Activity

1. conikeec

   added

   doctor-reportPublic SkillSpec doctor report requestPublic SkillSpec doctor report request

   on Jul 28, 2026
2. github-actions commented on Jul 28, 2026

   

   github-actionsBot

   on Jul 28, 2026 – with GitHub Actions

   More actions

   SkillSpec Doctor shape gate

   Target: github.com/ericosiu/ai-marketing-skills/.../sales-pipeline

   Shape: simple_skill

   • Skill files: 1
   • Plugin roots: 0
   • Decision: Run full single-skill Doctor assessment.

   Shape-specific handling

   This is one atomic skill package. The public report can score this package directly.

   Next

   A full Doctor report follows this shape gate in the workflow artifacts and issue comment.

   ---

   SkillSpec Doctor report

   Target: github.com/ericosiu/ai-marketing-skills/.../sales-pipeline

   Shape: simple_skill - one atomic SKILL.md package; detailed doctor analysis can run

   Status: full

   Primary skill: SKILL.md

   What This Measures

   Doctor estimates how likely an agent is to miss, reorder, improvise, use the wrong surface, or finish without proof because of the current skill shape.

   Assessment scope: one atomic SKILL.md package; the score describes this package directly

   Risk interpretation: A high score means this raw package should be ported before install or runtime reliance.

   This is a baseline of the current skill shape at doctor time. It is not a grade of domain knowledge, human usefulness, author effort, or legal/medical correctness.

   Higher risk means a higher chance the agent skips, reorders, or improvises load-bearing instructions.

   Current Skill Baseline

   • Verdict: critical reliability debt
   • Follow-through readiness: very low
   • Agent follow-through risk: critical (100/100, single-skill drift)
   • Discovery risk: low (24/100)
   • Raw activation load risk: critical (100/100 before contract mitigation)

   Shape Contract

   • Kind: simple_skill
   • Kind handling: one atomic package; use the single-skill import, review, compile, dry-run, and install path
   • Analysis status: full
   • Skill files: 1
   • Packages: 1
   • Namespaces: 0
   • Plugin roots: 0
   • Primary skill: SKILL.md

   Next command

   /skillspec import github.com/ericosiu/ai-marketing-skills/.../sales-pipeline/, compile it for <target>, install it, and prove it
   

   Surface

   • Activation body: 80 line(s), 3607 byte(s), approximately 902 token(s)
   • Deferred resources: 10 file(s), 115020 byte(s)
   • Frontmatter: 0 line(s), 0 byte(s)
   • Activation-loaded surface: 3%
   • Unmapped package files: 9
   • Instruction signals: 4 modal obligation(s), 2 late obligation(s), 0 numbered step(s), 5 dependency mention(s)
   • Code in active skill: 2 block(s), 1 unlabeled

   Findings

   1. CRITICAL: Frontmatter is missing or malformed

   Location: github.com/ericosiu/ai-marketing-skills/.../sales-pipeline/SKILL.md

   Evidence: Skill frontmatter is missing, malformed, or lacks a usable description.

   Basis: claude_skill_frontmatter_discovery, skilldex_format_conformance, skill_metadata_supply_chain

   Fix: Fix YAML frontmatter and provide a specific description with the main use case first.

   2. HIGH: Operational prose lacks a structured execution contract

   Location: github.com/ericosiu/ai-marketing-skills/.../sales-pipeline/SKILL.md

   Evidence: The activation body tells the model to use/run/create/fetch/click/install or similar, but there is no SkillSpec route, tool boundary, command template, or trace vocabulary.

   Basis: contract_trace_activation_adherence_enforcement, contract_trace_unproven_verdict

   Fix: Add a SkillSpec contract with routes, phase tool boundaries, commands, scenario tests, and trace requirements.

   3. HIGH: Dependencies are implicit

   Location: github.com/ericosiu/ai-marketing-skills/.../sales-pipeline/

   Evidence: Detected 5 dependency mention(s), 6 code file(s), 1 manifest file(s), and 2 code block(s), but no deps.toml ledger.

   Basis: reliability_gap_implicit_environment_contract

   Fix: Create deps.toml and preserve dependency authority, local status, install risk, and degraded proof impact before proof or install.

   4. HIGH: No machine-checkable behavior contract

   Location: github.com/ericosiu/ai-marketing-skills/.../sales-pipeline/

   Evidence: No skill.spec.yml was found, so route choices, forbids, tool boundaries, dependency checks, scenario tests, and trace expectations are not falsifiable.

   Basis: reliability_gap_unfilled_requirement, contract_trace_behavioral_contract

   Fix: Run skillspec source map, then skillspec import-skill, and complete the generated contract before install or proof.

   5. MEDIUM: Late load-bearing instructions are exposed to primacy bias

   Location: github.com/ericosiu/ai-marketing-skills/.../sales-pipeline/SKILL.md

   Evidence: 2 modal obligation span(s) appear after the first 60% of the activation body.

   Basis: reliability_gap_instruction_density

   Fix: Move late obligations into earlier route/rule summaries or structured checks; do not rely on a model remembering buried instructions.

   6. MEDIUM: Code is mixed into the activation instruction body

   Location: github.com/ericosiu/ai-marketing-skills/.../sales-pipeline/SKILL.md

   Evidence: Found 2 fenced code block(s) in SKILL.md, accounting for about 15% of activation bytes.

   Basis: reliability_gap_no_execution_guarantees, contract_trace_static_well_formedness

   Fix: Move executable code into scripts/resources or structured code entries and state whether snippets are executable, examples, or reference material.

   7. MEDIUM: Code fence language is ambiguous

   Location: github.com/ericosiu/ai-marketing-skills/.../sales-pipeline/SKILL.md

   Evidence: 1 code fence(s) in SKILL.md omit a language label.

   Basis: reliability_gap_no_execution_guarantees

   Fix: Label code fences and classify each one as executable code, command example, or non-executable reference.

   8. MEDIUM: Package files are present but not clearly reachable

   Location: github.com/ericosiu/ai-marketing-skills/.../sales-pipeline/

   Evidence: 9 non-SKILL file(s) are present without an explicit local reference from Markdown.

   Basis: contract_trace_static_well_formedness

   Fix: Declare package-local files as imports, resources, code sources, artifacts, or dependency ledgers during SkillSpec porting.

   1 more finding(s) omitted. Use --json or --html for the full report.

   Next Actions

   Recommended next action

   /skillspec import github.com/ericosiu/ai-marketing-skills/.../sales-pipeline/, compile it for <target>, install it, and prove it
   

   • Capture this baseline before changing the skill: skillspec doctor github.com/ericosiu/ai-marketing-skills/.../sales-pipeline/ --markdown > .skillspec/reports/skillspec-doctor-baseline.md.
   • Install the skillspec skill into your harness if it is not already installed.
   • From the harness, ask /skillspec import github.com/ericosiu/ai-marketing-skills/.../sales-pipeline/, compile it for <target>, verify it, test it, and prove it. Print the alignment summary.
   • Read the alignment summary before trusting the port: decision replay should pass, required steps should be proven, missing proof should be explicit, and forbidden actions should show no violations.
   • Optionally publish the baseline doctor report, generated skill.spec.yml, compiled loader, and alignment report with the source repo or PR.
   • Restart the harness after install, then try the SkillSpec-backed skill normally on a real task.
   • For a CLI-only port, run skillspec source map github.com/ericosiu/ai-marketing-skills/.../sales-pipeline/ --out <draft-dir>/.skillspec/source-map, then skillspec import-skill github.com/ericosiu/ai-marketing-skills/.../sales-pipeline/ --out <draft-dir>/skill.spec.yml --source-map <draft-dir>/.skillspec/source-map/source-map.json.
   • Create or complete deps.toml; preserve dependency authority, local status, install risk, and degraded proof impact.
   • Promote operational prose into routes, rules, forbids, command templates, scenario tests, and trace/progress proof obligations.

   Research Basis

   17 cited basis item(s) are attached to this report.

   • reliability_gap_instruction_density - Large, dense activation bodies increase dropped-step risk and later instructions suffer primacy bias. (SkillSpec Skills Reliability Gap)
   • reliability_gap_metadata_context_pressure - Skill frontmatter metadata and activated bodies consume context; broad surfaces degrade routing and adherence. (SkillSpec Skills Reliability Gap)
   • reliability_gap_implicit_environment_contract - Scripts and snippets carry dependency contracts whether or not the skill declares them. (SkillSpec Skills Reliability Gap)
   • reliability_gap_no_execution_guarantees - Prose instructions and embedded snippets are guidance unless moved into checkable or enforced surfaces. (SkillSpec Skills Reliability Gap)
   • reliability_gap_unfilled_requirement - Reliable skills need a portable, machine-checkable account of intended behavior, dependencies, and proof. (SkillSpec Skills Reliability Gap)
   • contract_trace_activation_adherence_enforcement - Activation, adherence, and enforcement are separate gates; static prose mostly influences adherence, not enforcement. (SkillSpec Contract Trace Methodology)
   • 11 more basis item(s) omitted. Use --json for the full basis registry.

   Use --html for a shareable review page or --json for machine evidence.

   Security analysis — what each skill can reach

   0 critical · 1 high · 0 medium · 0 low · 0 clean across 1 skill(s).
   1 skill(s) reach beyond their own directory and warrant review before install.

   Findings to review

   HIGH — .

   • 🔴 reads a secret from the environment → BRAVE_API_KEY: can read a token or key held in the environment. — trigger_prospector.py:92
   • 🔴 reads a secret from the environment → HUBSPOT_API_KEY: can read a token or key held in the environment. — deal_resurrector.py:39
   • 🔴 reads a secret from the environment → INSTANTLY_API_KEY: can read a token or key held in the environment. — rb2b_instantly_router.py:40
   • 🟠 writes outside its directory → /dev/null: can modify files beyond the skill folder. — SKILL.md:7
   • 🟠 runs a command chosen at runtime: what it runs cannot be determined before it runs. — rb2b_instantly_router.py:190

   What to do next

   1. Check and decide. Review the findings above, or re-run the analysis yourself:

   skillspec boundary assess https://github.com/ericosiu/ai-marketing-skills/tree/main/sales-pipeline

   2. Install safely through the gate. Assess, then install only on your approval — across harnesses (Claude, Codex, or any AGENTS.md/SKILL.md skills dir):

   skillspec pull https://github.com/ericosiu/ai-marketing-skills/tree/main/sales-pipeline

   3. Guard your harness. Compile a deny-by-default policy from the surface and enforce it on every tool call, so an unreviewed effect is blocked:

   skillspec boundary emit <skill> --format skillspec   # least-privilege policy
   skillspec boundary guard install                     # managed PreToolUse hook (observe mode)
   skillspec boundary guard mode enforce                # deny effects no policy covers

   Static analysis only — nothing in the package was executed. See the boundary guide.

   Full artifacts: https://github.com/modiqo/skillspec/actions/runs/30386710857/artifacts/8699237190

   The artifact contains:

   • doctor-report.txt
   • doctor-report.md
   • doctor-report.html
   • doctor-report.json
   • shape-gate.md
   • shape-gate.json
   • source-stage.json
   • boundary-assess.txt
   • boundary-assess.json
   • boundary-report.md
   • target.txt