Skip to content

Update SKILLS.txt #90

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
shunkakinoki merged 1 commit into from
Mar 14, 2026
Merged

Update SKILLS.txt #90

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions SKILLS.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,6 +10,7 @@ googleworkspace/cli
inference-sh/skills
obra/superpowers
PaulRBerg/agent-skills
max-sixty/worktrunk

@coderabbitai coderabbitai Bot Mar 14, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🌐 Web query:

Official docs for the skillsCLI: doesskills add support pinning a repository to a tag/commit/SHA (e.g., owner/repo@ref), and what are the recommended security practices for installing third-party skills globally?

💡 Result:

Does skills add support pinning to a tag/commit/SHA (e.g., owner/repo@ref)?

The official skills CLI docs/README do not document an owner/repo@ref syntax for Git refs. The supported “source formats” are owner/repo, full GitHub/GitLab/git URLs, a direct GitHub “tree/…” path, and local paths. [1]

Recommended way to pin anyway: use a GitHub URL that includes the ref in the path, e.g. .../tree/<ref>/... (the README shows tree/main/...; you can replace main with a tag name or a commit SHA on GitHub). [1]

Recommended security practices for installing third-party skills globally

From the official docs:

  • Prefer running the CLI via npx (no global install required). [2]
  • Use the published Security Audits view as a screening signal. [3]
  • Review skills before installing; Vercel notes they can’t guarantee every listed skill is safe and explicitly encourages review and judgment. [4]
  • Be cautious with --global installs (they’re available across all projects); the README documents global scope and that symlinking is the recommended install method. [1]

Sources:
[1] vercel-labs/skills README (source formats, --global, symlink recommendation) (github.com)
[2] Skills CLI docs (npx skills add …, “no installation required”) (skills.sh)
[3] skills.sh Security Audits page (skills.sh)
[4] skills.sh docs (“How are you securing skills?”, “review skills before installing”) (skills.sh)

Citations:

Unpinned third-party skill source violates security guidance and introduces supply-chain risk.

Adding max-sixty/worktrunk without an immutable reference exposes the build to unexpected changes. The skills CLI official documentation recommends reviewing every skill before installation and emphasizes that Vercel cannot guarantee each listed skill is safe. This entry is installed globally via Makefile:88-100 (bunx skills add ... --global --yes) with no validation or review step in Makefile:26-33.

Use a pinned GitHub URL (e.g., https://github.com/max-sixty/worktrunk/tree/<commit-sha> or https://github.com/max-sixty/worktrunk/tree/<tag>) instead, add a code review requirement for any new entries in SKILLS.txt, and consider whether the --global --yes automation aligns with your organization's security posture.

🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In `@SKILLS.txt` at line 13, Replace the unpinned skill entry
"max-sixty/worktrunk" in SKILLS.txt with an immutable GitHub URL that includes a
commit SHA or tag (e.g.,
https://github.com/max-sixty/worktrunk/tree/<commit-sha> or /tree/<tag>), update
the Makefile automation (the target that runs `bunx skills add ... --global
--yes`) to stop auto-installing unreviewed skills globally—either require a
pinned URL parameter or remove `--global --yes` and add an explicit confirmation
step—and add a repository policy/check (e.g., CI or CONTRIBUTING note) that
requires a code review for any changes to SKILLS.txt before merging.

nextlevelbuilder/ui-ux-pro-max-skill
remotion-dev/skills
schpet/linear-cli
Expand Down
Loading