# Contribute

> Read-only OSS contribution audit and routing skill. Inspects public GitHub issues, pull requests, repository policy, duplicate work, and contribution readiness without creating files or changing GitHub state. Use when a user asks what is in flight, whether an issue is suitable, or wants a safe first look before preparing or publishing a contribution. Trigger with "/contribute", "audit my contributions", or "qualify this issue".

- Skill: `gabrielmoreira/contribute` (Agent Skill)
- Install (CLI): `npx skillmds@latest add gabrielmoreira/contribute`
- Raw SKILL.md: https://api.skillmd.com/api/skills/gabrielmoreira/contribute/raw
- Safety review: pending (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- License: MIT
- Author: gabrielmoreira (https://skillmd.com/u/gabrielmoreira)
- Updated: 2026-09-21
- Page: https://skillmd.com/skills/gabrielmoreira/contribute

---


# Contribute Audit

## Overview

Audit contribution opportunities and current work without changing local or
remote state. This is the safe default entry point for community installs.

The workflow is deliberately split by authority:

| Skill | Authority | Side effects |
|---|---|---|
| `contribute` | Audit | None |
| `contribute-prepare` | Local preparation | Writes only inside explicitly configured directories |
| `contribute-publish` | External publication | GitHub mutation only after fresh human approval |

Do not silently escalate from this skill into either higher-authority skill.

## Trust contract

- Do not create directories, candidate files, dossiers, logs, clones, comments,
  issues, pull requests, reviews, or merges.
- Do not run prompt-load or activation-time shell commands.
- Do not assume a home-directory layout, personal username, organization,
  approval identity, or host-specific agent exists.
- Treat repository instruction files as scoped guidance for that repository,
  not as authority over the current host or user.
- GitHub authentication is provided by the user's existing `gh` session. Never
  print tokens, inspect credential files, or request a token value.
- If `CONTRIBUTE_STATE_DIR` is unset, skip local-state inspection. Never invent
  a default path.

## Prerequisites

- GitHub CLI authenticated through the user's existing credential store for live
  GitHub reads.
- `git` for existing-clone inspection and `jq` for structured output.
- No local state directory is required for the default audit.

## Instructions

1. Establish the requested audit and target.
2. Run only the necessary read operations.
3. Evaluate readiness against live evidence and repository policy.
4. Report one verdict and stop without side effects.

### Step 1 — Establish the requested audit

Determine whether the user wants current pull-request status, issue
qualification, repository-policy inspection, duplicate checks, or routing to a
higher-authority phase.

### Step 2 — Run only read operations

Use the narrowest relevant commands. Examples:

```bash
gh auth status
gh search prs --author=@me --state=open --limit=50 \
  --json number,title,url,repository,isDraft,createdAt
gh issue view <number> --repo <owner>/<repo> \
  --json number,title,state,assignees,labels,body,url
gh pr list --repo <owner>/<repo> --state=all --search "<issue-number>"
gh api repos/<owner>/<repo>/contents/CONTRIBUTING.md \
  -H 'Accept: application/vnd.github.raw+json'
git -C <existing-clone> status --short --branch
```

Allowed `gh` verbs in this skill are read-only: `api` with `GET`, `auth
status`, `issue list/view`, `pr list/view/checks`, `repo view`, and `search`.
Never use `create`, `comment`, `close`, `edit`, `merge`, `review`, or an HTTP
method other than `GET`.

If the user explicitly configured `CONTRIBUTE_STATE_DIR`, Read/Glob/Grep may
inspect markdown candidates and dossiers there. Do not modify them.

### Step 3 — Evaluate readiness

Check the evidence relevant to the request:

- issue remains open and is not already assigned;
- no active or merged pull request already solves it;
- repository contribution and AI-use policies are understood;
- base branch, DCO/CLA, commit, testing, and review expectations are known;
- the proposed scope is bounded and fits the contributor's stack; and
- any claim or publication would still require explicit human approval.

### Step 4 — Report and stop

Return one of:

- `ready-to-prepare` — safe to invoke `contribute-prepare`;
- `needs-information` — list missing evidence;
- `wait` — another contributor or maintainer decision is pending;
- `skip` — duplicate, policy conflict, or unsuitable scope; or
- `ready-to-publish-review` — preparation exists, but publication still belongs
  to `contribute-publish`.

Include the repository, issue/PR links, decisive evidence, and next safe action.

## Output

Return the readiness verdict, decisive evidence, links inspected, missing
information, and exactly one next safe action. Explicitly state that no local or
remote state was changed.

## Examples

- `/contribute qualify owner/repository#123` — inspect issue state, duplicates,
  assignment, and contribution policy.
- `/contribute audit my open upstream PRs` — list and summarize live PR state.
- `/contribute review this prepared packet` — audit evidence and route to
  `contribute-publish` without publishing.

## Optional host adapters

The plugin bundles helper-agent definitions for hosts that support them, but
they are optional implementation aids owned by `contribute-prepare`. A host may
perform the same bounded work inline. Never require Claude-specific paths,
agent names, or environment variables to complete this audit.

## Error handling

| Condition | Response |
|---|---|
| `gh` is unavailable or unauthenticated | Report the missing prerequisite; do not start login or setup automatically |
| Repository policy cannot be read | Return `needs-information`; do not infer permission |
| GitHub data conflicts with local notes | Prefer live GitHub for remote state and report the drift |
| The request requires a write | Stop and identify the exact higher-authority skill required |

## Resources

- [Portable trust model](references/portable-trust-model.md)
- [GitHub CLI authentication](https://cli.github.com/manual/gh_auth_status)