Senior Dev

Production development workflow with TODO tracking, Graphite PRs, GitHub issues, Vercel deploy checks, and SMS notifications. Use when starting a new task, fixing bugs, implementing features, or any development work that needs tracked progress and code review.

Security Scan

The workflow instructions are mostly coherent for a developer, but there are mismatches between the skill's description/metadata and what the instructions actually require (missing declarations for CLIs, credentials, and an unexplained SMS capability), so caution is warranted.

Purpose & Capability

The name/description mention TODO tracking, Graphite PRs, GitHub issues, Vercel deploy checks, and SMS notifications. The SKILL.md covers TODOs, Graphite (gt), GitHub (gh), and Vercel (vl) workflows but contains no mention of SMS configuration or how SMS notifications are sent. Registry metadata claims no required binaries or credentials, yet the instructions clearly require external CLIs (gt, gh, vl) and authenticated accounts. These gaps are incoherent with the stated purpose.

Instruction Scope

The SKILL.md is an instruction-only workflow that stays within a development workflow: editing TODO.md/CHANGELOG.md, using git/gt/gh/vl, and creating GH issues for failed deploys. It does not instruct reading unrelated system files or exfiltrating data. However it assumes the presence and authenticated state of several CLIs and that creating issues may include posting logs (potentially sensitive) without guidance on sanitization.

Install Mechanism

No install spec or code is present (instruction-only), so nothing is written to disk by the skill itself. This is the lowest-risk install mechanism. The SKILL.md lists required tools but the registry metadata did not declare them as required binaries — an inconsistency but not an install risk.

Credentials

The skill declares no required environment variables or primary credential, but the workflow depends on GitHub (gh), Graphite (gt), and Vercel (vl) CLIs which typically require authentication tokens/credentials. The description also mentions SMS notifications but the instructions and metadata provide no explanation or required SMS credentials (e.g., Twilio API keys). Requesting no credentials in metadata while implying credentialed actions is disproportionate and unclear.

Persistence & Privilege

always is false and the skill is user-invocable only; it does not request persistent presence or modify other skills. It operates only within the user's project directory and Git history as described.

What to consider before installing

This skill is a text-only developer workflow and not executable code, but there are several inconsistencies you should resolve before relying on it: 1) Confirm the author/source (none provided). 2) The SKILL.md assumes you have and are authenticated to 'gt' (Graphite), 'gh' (GitHub), and 'vl'/'vercel' CLIs — make sure those tools are installed and you understand which accounts/tokens are used. 3) The description mentions SMS notifications but the instructions give no implementation or credential requirements — ask the publisher how SMS is sent and what credentials are needed. 4) When following instructions that create issues or post logs, review and sanitize any sensitive data (credentials, secrets, internal endpoints) before posting. 5) If you plan to use this skill in an automated agent, ensure the agent's access tokens follow least-privilege principles and that you are comfortable granting the agent access to the relevant repos/deploy systems. If the publisher cannot explain the SMS piece or why no credentials are declared, treat the skill as untrusted.

A 12-step production workflow that keeps context across compaction.

Workflow

1. Setup

cd ~/Projects/<project>

Create or append to TODO.md:

## [Date] Task: <description>
- [ ] Subtask 1
- [ ] Subtask 2

2-3. Execute & Track

Complete work, check off TODO items as done.

Update CHANGELOG.md (create if missing):

## [Unreleased]
### Added/Changed/Fixed
- Description of change

4-5. Stage & Verify

git add -A
git diff --staged  # Verify changes match request

6-7. Create PR

Branch naming: (issue|feature|fix)/<short-description>

gt create "feature/add-dark-mode" -m "Add dark mode toggle"
gt submit

If this fixes an issue, create the issue first:

gh issue create --title "Bug: description" --body "Details..."
# Note the issue number
gt create "issue/42-fix-login-bug" -m "Fix login bug (#42)"
gt submit

8-9. Review Cycle

Wait for reviewer comments. Address feedback:

# Make fixes
git add -A
gt modify -m "Address review feedback"
gt submit

10-11. Post-Merge Deploy Check

After PR merges:

git checkout main && git pull

For Vercel projects:

# Watch deployment (polls until Ready/Error, auto-fetches logs on failure)
vl

If build fails → gh issue create with error logs, restart from step 6.

12. Report & Cleanup

Report completion format:

✅ [Project] Task completed PR: <url> Deploy: success/failed

Quick Reference

Step	Command	Purpose
Stage	git add -A	Stage all changes
Verify	git diff --staged	Review before commit
Branch	gt create "type/name" -m "msg"	Create branch + commit
PR	gt submit	Push + create/update PR
Issue	gh issue create	Track bugs/tasks
Deploy	vl	Watch build, auto-fetch logs on error

Branch Prefixes

• feature/ — New functionality
• fix/ — Bug fixes
• issue/ — Linked to GitHub issue (include #number)
• chore/ — Maintenance, deps, config

Files to Maintain

• TODO.md — Active task tracking (survives context compaction)
• CHANGELOG.md — Version history
• PLAN.md — Architecture decisions (optional)

Tools Required

• gt — Graphite CLI for stacked PRs
• gh — GitHub CLI for issues
• vl — Vercel deploy watcher (or vercel CLI)