Activity

1. github-actions commented on Nov 4, 2026

   

   github-actionsBot

   on Nov 4, 2026 – with GitHub Actions

   More actions

   Follow-through report — skillspec doctor

   SkillSpec Doctor shape gate

   Target: github.com/harryvondiesel-web/5-persona-advisory-board

   Shape: simple_skill

   • Skill files: 1
   • Plugin roots: 0
   • Decision: Run full single-skill Doctor assessment.

   Shape-specific handling

   This is one atomic skill package. The public report can score this package directly.

   Next

   A full Doctor report follows this shape gate in the workflow artifacts and issue comment.

   ---

   SkillSpec Doctor report

   Target: github.com/harryvondiesel-web/5-persona-advisory-board

   Shape: simple_skill - one atomic SKILL.md package; detailed doctor analysis can run

   Status: full

   Primary skill: SKILL.md

   What This Measures

   Doctor estimates how likely an agent is to miss, reorder, improvise, use the wrong surface, or finish without proof because of the current skill shape.

   Assessment scope: one atomic SKILL.md package; the score describes this package directly

   Risk interpretation: A high score means this raw package should be ported before install or runtime reliance.

   This is a baseline of the current skill shape at doctor time. It is not a grade of domain knowledge, human usefulness, author effort, or legal/medical correctness.

   Higher risk means a higher chance the agent skips, reorders, or improvises load-bearing instructions.

   Current Skill Baseline

   • Verdict: critical reliability debt
   • Follow-through readiness: very low
   • Agent follow-through risk: critical (100/100, single-skill drift)
   • Discovery risk: low (0/100)
   • Raw activation load risk: critical (100/100 before contract mitigation)

   Shape Contract

   • Kind: simple_skill
   • Kind handling: one atomic package; use the single-skill import, review, compile, dry-run, and install path
   • Analysis status: full
   • Skill files: 1
   • Packages: 1
   • Namespaces: 0
   • Plugin roots: 0
   • Primary skill: SKILL.md

   Next command

   /skillspec import github.com/harryvondiesel-web/5-persona-advisory-board/, compile it for <target>, install it, and prove it
   

   Surface

   • Activation body: 316 line(s), 10718 byte(s), approximately 2680 token(s)
   • Deferred resources: 9 file(s), 20571 byte(s)
   • Frontmatter: 7 line(s), 221 byte(s)
   • Activation-loaded surface: 34%
   • Unmapped package files: 0
   • Instruction signals: 16 modal obligation(s), 4 late obligation(s), 1 numbered step(s), 1 dependency mention(s)
   • Code in active skill: 2 block(s), 0 unlabeled

   Findings

   1. HIGH: Dense load-bearing prose

   Location: github.com/harryvondiesel-web/5-persona-advisory-board/SKILL.md

   Evidence: Found 16 modal obligation spans and 1 numbered steps in the activation body.

   Basis: reliability_gap_instruction_density, contract_trace_activation_adherence_enforcement

   Fix: Promote route choices, forbids, elicitations, dependencies, and tests into skill.spec.yml so they can be checked instead of remembered.

   2. HIGH: Operational prose lacks a structured execution contract

   Location: github.com/harryvondiesel-web/5-persona-advisory-board/SKILL.md

   Evidence: The activation body tells the model to use/run/create/fetch/click/install or similar, but there is no SkillSpec route, tool boundary, command template, or trace vocabulary.

   Basis: contract_trace_activation_adherence_enforcement, contract_trace_unproven_verdict

   Fix: Add a SkillSpec contract with routes, phase tool boundaries, commands, scenario tests, and trace requirements.

   3. HIGH: Dependencies are implicit

   Location: github.com/harryvondiesel-web/5-persona-advisory-board/

   Evidence: Detected 1 dependency mention(s), 0 code file(s), 0 manifest file(s), and 2 code block(s), but no deps.toml ledger.

   Basis: reliability_gap_implicit_environment_contract

   Fix: Create deps.toml and preserve dependency authority, local status, install risk, and degraded proof impact before proof or install.

   4. HIGH: No machine-checkable behavior contract

   Location: github.com/harryvondiesel-web/5-persona-advisory-board/

   Evidence: No skill.spec.yml was found, so route choices, forbids, tool boundaries, dependency checks, scenario tests, and trace expectations are not falsifiable.

   Basis: reliability_gap_unfilled_requirement, contract_trace_behavioral_contract

   Fix: Run skillspec source map, then skillspec import-skill, and complete the generated contract before install or proof.

   5. MEDIUM: Late load-bearing instructions are exposed to primacy bias

   Location: github.com/harryvondiesel-web/5-persona-advisory-board/SKILL.md

   Evidence: 4 modal obligation span(s) appear after the first 60% of the activation body.

   Basis: reliability_gap_instruction_density

   Fix: Move late obligations into earlier route/rule summaries or structured checks; do not rely on a model remembering buried instructions.

   6. MEDIUM: Code is mixed into the activation instruction body

   Location: github.com/harryvondiesel-web/5-persona-advisory-board/SKILL.md

   Evidence: Found 2 fenced code block(s) in SKILL.md, accounting for about 15% of activation bytes.

   Basis: reliability_gap_no_execution_guarantees, contract_trace_static_well_formedness

   Fix: Move executable code into scripts/resources or structured code entries and state whether snippets are executable, examples, or reference material.

   7. MEDIUM: Runtime success would be unproven

   Location: github.com/harryvondiesel-web/5-persona-advisory-board/

   Evidence: No trace/progress/test surface was found, so a successful run would not prove which obligations actually executed.

   Basis: contract_trace_unproven_verdict

   Fix: Add scenario tests and trace/progress requirements; report unproven when evidence is absent instead of treating no error as success.

   Next Actions

   Recommended next action

   /skillspec import github.com/harryvondiesel-web/5-persona-advisory-board/, compile it for <target>, install it, and prove it
   

   • Capture this baseline before changing the skill: skillspec doctor github.com/harryvondiesel-web/5-persona-advisory-board/ --markdown > .skillspec/reports/skillspec-doctor-baseline.md.
   • Install the skillspec skill into your harness if it is not already installed.
   • From the harness, ask /skillspec import github.com/harryvondiesel-web/5-persona-advisory-board/, compile it for <target>, verify it, test it, and prove it. Print the alignment summary.
   • Read the alignment summary before trusting the port: decision replay should pass, required steps should be proven, missing proof should be explicit, and forbidden actions should show no violations.
   • Optionally publish the baseline doctor report, generated skill.spec.yml, compiled loader, and alignment report with the source repo or PR.
   • Restart the harness after install, then try the SkillSpec-backed skill normally on a real task.
   • For a CLI-only port, run skillspec source map github.com/harryvondiesel-web/5-persona-advisory-board/ --out <draft-dir>/.skillspec/source-map, then skillspec import-skill github.com/harryvondiesel-web/5-persona-advisory-board/ --out <draft-dir>/skill.spec.yml --source-map <draft-dir>/.skillspec/source-map/source-map.json.
   • Create or complete deps.toml; preserve dependency authority, local status, install risk, and degraded proof impact.
   • Promote operational prose into routes, rules, forbids, command templates, scenario tests, and trace/progress proof obligations.

   Research Basis

   17 cited basis item(s) are attached to this report.

   • reliability_gap_instruction_density - Large, dense activation bodies increase dropped-step risk and later instructions suffer primacy bias. (SkillSpec Skills Reliability Gap)
   • reliability_gap_metadata_context_pressure - Skill frontmatter metadata and activated bodies consume context; broad surfaces degrade routing and adherence. (SkillSpec Skills Reliability Gap)
   • reliability_gap_implicit_environment_contract - Scripts and snippets carry dependency contracts whether or not the skill declares them. (SkillSpec Skills Reliability Gap)
   • reliability_gap_no_execution_guarantees - Prose instructions and embedded snippets are guidance unless moved into checkable or enforced surfaces. (SkillSpec Skills Reliability Gap)
   • reliability_gap_unfilled_requirement - Reliable skills need a portable, machine-checkable account of intended behavior, dependencies, and proof. (SkillSpec Skills Reliability Gap)
   • contract_trace_activation_adherence_enforcement - Activation, adherence, and enforcement are separate gates; static prose mostly influences adherence, not enforcement. (SkillSpec Contract Trace Methodology)
   • 11 more basis item(s) omitted. Use --json for the full basis registry.

   Use --html for a shareable review page or --json for machine evidence.

   Full artifacts: https://github.com/modiqo/skillspec/actions/runs/41768962335/artifacts/13294126679

   The artifact contains: doctor-report.txt, doctor-report.md, doctor-report.html, doctor-report.json, shape-gate.md, shape-gate.json, source-stage.json, target.txt.
2. github-actions commented on Nov 4, 2026

   

   github-actionsBot

   on Nov 4, 2026 – with GitHub Actions

   More actions

   Security analysis — what each skill can reach

   0 critical · 0 high · 1 medium · 0 low · 0 clean across 1 skill(s).
   1 skill(s) reach beyond their own directory and warrant review before install.

   Findings to review

   MEDIUM — .

   • 🟠 agent-directing instruction: the agent could be steered away from what you asked. — SKILL.md:300

   What to do next

   1. Check and decide. Review the findings above, or re-run the analysis yourself:

   skillspec boundary assess https://github.com/harryvondiesel-web/5-persona-advisory-board

   2. Install safely through the gate. Assess, then install only on your approval — across harnesses (Claude, Codex, or any AGENTS.md/SKILL.md skills dir):

   skillspec pull https://github.com/harryvondiesel-web/5-persona-advisory-board

   3. Guard your harness. Compile a deny-by-default policy from the surface and enforce it on every tool call, so an unreviewed effect is blocked:

   skillspec boundary emit <skill> --format skillspec   # least-privilege policy
   skillspec boundary guard install                     # managed PreToolUse hook (observe mode)
   skillspec boundary guard mode enforce                # deny effects no policy covers

   Static analysis only — nothing in the package was executed. See the boundary guide.

   Full analysis artifacts: https://github.com/modiqo/skillspec/actions/runs/41768962335/artifacts/13294126679

   The artifact contains: boundary-report.md, boundary-assess.txt, boundary-assess.json.