocock/skills (33 total) - keep all currently published skills | ||
| mattpocock/skills ask-matt,claude-handoff,code-review,codebase-design,diagnosing-bugs,domain-modeling,git-guardrails-claude-code,grill-me,grill-with-docs,grilling,handoff,implement,improve-codebase-architecture,loop-me,migrate-to-shoehorn,prototype,research,resolving-merge-conflicts,scaffold-exercises,setup-matt-pocock-skills,setup-pre-commit,setup-ts-deep-modules,tdd,teach,to-questionnaire,to-tickets,to-spec,triage,wayfinder,wizard,writing-beats,writing-fragments,writing-shape |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | 🏗️ Heavy lift
🧩 Analysis chain
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
python3 - <<'PY'
import json
from pathlib import Path
catalog_line = next(
line for line in Path("SKILLS.txt").read_text().splitlines()
if line.startswith("mattpocock/skills ")
)
names = catalog_line.split(maxsplit=1)[1].split(",")
lock = json.loads(Path("skills-lock.json").read_text())["skills"]
mismatches = [
(name, lock.get(name, {}).get("source"))
for name in names
if lock.get(name, {}).get("source") != "mattpocock/skills"
]
if mismatches:
for name, source in mismatches:
print(f"{name}: {source}")
raise SystemExit(1)
PYRepository: shunkakinoki/dotagents
Length of output: 301
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
printf '--- SKILLS.txt excerpt ---\n'
sed -n '1,135p' SKILLS.txt | nl -ba | sed -n '110,123p'
printf '\n--- skills-lock.json duplicate entries with sources ---\n'
python3 - <<'PY'
import json
from pathlib import Path
lock = json.loads(Path("skills-lock.json").read_text())
skills = lock.get("skills", {})
target = "mattpocock/skills"
for name in ["code-review", "tdd", "teach", "triage"]:
entry = skills.get(name, {})
print(f"{name} source={entry.get('source')}")
print("\nAll skill names with duplicate names:")
from collections import Counter
names = Counter(skills)
for name, count in names.items():
if count > 1:
print(f"{name}: {count}")
PY
printf '\n--- Makefile relevant excerpt ---\n'
if [ -f Makefile ]; then
sed -n '80,125p' Makefile | nl -ba
fiRepository: shunkakinoki/dotagents
Length of output: 251
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
printf '%s\n' '--- SKILLS.txt excerpt ---'
sed -n '110,123p' SKILLS.txt | nl -ba
printf '%s\n' ''
printf '%s\n' '--- skills-lock.json locked sources for conflicts ---'
python3 - <<'PY'
import json
from pathlib import Path
lock = json.loads(Path("skills-lock.json").read_text())
skills = lock.get("skills", {})
for name in ["code-review", "tdd", "teach", "triage"]:
entry = skills.get(name, {})
print(f"{name} source={entry.get('source')}")
PY
printf '%s\n' ''
printf '%s\n' '--- Makefile skill installation excerpt ---'
if [ -f Makefile ]; then
sed -n '80,125p' Makefile | nl -ba
else
printf '%s\n' 'Makefile not present'
fi
printf '%s\n' ''
printf '%s\n' '--- Search for skill lock generation/install references ---'
rg -n "skills-lock|SKILLS|install|source" Makefile SKILLS.txt skills-lock.json 2>/dev/null || trueRepository: shunkakinoki/dotagents
Length of output: 227
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
sed -n '110,123p' SKILLS.txt
echo
python3 - <<'PY'
import json
from pathlib import Path
lock = json.loads(Path("skills-lock.json").read_text())
skills = lock.get("skills", {})
for name in ["code-review", "tdd", "teach", "triage"]:
entry = skills.get(name, {})
print(f"{name} source={entry.get('source')}")
pairs = {name: (idx, skill) for idx, skill in enumerate(lock.get("skills", {}).items()) for name in [name]}
from collections import Counter
for name, count in Counter(skills).items():
if count > 1:
print(f"{name} duplicate_count={count}")
PY
echo
sed -n '76,116p' Makefile 2>/dev/null || true
echo
rg -n "skills-lock|SKILLS" Makefile SKILLS.txt skills-lock.json 2>/dev/null || trueRepository: shunkakinoki/dotagents
Length of output: 1496
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
echo "--- Makefile skill installation excerpt ---"
sed -n '80,120p' Makefile 2>/dev/null || true
echo
echo "--- skills-lock.json duplicate skill names ---"
python3 - <<'PY'
import json
from pathlib import Path
from collections import Counter
text = Path("skills-lock.json").read_text()
# Parse JSON objects literally enough to get "source" fields without importing lockfile generation code.
# This is a small read-only data check: the lock is valid JSON per the first verifier.
lock = json.loads(text)
skills = lock.get("skills", {})
name_counts = Counter(skills)
for name, count in name_counts.items():
if count > 1:
print(f"{name}: {count}")
PY
echo
echo "--- exact JSON entries for conflicting names ---"
python3 - <<'PY'
import json
from pathlib import Path
lock = json.loads(Path("skills-lock.json").read_text())
skills = lock.get("skills", {})
for name in ["code-review", "tdd", "teach", "triage"]:
print(name, "=>", json.dumps(skills.get(name), indent=2, ensure_ascii=False))
PYRepository: shunkakinoki/dotagents
Length of output: 2401
Resolve mattpocock/skills name conflicts before merging.
mattpocock/skills includes code-review, tdd, teach, and triage, but skills-lock.json locks those names to anthropics/knowledge-work-plugins, cursor/plugins, cursor/plugins, and anthropics/defending-code-reference-harness. make skills-install installs skills-lock.json by name, so the Matt Pocock variants will not be installed for these four skills. Use source-qualified skill IDs, define explicit precedence, or remove the unsupported names from this entry.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@SKILLS.txt` around lines 118 - 119, Resolve the four conflicting entries in
the mattpocock/skills list—code-review, tdd, teach, and triage—so they do not
collide with the sources locked in skills-lock.json. Use source-qualified
identifiers or an explicitly supported precedence mechanism, or remove those
entries if unsupported, while preserving the remaining published skills.
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
1 issue found and verified against the latest diff
Prompt for AI agents (unresolved issues)
Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.
<file name="Makefile">
<violation number="1" location="Makefile:112">
P3: The pinned skills CLI version `1.5.20` is now hardcoded in three separate places in the Makefile (skills-install, skills-update, and the skills-lock warning message). A future CLI bump requires touching all three spots, and there's no single source of truth to keep them in sync. Consider hoisting it into a single Makefile variable (e.g. `SKILLS_CLI_VERSION ?= 1.5.20`) referenced by all three `bun x --package skills@$(SKILLS_CLI_VERSION)` invocations so the pin is defined once.</violation>
</file>
Reply with feedback, questions, or to request a fix.
Re-trigger cubic
| count=$$(printf '%s\n' "$$names" | wc -l | tr -d ' '); \ | ||
| echo "Installing $$count skill(s) from $$source..."; \ | ||
| bun x skills add "$$source" --global --yes $$skill_args </dev/null; \ | ||
| bun x --package skills@1.5.20 skills add "$$source" --global --yes $$skill_args </dev/null; \ |
There was a problem hiding this comment.
P3: The pinned skills CLI version 1.5.20 is now hardcoded in three separate places in the Makefile (skills-install, skills-update, and the skills-lock warning message). A future CLI bump requires touching all three spots, and there's no single source of truth to keep them in sync. Consider hoisting it into a single Makefile variable (e.g. SKILLS_CLI_VERSION ?= 1.5.20) referenced by all three bun x --package skills@$(SKILLS_CLI_VERSION) invocations so the pin is defined once.
Prompt for AI agents
Check if this issue is valid — if so, understand the root cause and fix it. At Makefile, line 112:
<comment>The pinned skills CLI version `1.5.20` is now hardcoded in three separate places in the Makefile (skills-install, skills-update, and the skills-lock warning message). A future CLI bump requires touching all three spots, and there's no single source of truth to keep them in sync. Consider hoisting it into a single Makefile variable (e.g. `SKILLS_CLI_VERSION ?= 1.5.20`) referenced by all three `bun x --package skills@$(SKILLS_CLI_VERSION)` invocations so the pin is defined once.</comment>
<file context>
@@ -109,7 +109,7 @@ skills-install: ## Install external skills from skills-lock.json (skips already
count=$$(printf '%s\n' "$$names" | wc -l | tr -d ' '); \
echo "Installing $$count skill(s) from $$source..."; \
- bun x skills add "$$source" --global --yes $$skill_args </dev/null; \
+ bun x --package skills@1.5.20 skills add "$$source" --global --yes $$skill_args </dev/null; \
status=$$?; \
still_missing=$$(printf '%s\n' "$$names" | while IFS= read -r n; do \
</file context>
|
Superseded by #186, which uses the current Skills SDK and supports invocation from the upstream ~/dotfiles checkout. |
1 participant
Pin the Vercel skills CLI so dotagents does not resolve the unrelated skills-cli package. Remove eight retired mattpocock skill entries and refresh the lockfile. Verified make skills-install and make sync.
Summary by cubic
Pin the Vercel skills CLI to
skills@1.5.20to prevent resolving the unrelatedskills-cli. UpdatedSKILLS.txtto keep only currently publishedmattpocock/skills.bun x --package skills@1.5.20 skills ....mattpocock/skillsentries: batch-grill-me, design-an-interface, edit-article, obsidian-vault, qa, request-refactor-plan, ubiquitous-language, writing-great-skills.Written for commit 4801b87. Summary will update on new commits.