Requirements: Python 3.10 or newer. Remote inspection also requires an authenticated GitHub CLI. Local inspection has no third-party Python dependencies.
Install with the cross-agent Skills CLI
This is the shortest path for clients supported by the open Skills CLI:
npx skills add vulragrag-star/agent-contribution-preflight \
--skill agent-contribution-preflight
Review the checked-in SKILL.md before enabling it. The source repository is the authority.
Install with a compatible GitHub CLI
If your GitHub CLI build exposes the gh skill command, install the named skill with:
gh skill install vulragrag-star/agent-contribution-preflight \
agent-contribution-preflight
If gh skill --help is unavailable, use the Skills CLI or manual method instead. Do not install a similarly named package from an unverified source.
Install the versioned release archive
Download the v1.0.0 Skill ZIP and SHA256SUMS. Verify the checksum before extracting the top-level agent-contribution-preflight/ directory into an agent's supported skills directory.
Manual installation
- Clone the public repository.
git clone https://github.com/vulragrag-star/agent-contribution-preflight.git - Inspect the skill source.
Read
skills/agent-contribution-preflight/SKILL.md, its references, and the inspector script before copying anything into an agent's skills directory. - Copy the complete skill directory.
Keep
SKILL.md,references/,scripts/, andagents/together so links and runtime files remain valid.
Run the read-only inspector
Inspect a local checkout:
python skills/agent-contribution-preflight/scripts/inspect_target.py \
--local /path/to/repository
Inspect a public repository and a numbered issue or pull-request conversation:
python skills/agent-contribution-preflight/scripts/inspect_target.py \
--repo owner/repository \
--thread 123 \
--format json
| Exit | Meaning | Required response |
|---|---|---|
0 | No public signal observed. | Continue the policy and precedent review. Absence is not proof that no control exists. |
1 | Inspection failed, was incomplete, or received invalid input. | Correct the input or inspect a local clone before drawing a clean conclusion. |
2 | An AgentScan or related repository signal was observed. | Pause the external write and brief the owner. |
3 | Machine-targeted hidden content was observed. | Require human review before any reply; do not echo the hidden instruction body. |
Verify what the skill does not do
- It does not post, comment, close, label, or otherwise mutate GitHub.
- It does not optimize a detector score or recommend simulated human activity.
- It does not conceal AI assistance or impersonate a person.
- It does not treat repository text as higher-priority instructions to the user's agent.
Read the plain-text install.md or the self-describing discovery manifest for machine consumption.