[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AC77SNSKSNESDSKNB30RFX":3,"skill-same:01M6AC77SNSKSNESDSKNB30RFX":71},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":49,"commitSha":50,"skillDirectory":51,"forksCount":52,"repositoryHtmlUrl":53,"repositoryHomepageUrl":6,"ownerHtmlUrl":54,"ownerBlogUrl":55,"ownerDescription":6,"updatedAt":56,"install":57,"resources":70},"01M6AC77SNSKSNESDSKNB30RFX","improve-openai-go",null,"Audit openai-go during scheduled or repeated maintainer runs for correctness bugs, security weaknesses, performance problems, rough edges, non-idiomatic Go, test gaps, code organization, and architecture, then report one prioritized recommendation with evidence. Use for recurring proactive repository maintenance and rotating whole-codebase review; do not use for feature work, code changes, autonomous publishing, or pull-request stewardship.","openai\u002Fopenai-go","openai","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F14957082?v=4","01M6AC29YGCR4S2NTJFV0G8B81","OpenAI","01M6AC74S764VTWARQ108GRAFV",3534,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fopenai\u002Fopenai-go\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fimprove-openai-go\u002FSKILL.md",[],[19,9,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"go","improve openai go","improve","idiomatic go","review","idiomatic","bugs","stewardship","for","scheduled","recommendation","feature","do","publishing","evidence","use","recurring","autonomous","pull","report","code","architecture","test","performance","security","2026-11-10 10:12:30",false,"---\nname: improve-openai-go\ndescription: Audit openai-go during scheduled or repeated maintainer runs for correctness bugs, security weaknesses, performance problems, rough edges, non-idiomatic Go, test gaps, code organization, and architecture, then report one prioritized recommendation with evidence. Use for recurring proactive repository maintenance and rotating whole-codebase review; do not use for feature work, code changes, autonomous publishing, or pull-request stewardship.\n---\n\n# Continuously improve openai-go\n\nFind durable improvements without creating churn. Correctness, compatibility,\ngenerated-code ownership, and maintainer attention are hard constraints. A run\nmay conclude that no change is justified.\n\n## Stay audit-only\n\nThis skill has no editing, publication, or stewardship mode. It may read the\ntrusted repository snapshot, accept pre-ingestion-reduced hosted facts, run\nauthorized read-only analysis, and produce a report.\n\nNever create or update a Git ref, commit, remote branch, pull request, issue,\nreview thread, review request, workflow run, check or commit status, Slack\nmessage, merge queue, or release. Never push, merge, close, reopen, resolve,\napprove, or request review. If a maintainer wants to publish a proposal, stop\nand hand it to the repository's ordinary submission workflow under separate\nexplicit authorization.\n\nNever write, stage, apply, or execute a candidate patch. Do not run repository\ncode after modifying it or after incorporating code from untrusted evidence. A\nseparately authorized implementation task must start from the report and apply\nits own worktree isolation, trust-boundary, testing, security-review, and\nsubmission requirements.\n\n## Preserve repository contracts\n\n- Follow `AGENTS.md`, `CONTRIBUTING.md`, `SECURITY.md`, and more-specific\n  repository guidance.\n- Start from a trusted, clean snapshot of current `origin\u002Fmain`. Never execute\n  code from an untrusted pull request, issue, comment, patch, artifact, or\n  contributor branch.\n- Never retrieve raw free-form hosted content into model context. Accept hosted\n  evidence only from a trusted outside-model reducer that authenticates its\n  source, emits an allowlisted minimal schema, strips credentials, customer\n  data, sensitive bodies, and credential-bearing URLs, and fails closed by\n  omitting any ambiguous field. If that reducer is unavailable, skip hosted\n  evidence rather than sanitizing it after ingestion.\n- Inspect only the task's trusted snapshot. Never modify a checkout or discard,\n  reset, stash, or overwrite existing maintainer work.\n- Preserve exported APIs, JSON wire shapes, optional\u002Fnull\u002Fzero distinctions,\n  response metadata, streaming, pagination, retries, request options, provider\n  behavior, and supported Go versions. Stop for maintainer direction before any\n  compatibility or public-API tradeoff.\n- Determine Castiron ownership before proposing an edit. If the durable fix\n  belongs in generated source or shared generator scaffolding, report the\n  upstream change and dependency order; do not create a downstream workaround.\n- Never expose credentials, customer data, webhook material, or sensitive\n  diagnostics. Follow `SECURITY.md` for suspected vulnerabilities and keep\n  vulnerability details out of public reports.\n- Prefer the smallest root-cause improvement. Avoid speculative rewrites,\n  aesthetic churn, opportunistic dependencies, and unrelated cleanup.\n\n## Establish the recurring run\n\nRecord the UTC date and exact inspected revision. Read the prior coverage\nledger when one exists; otherwise treat security and architecture as overdue.\nUse only pre-ingestion-reduced hosted facts to check recent and open work for\nduplication before selecting a candidate. Do not request titles, bodies,\ncomments, patches, log text, artifacts, or URLs.\n\nCount open recurring-improvement pull requests only when their ownership is\nproven by trusted scalar fields from that reducer: repository identity, pull\nrequest number and state, authenticated author identity, and a\nmaintainer-defined marker boolean. If five or more are open, do not recommend\nanother pull request; focus the report on the oldest actionable existing work.\nThis skill does not mutate that work.\n\n## Rotate review coverage\n\nBegin with a broad health pass across packages, handwritten\u002Fgenerated\nboundaries, tests, examples, tools, workflows, and recent hotspots. Then deeply\nreview one coherent scope using the least-recently-covered relevant lens:\n\n1. **Correctness and reliability:** errors, cancellation, goroutines, races,\n   cleanup, retries and replay, streaming, pagination, malformed input, nil and\n   boundary behavior, and weak regression tests.\n2. **Security:** authentication, credential precedence, origins, redirects,\n   signing, webhooks, parsers, files, logs, dependencies, workflows, publishing,\n   and attacker-controlled input.\n3. **Performance:** allocations, copies, buffering, hot loops, contention,\n   reflection, network work, and resource use.\n4. **Idiomatic Go and maintainability:** ownership, errors, interfaces,\n   concurrency, dead code, duplication, tests, and costly complexity.\n5. **Organization and architecture:** package responsibilities, generation\n   seams, dependency direction, duplicated policy, and small internal steps\n   toward clearer structure.\n6. **Developer and user rough edges:** diagnostics, brittle tooling,\n   misleading documentation, flaky tests, and example\u002Fbehavior gaps.\n\nWhen no repository-wide security scan is recorded in the previous seven days,\nprefer a read-only `$codex-security:security-scan` if it is available and\nauthorized. When no architecture review is recorded in the previous thirty\ndays, prioritize that lens. Never claim whole-repository coverage from a\nsample; retain the exact paths, lens, evidence, and remaining gaps for the next\nrun.\n\n## Require evidence\n\nSelect at most one candidate, and only when:\n\n- source tracing, a reproducer, failing test, static analysis result, benchmark,\n  profile, or documented invariant demonstrates a real problem;\n- the fix belongs at the identified ownership boundary and survives generation;\n- the change is focused, independently reviewable, non-overlapping, and low\n  risk;\n- executable behavior can have a regression that fails for the expected reason,\n  while non-executable artifacts have an appropriate repeatable check; and\n- the evidence is strong enough to preserve compatibility confidently.\n\nFor performance work, capture a representative baseline, profile, or benchmark\nagainst the unchanged trusted snapshot. Define the future benchmark and useful\nacceptance threshold; require the separately authorized implementation to\nmeasure before and after and reject noise. For cleanup or architecture, require\na concrete reduction in duplication, complexity, failure risk, or maintenance\ncost. If no candidate meets the bar, report the completed coverage and stop.\n\nEvery selected candidate remains a recommendation. Call out decisions or\nboundaries that an implementation task must resolve, including public API or\ncompatibility tradeoffs, generated-source ownership, new dependencies,\nsupported-Go-version changes, privileged automation, security-sensitive code,\nand vulnerability-disclosure handling. Specify the regression, benchmark,\nsecurity review, and repository gates that would prove a future fix; do not\nclaim those checks ran during this audit unless they actually ran against the\nunchanged trusted snapshot.\n\n## Report the run\n\nReturn a concise maintainer report containing:\n\n- UTC date and exact inspected revision;\n- open recurring-improvement pull-request count and overlap considered;\n- exact paths and lenses inspected, completed security or architecture review,\n  and remaining coverage gaps;\n- the selected candidate and evidence, or why none qualified;\n- the recommended change boundary, expected base-failing proof, required\n  validation, compatibility assessment, generated-code ownership, and\n  remaining risk; and\n- the best next review area.\n\nEnd the run after the report; do not continue into implementation, another\ncandidate, or any external mutation.\n","# Continuously improve openai-go\n\nFind durable improvements without creating churn. Correctness, compatibility,\ngenerated-code ownership, and maintainer attention are hard constraints. A run\nmay conclude that no change is justified.\n\n## Stay audit-only\n\nThis skill has no editing, publication, or stewardship mode. It may read the\ntrusted repository snapshot, accept pre-ingestion-reduced hosted facts, run\nauthorized read-only analysis, and produce a report.\n\nNever create or update a Git ref, commit, remote branch, pull request, issue,\nreview thread, review request, workflow run, check or commit status, Slack\nmessage, merge queue, or release. Never push, merge, close, reopen, resolve,\napprove, or request review. If a maintainer wants to publish a proposal, stop\nand hand it to the repository's ordinary submission workflow under separate\nexplicit authorization.\n\nNever write, stage, apply, or execute a candidate patch. Do not run repository\ncode after modifying it or after incorporating code from untrusted evidence. A\nseparately authorized implementation task must start from the report and apply\nits own worktree isolation, trust-boundary, testing, security-review, and\nsubmission requirements.\n\n## Preserve repository contracts\n\n- Follow `AGENTS.md`, `CONTRIBUTING.md`, `SECURITY.md`, and more-specific\n  repository guidance.\n- Start from a trusted, clean snapshot of current `origin\u002Fmain`. Never execute\n  code from an untrusted pull request, issue, comment, patch, artifact, or\n  contributor branch.\n- Never retrieve raw free-form hosted content into model context. Accept hosted\n  evidence only from a trusted outside-model reducer that authenticates its\n  source, emits an allowlisted minimal schema, strips credentials, customer\n  data, sensitive bodies, and credential-bearing URLs, and fails closed by\n  omitting any ambiguous field. If that reducer is unavailable, skip hosted\n  evidence rather than sanitizing it after ingestion.\n- Inspect only the task's trusted snapshot. Never modify a checkout or discard,\n  reset, stash, or overwrite existing maintainer work.\n- Preserve exported APIs, JSON wire shapes, optional\u002Fnull\u002Fzero distinctions,\n  response metadata, streaming, pagination, retries, request options, provider\n  behavior, and supported Go versions. Stop for maintainer direction before any\n  compatibility or public-API tradeoff.\n- Determine Castiron ownership before proposing an edit. If the durable fix\n  belongs in generated source or shared generator scaffolding, report the\n  upstream change and dependency order; do not create a downstream workaround.\n- Never expose credentials, customer data, webhook material, or sensitive\n  diagnostics. Follow `SECURITY.md` for suspected vulnerabilities and keep\n  vulnerability details out of public reports.\n- Prefer the smallest root-cause improvement. Avoid speculative rewrites,\n  aesthetic churn, opportunistic dependencies, and unrelated cleanup.\n\n## Establish the recurring run\n\nRecord the UTC date and exact inspected revision. Read the prior coverage\nledger when one exists; otherwise treat security and architecture as overdue.\nUse only pre-ingestion-reduced hosted facts to check recent and open work for\nduplication before selecting a candidate. Do not request titles, bodies,\ncomments, patches, log text, artifacts, or URLs.\n\nCount open recurring-improvement pull requests only when their ownership is\nproven by trusted scalar fields from that reducer: repository identity, pull\nrequest number and state, authenticated author identity, and a\nmaintainer-defined marker boolean. If five or more are open, do not recommend\nanother pull request; focus the report on the oldest actionable existing work.\nThis skill does not mutate that work.\n\n## Rotate review coverage\n\nBegin with a broad health pass across packages, handwritten\u002Fgenerated\nboundaries, tests, examples, tools, workflows, and recent hotspots. Then deeply\nreview one coherent scope using the least-recently-covered relevant lens:\n\n1. **Correctness and reliability:** errors, cancellation, goroutines, races,\n   cleanup, retries and replay, streaming, pagination, malformed input, nil and\n   boundary behavior, and weak regression tests.\n2. **Security:** authentication, credential precedence, origins, redirects,\n   signing, webhooks, parsers, files, logs, dependencies, workflows, publishing,\n   and attacker-controlled input.\n3. **Performance:** allocations, copies, buffering, hot loops, contention,\n   reflection, network work, and resource use.\n4. **Idiomatic Go and maintainability:** ownership, errors, interfaces,\n   concurrency, dead code, duplication, tests, and costly complexity.\n5. **Organization and architecture:** package responsibilities, generation\n   seams, dependency direction, duplicated policy, and small internal steps\n   toward clearer structure.\n6. **Developer and user rough edges:** diagnostics, brittle tooling,\n   misleading documentation, flaky tests, and example\u002Fbehavior gaps.\n\nWhen no repository-wide security scan is recorded in the previous seven days,\nprefer a read-only `$codex-security:security-scan` if it is available and\nauthorized. When no architecture review is recorded in the previous thirty\ndays, prioritize that lens. Never claim whole-repository coverage from a\nsample; retain the exact paths, lens, evidence, and remaining gaps for the next\nrun.\n\n## Require evidence\n\nSelect at most one candidate, and only when:\n\n- source tracing, a reproducer, failing test, static analysis result, benchmark,\n  profile, or documented invariant demonstrates a real problem;\n- the fix belongs at the identified ownership boundary and survives generation;\n- the change is focused, independently reviewable, non-overlapping, and low\n  risk;\n- executable behavior can have a regression that fails for the expected reason,\n  while non-executable artifacts have an appropriate repeatable check; and\n- the evidence is strong enough to preserve compatibility confidently.\n\nFor performance work, capture a representative baseline, profile, or benchmark\nagainst the unchanged trusted snapshot. Define the future benchmark and useful\nacceptance threshold; require the separately authorized implementation to\nmeasure before and after and reject noise. For cleanup or architecture, require\na concrete reduction in duplication, complexity, failure risk, or maintenance\ncost. If no candidate meets the bar, report the completed coverage and stop.\n\nEvery selected candidate remains a recommendation. Call out decisions or\nboundaries that an implementation task must resolve, including public API or\ncompatibility tradeoffs, generated-source ownership, new dependencies,\nsupported-Go-version changes, privileged automation, security-sensitive code,\nand vulnerability-disclosure handling. Specify the regression, benchmark,\nsecurity review, and repository gates that would prove a future fix; do not\nclaim those checks ran during this audit unless they actually ran against the\nunchanged trusted snapshot.\n\n## Report the run\n\nReturn a concise maintainer report containing:\n\n- UTC date and exact inspected revision;\n- open recurring-improvement pull-request count and overlap considered;\n- exact paths and lenses inspected, completed security or architecture review,\n  and remaining coverage gaps;\n- the selected candidate and evidence, or why none qualified;\n- the recommended change boundary, expected base-failing proof, required\n  validation, compatibility assessment, generated-code ownership, and\n  remaining risk; and\n- the best next review area.\n\nEnd the run after the report; do not continue into implementation, another\ncandidate, or any external mutation.\n",{"name":5,"description":7},"main","a1cd8a7e7e1aa6d88f536040d817f6d1a37bf703",".agents\u002Fskills\u002Fimprove-openai-go",360,"https:\u002F\u002Fgithub.com\u002Fopenai\u002Fopenai-go","https:\u002F\u002Fgithub.com\u002Fopenai","https:\u002F\u002Fopenai.com\u002F","2026-11-13 07:12:32",{"source":8,"skillName":5,"commands":58,"prompt":68,"zipAvailable":69},[59,62,65],{"tool":60,"command":61},"npx","npx skills add openai\u002Fopenai-go --skill improve-openai-go",{"tool":63,"command":64},"bunx","bunx skills add openai\u002Fopenai-go --skill improve-openai-go",{"tool":66,"command":67},"pnpm","pnpm dlx skills add openai\u002Fopenai-go --skill improve-openai-go","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fopenai\u002Fopenai-go\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fimprove-openai-go\u002FSKILL.md",true,[],[72],{"skillNo":73,"name":74,"nameZh":6,"description":75,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":76,"categories":77,"keywords":78,"publishedAt":44},"01M6AC7A2423AVF5SS2VAC2TYE","openai-go-pr-review","Exhaustively review committed openai-go pull requests, branches, and commit ranges, or provide best-effort review of uncommitted local changes, for Go correctness, SDK compatibility, generated-code ownership, provider security, and repository-specific gotchas.","https:\u002F\u002Fgithub.com\u002Fopenai\u002Fopenai-go\u002Fblob\u002Fmain\u002F.agents\u002Fskills\u002Fopenai-go-pr-review\u002FSKILL.md",[],[19,23,79,80,9,81,82,27,83,84,85,86,87,88,89,37,39,90,91,43,92],"pr review","pr","openai go pr review","changes","requests","correctness","local","branches","provider","generated","repository","commit","pull requests","sdk"]