SkillsVote Skill Governance

The README says the hosted integration requires SKILLS_VOTE_API_KEY and GH_TOKEN and describes recommendation and post-task feedback, but does not explain permission scope, exact data flows, or key protection; least privilege, data flow transparency, and sensitive data handling therefore score 1. The setup prompt does not specify step-by-step approval or confirmation. The dependency list has version ranges and pins but no security audit evidence. Remote service use and post-task feedback are disclosed at a high level, while revocation or recovery is not described. A paper citation, author list, project name, and MIT license provide some attribution evidence, supporting a score of 2 for source attribution.

The README is broadly consistent about hosted and local integrations, capabilities, and unfinished roadmap items. pyproject.toml specifies Python and dependency constraints, supporting a self-consistency score of 2. Some dependencies are bounded or pinned, but no availability guarantees are given, so dependency availability scores 1. The provided material does not describe error handling or failure messages, so that criterion scores 0.

The README targets coding, research, and workflow agents and distinguishes hosted service use from local or private skill libraries, earning 2 for audience and scenarios. It states that local recommendation can avoid the hosted index and marks local attribution and evolution as unfinished roadmap work, earning 2 for capability boundaries. Timing is summarized as recommendation before a task and feedback after it, without precise trigger conditions, so trigger precision scores 1. Setup instructions cover Windows, macOS/Linux, and Python 3.12+, supporting an environment fit score of 2.

The README organizes material into product overview, roadmap, evaluation, quick start, and citation sections, earning 2 for information architecture. It gives hosted and local installation steps and points to configuration guidance, though the full configuration document was not provided, so install notes score 2. Skill and package names are stable in the supplied material, earning 2 for naming stability. Quick-start examples are present but no FAQ is shown, so examples and FAQ score 1. The roadmap identifies local attribution/evolution and experiment trajectories as unreleased, earning 2 for known limitations. The LICENSE file presents the MIT terms in full, earning 3. pyproject.toml declares version 1.2.0 and the README lists dated release news, earning 2 for versioning and changelog. MemTensor/OpenMem are named, but no clear maintenance owner or update responsibility is described, so maintenance responsibility scores 1.

The stated product goal is to recommend skills on demand, attribute task outcomes, and feed results into skill evolution; the README also names local recommendation modes. The supplied material lacks output formats, concrete use results, or detailed operating flows, so output usability scores 1. The lifecycle connection between collection, recommendation, attribution, and evolution is clearly stated, supporting marginal value of 2. Hosted use requires API credentials and the dependency list is substantial; local use requires configuration. Costs and benefits are not quantified, so cost-benefit scores 1.

The README names evaluation benchmarks, points to a reproduction document, and cites a paper, but the underlying data and itemized evidence for scale and performance claims are absent from the supplied material; claim traceability scores 1. The README and pyproject.toml offer limited cross-checks for project identity, dependencies, version, and setup, but the cited experiment document, code, and result files were not provided, so cross-source corroboration scores 1. The README distinguishes released features from roadmap items and points performance claims to a paper and experiment document; however, the supplied material does not separate each numerical or outcome claim from verifiable evidence, so fact-inference separation scores 1.