A small ops suggestion for the .claude/skills directory here, particularly the byoa pair.
byoa-deploy-vercel and byoa-link are skills that outside users run against their own Vercel/Supabase accounts — they curl, chmod, copy files, and read .env.byoa / .env.supabase. All intentional, but it makes those skills security-sensitive surface: a PR that adds a new shell command, outbound URL, or env-file read to one of them looks exactly like a prose edit in git diff. (All 7 skills in the repo contain shell commands; none declare allowed-tools — normal, the format barely supports it. Ecosystem-wide it's 38.8% vs 4%: data from a ~17,000-skill scan.)
Prior art in case it's useful: skil-lock (Apache-2.0) parses each SKILL.md + bundled scripts into a deterministic capability set, commits it as skills.lock, and a GitHub Action blocks PRs whose behavior surface drifts from the approved baseline — so a change to what byoa-deploy-vercel can do becomes an explicit, reviewable delta instead of a markdown diff. Spec: SPEC.md.
Happy to answer questions; if it's not relevant to how you maintain the skills, feel free to close.
A small ops suggestion for the
.claude/skillsdirectory here, particularly the byoa pair.byoa-deploy-vercelandbyoa-linkare skills that outside users run against their own Vercel/Supabase accounts — theycurl,chmod, copy files, and read.env.byoa/.env.supabase. All intentional, but it makes those skills security-sensitive surface: a PR that adds a new shell command, outbound URL, or env-file read to one of them looks exactly like a prose edit ingit diff. (All 7 skills in the repo contain shell commands; none declareallowed-tools— normal, the format barely supports it. Ecosystem-wide it's 38.8% vs 4%: data from a ~17,000-skill scan.)Prior art in case it's useful: skil-lock (Apache-2.0) parses each SKILL.md + bundled scripts into a deterministic capability set, commits it as
skills.lock, and a GitHub Action blocks PRs whose behavior surface drifts from the approved baseline — so a change to whatbyoa-deploy-vercelcan do becomes an explicit, reviewable delta instead of a markdown diff. Spec: SPEC.md.Happy to answer questions; if it's not relevant to how you maintain the skills, feel free to close.