feat: add instructree skill - #1251
Conversation
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: d310a23eb0
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| If neither is available, explain that the next command downloads executable package code and ask for approval before running the pinned release: | ||
|
|
||
| ```bash | ||
| npx github:kotobuki09/instructree#v0.7.0 scan . |
There was a problem hiding this comment.
When no local binary exists, this command makes npx download and execute whatever object the v0.7.0 ref resolves to at invocation time. The installed npm package-spec documentation defines #ref as “a git tag, branch, or other git ref,” so this is not the immutable pin the surrounding guidance claims; if the upstream tag is moved or compromised, users can execute code other than the reviewed 364dddc66badac13a284b79f0dc71f2b4362f6de. Use that full commit SHA in the package spec instead.
AGENTS.md reference: AGENTS.md:L52-L54
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
Fixed in 100fa3a: the executable fallback now pins the reviewed v0.7.0 commit (364dddc66badac13a284b79f0dc71f2b4362f6de) instead of the movable tag. I also applied the same immutable pin to the canonical skill source.
1 participant
Pull Request Description
Adds the
instructreecommunity skill for mapping and linting repository-scoped coding-agent instructions before an agent changes code.The contribution is pinned to the MIT-licensed Instructree v0.7.0 release, credits the source repository, and keeps generated catalogs and plugin mirrors out of the source PR.
This fills a different role from the existing instruction-authoring skills: it inventories and explains
AGENTS.md,CLAUDE.md, Copilot instructions and recursive imports, Agent Skills, custom agents, Cursor rules, and Windsurf rules. The audit is local and read-only, and its limitations avoid claiming universal client precedence.Change Classification
Issue Link (Optional)
Not applicable.
Quality Bar Checklist ✅
docs/contributors/quality-bar.mdanddocs/contributors/security-guardrails.md.SKILL.mdfrontmatter is valid (checked withnpm run validate).risk: safe; the default audit is read-only and the executable fallback requires approval.## Limitationssection.npm run security:docspassed with the bundled Python runtime selected explicitly.risk: safeclassification.npm run validate:referencespassed.kotobuki09/instructreeunder Community Contributors.Validation
npm run chain— passed for 2,029 skillsnpm run check:warning-budget— 0/0npm run check:readme-credits -- --base origin/main --head HEAD— passednpm run validate:references— passednpm run security:docs— passed withPYTHONset to the bundled Python 3.12 runtimenpm run pr:evidence ...— non-blocking; zero audit errors/warnings, zero security flags, mode100644git diff --cached --check— passed before commitThe complete local test runner reaches four pre-existing Windows host-contract failures involving POSIX
0600mode assertions, symlink privileges, and ACL behavior. This PR changes only Markdown source files; the hosted Linux checks remain the authoritative full-suite gate.Screenshots (if applicable)
Not applicable.