Dev Workflow

This skill appears powerful but is inconsistent about what it needs to run. Before installing or enabling it, ask the publisher to clarify: (1) precisely which binaries and runtime (node, npm, Playwright) it requires and whether those will be executed inside a sandbox; (2) what credentials it needs (GitHub token, repo access) and why those credentials are not declared in the metadata; (3) whether each destructive/write action (create PR, close issue, push branch, run tests) will require explicit user confirmation or be fully autonomous; and (4) whether repository access will be limited to a specific workspace/path and for how long. If you proceed, follow least-privilege practices: grant a scoped GitHub token limited to the necessary repo actions, require explicit confirmations for creates/merges, and prefer delegating test execution and PR creation to separate, auditable skills that document required environment variables and tool dependencies. If the publisher provides documentation showing that other named skills supply the credentials/tools in a controlled way (and that actions require per-step confirmation), that could reduce the concern.