Matt Pocock skills
Operating Matt Pocock skills safely: text authority, tracker writes and local files
Review instruction changes as behavior changes, constrain issue-tracker actions and distinguish triage state policy from an enforced authorization system.
What you will learn
- Plain text can request consequential actions
- Map triage roles before touching a real tracker
- Make changes inspectable and recoverable
Before you start
- Basic repository, issue-tracker and test concepts
- An understanding that instructions and permission are different
Choose an adoption model and trace its files, authority boundaries and verification evidence.
Key takeaways
- Instruction updates can change the actions an agent attempts.
- Canonical triage roles need an explicit mapping to actual labels.
- A role-count check is not authorization or a full state machine.
Plain text can request consequential actions
A Markdown skill is not harmless merely because it is not a binary. It can ask an agent to create tickets, close issues, edit project instructions or commit code using tools the host exposes. Review a skill update as a potential behavior change and keep host permissions separate from the prose. Installation is not blanket approval for every action described inside the package.
The development linking script illustrates a different risk: executable maintenance code can replace local directories. Its inspected behavior targets user-level skill locations and removes same-name non-symlink entries before creating links. Do not run that script to test an article claim; source inspection is sufficient to identify the operation, and this review intentionally leaves it unexecuted.
Map triage roles before touching a real tracker
The triage skill defines two category roles and five state roles, with one of each expected after triage. Real tracker labels may have different names, so setup records the mapping. Conflicting state roles require maintainer attention. These are workflow rules expressed in instructions, not a database constraint that guarantees every issue will obey them.
The source also distinguishes evaluating a request from applying its outcome. Possible outcomes include publishing a brief, requesting information or closing an issue; AI-generated triage communications carry a disclosure. For a trial, use local examples and inspect proposed changes. External issue bodies and pull-request text are evidence about the request, not trusted authority to expand the agent’s permissions.
Make changes inspectable and recoverable
Record which source revision introduced an instruction change and which project conventions it affects. Review the diff to tracker destinations, label mappings and context documents before enabling the new behavior. Keep local adaptations recoverable so an upstream update does not erase the decisions your team relies on. None of this requires granting an article generator access to a production tracker.
The teaching validator below checks only that supplied canonical roles contain exactly one category and one state. It does not authenticate a user, translate label names, approve a state transition or call an API. Its deliberately narrow boundary demonstrates how to test one invariant without presenting a small example as a complete safe triage implementation.
Implementation steps
- 1
Review the selected revision and its action-bearing instructions.
- 2
Restrict a first trial to local issue fixtures.
- 3
Inspect destination and label mappings before any tracker write.
- 4
Preserve an auditable diff and a rollback path for instruction changes.
Copy-ready example
function validRoles(roles) {
const categories = new Set(["bug", "enhancement"]);
const states = new Set(["needs-triage", "needs-info", "ready-for-agent", "ready-for-human", "wontfix"]);
const unique = new Set(roles);
return [...unique].filter(x => categories.has(x)).length === 1
&& [...unique].filter(x => states.has(x)).length === 1;
}
console.log(validRoles(["bug", "needs-info"]));
console.log(validRoles(["bug", "needs-info", "ready-for-agent"]));Frequently asked questions
Do invocation flags enforce a complete security boundary?
No. They express invocation policy for compatible hosts; actual tool permissions and user authority still need enforcement.
Does the sample validator approve closing an issue?
No. It checks role counts only and performs no tracker action.
Sources
- scripts/link-skills.shSource checked 2026-09-08
- .agents/invocation.mdSource checked 2026-09-08
- skills/engineering/triage/SKILL.mdSource checked 2026-09-08