Update SKILLS.txt

[shunkakinoki]

Summary by cubic

Added max-sixty/worktrunk to SKILLS.txt to include this repository in the skills registry.

^{Written for commit bef2236. Summary will update on new commits.}

[coderabbitai]

📝 Walkthrough

Summary by CodeRabbit

• Chores
  • Updated internal skill registry with a new entry to reflect expanded capabilities.

Walkthrough

A single entry "max-sixty/worktrunk" is added to SKILLS.txt, expanding the list of skills without any deletions or modifications to existing content.

Changes

Cohort / File(s)	Summary
Skills List Update SKILLS.txt	Added new entry max-sixty/worktrunk to the skills list.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

Suggested labels

enhancement

Poem

🐰 A new skill hops into view,
max-sixty/worktrunk joins the crew,
One line added, shiny and bright,
The list grows longer, oh what delight!
Progress marches on, skills stack high,
Reaching for goals that touch the sky! 🌟

🚥 Pre-merge checks | ✅ 2 | ❌ 1

❌ Failed checks (1 inconclusive)

Check name	Status	Explanation	Resolution
Title check	❓ Inconclusive	The title 'Update SKILLS.txt' is vague and generic, using a non-descriptive verb that doesn't convey the specific nature of the change.	Consider a more specific title like 'Add max-sixty/worktrunk to SKILLS.txt' that clarifies what was added or changed.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Description check	✅ Passed	The description clearly explains that 'max-sixty/worktrunk' was added to SKILLS.txt to include the repository in the skills registry, which directly relates to the changeset.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch shunkakinoki-patch-1

📝 Coding Plan

• Generate coding plan for human review comments

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[cubic-dev-ai]

No issues found across 1 file

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@SKILLS.txt`:
- Line 13: Replace the unpinned skill entry "max-sixty/worktrunk" in SKILLS.txt
with an immutable GitHub URL that includes a commit SHA or tag (e.g.,
https://github.com/max-sixty/worktrunk/tree/<commit-sha> or /tree/<tag>), update
the Makefile automation (the target that runs `bunx skills add ... --global
--yes`) to stop auto-installing unreviewed skills globally—either require a
pinned URL parameter or remove `--global --yes` and add an explicit confirmation
step—and add a repository policy/check (e.g., CI or CONTRIBUTING note) that
requires a code review for any changes to SKILLS.txt before merging.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 69d60dff-80cb-4d90-854a-ee7de894eae6

📥 Commits

Reviewing files that changed from the base of the PR and between a1212ea and bef2236.

📒 Files selected for processing (1)

• SKILLS.txt

[coderabbitai]

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🌐 Web query:

Official docs for the skillsCLI: doesskills add support pinning a repository to a tag/commit/SHA (e.g., owner/repo@ref), and what are the recommended security practices for installing third-party skills globally?

💡 Result:

Does skills add support pinning to a tag/commit/SHA (e.g., owner/repo@ref)?

The official skills CLI docs/README do not document an owner/repo@ref syntax for Git refs. The supported “source formats” are owner/repo, full GitHub/GitLab/git URLs, a direct GitHub “tree/…” path, and local paths. [1]

Recommended way to pin anyway: use a GitHub URL that includes the ref in the path, e.g. .../tree/<ref>/... (the README shows tree/main/...; you can replace main with a tag name or a commit SHA on GitHub). [1]

Recommended security practices for installing third-party skills globally

From the official docs:

• Prefer running the CLI via npx (no global install required). [2]
• Use the published Security Audits view as a screening signal. [3]
• Review skills before installing; Vercel notes they can’t guarantee every listed skill is safe and explicitly encourages review and judgment. [4]
• Be cautious with --global installs (they’re available across all projects); the README documents global scope and that symlinking is the recommended install method. [1]

Sources:
[1] vercel-labs/skills README (source formats, --global, symlink recommendation) (github.com)
[2] Skills CLI docs (npx skills add …, “no installation required”) (skills.sh)
[3] skills.sh Security Audits page (skills.sh)
[4] skills.sh docs (“How are you securing skills?”, “review skills before installing”) (skills.sh)

Citations:

• 1: https://github.com/vercel-labs/skills
• 2: https://skills.sh/docs/cli
• 3: https://skills.sh/audits
• 4: https://skills.sh/docs

---

Unpinned third-party skill source violates security guidance and introduces supply-chain risk.

Adding max-sixty/worktrunk without an immutable reference exposes the build to unexpected changes. The skills CLI official documentation recommends reviewing every skill before installation and emphasizes that Vercel cannot guarantee each listed skill is safe. This entry is installed globally via Makefile:88-100 (bunx skills add ... --global --yes) with no validation or review step in Makefile:26-33.

Use a pinned GitHub URL (e.g., https://github.com/max-sixty/worktrunk/tree/<commit-sha> or https://github.com/max-sixty/worktrunk/tree/<tag>) instead, add a code review requirement for any new entries in SKILLS.txt, and consider whether the --global --yes automation aligns with your organization's security posture.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@SKILLS.txt` at line 13, Replace the unpinned skill entry
"max-sixty/worktrunk" in SKILLS.txt with an immutable GitHub URL that includes a
commit SHA or tag (e.g.,
https://github.com/max-sixty/worktrunk/tree/<commit-sha> or /tree/<tag>), update
the Makefile automation (the target that runs `bunx skills add ... --global
--yes`) to stop auto-installing unreviewed skills globally—either require a
pinned URL parameter or remove `--global --yes` and add an explicit confirmation
step—and add a repository policy/check (e.g., CI or CONTRIBUTING note) that
requires a code review for any changes to SKILLS.txt before merging.

[Copilot]

Pull request overview

Adds a new skills repository entry to the skills list.

Changes:

• Added max-sixty/worktrunk to SKILLS.txt.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.