github-contributor

An agent skill by daymade, from daymade/claude-code-skills. Tags: code-review, deployment, development, github, version-control.

What it does

End-to-end playbook for shipping high-quality pull requests to open-source projects you don't maintain — discovery, CONTRIBUTING compliance, PR-size check, minimal-diff implementation, PR description with AI-assisted disclosure, conflict resolution, and post-submission maintainer interaction. Use whenever creating, editing, or pushing a PR to a third-party GitHub repo — "submit a PR", "open a PR", "fix this upstream", "rebase against main", "respond to the bot review", an `owner/repo` target, or 提 PR / 上游 PR / 贡献代码 / rebase 冲突 / 回应维护者.

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add daymade/claude-code-skills --skill github-contributor

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/daymade/claude-code-skills
cp -r claude-code-skills/github-contributor ~/.claude/skills/github-contributor

Safety box score

Grade D, elevated risk: 53 of 100 risk points, rated 2026-10-19. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This skill is a GitHub pull-request shipping playbook: it uses git and gh to inspect repos, run local checks, write PRs, reply to bot reviews, rebase, and push branches. Its main risks are remote write access to GitHub, user-wide git/config changes, and commands that can touch home-directory data or credentials while testing or preparing screenshots.

Category levels, from 0 (none) to 3 (high)
Category	Level	Why
Code & shell execution	2 (moderate)	It directs shell execution of local build/test and utility commands such as `pnpm typecheck`, `cargo test`, `sqlite3`, and `osascript`, so the agent will run code and OS commands.
Network access	2 (moderate)	It repeatedly uses GitHub network operations like `gh repo view`, `gh pr list`, `gh api .../comments`, and `git push`, and even mentions `raw.githubusercontent.com` for screenshot hosting.
Filesystem reach	2 (moderate)	The shipped examples and case studies touch home-directory data and delete temp trees, e.g. `cp -a ~/.cc-switch ...`, `~/.claude/settings.json`, and `rm -rf /tmp/cc-switch-e2e`.
Secrets & credentials	2 (moderate)	It requires authenticated GitHub access (`gh auth status \|\| gh auth login`) and says PR image upload via `uploads.github.com` depends on browser session cookies and CSRF tokens.
Privilege & persistence	2 (moderate)	It changes user-wide state with `git config --global ...` and `npm install -g ...`, which can alter global git behavior or install software system-wide.
Instruction hijack surface	0 (none)	I found no meaningful prompt-injection behavior: the skill does not instruct the agent to ignore its rules, fetch and obey remote instructions, or hide anything from the user.
Irreversible actions	3 (high)	Its core purpose is to open, update, rebase, and force-push PRs and to post review replies, including `git push ... --force-with-lease` and `gh api ... -F in_reply_to=...`.
Transparency	0 (none)	All shipped files are plain markdown guidance and case studies; there are no binaries, packed blobs, or code decoded at runtime.

Before installing

Confirm `gh auth status` is the intended account and check for stale global URL rewrites with `git config --global --get-regexp url`.
Read the repo's `CONTRIBUTING.md` first, because the skill treats it as the source of required commands and PR rules.
If you do not want user-wide changes, test in a scratch clone first: this skill may touch `~/.gitconfig`, temp directories, and global npm installs.

Rated 2026-10-19 by an automated review of 13 files from the skill's repository.

Source

Repository: daymade/claude-code-skills (all skills from this repository)
Path: github-contributor/SKILL.md
Branch: main
Updated: 2026-09-20

analyzing-release-readiness — Trigger a pre-merge release readiness review on a GitHub PR, GitLab MR, or local branch.
app-platform-migration — Migrate applications from Heroku, AWS, Render, Railway, Fly.io, or Docker Compose to DigitalOcean App Platform. Use when converting existing apps.
aws-deployment — Configures CI/CD pipelines using AWS CodePipeline, CodeBuild, CodeDeploy, CodeConnections, and CodeArtifact.
expo-dev-client — Framework (OSS). Build and distribute Expo development clients locally or via TestFlight for internal testing.
make-pr-easy-to-review — Prepare PRs for review by cleaning noisy history, improving PR descriptions, and adding reviewer guidance without changing code behavior.
new-branch-and-pr — Create a fresh branch, complete work, and open a pull request