Primary finding
gh api commits step constructs an invalid query — `-f path=` is not a list-commits filter that gh forwards correctly
mediumbugmedium
- skills/skill-update-check/SKILL.md:28-33
`gh api` with `-f` sends form fields as POST body parameters by default for non-GET-default endpoints, but the commits endpoint is GET. In practice gh promotes `-f` to a query string for GET endpoints, however the documented form for list-commits requires `path` as a query parameter — using `-f` here actually works, but only because gh treats `-f` as querystring for GET. More importantly, `{source_repo}` and `{source_path}` are placeholder syntax that the skill never substitutes — there is no instruction (e.g., shell variable expansion or jq templating) telling the operator/agent to interpolate values from the lock file entry into the gh command. A literal execution would call `repos/{source_repo}/commits` and 404. Same issue recurs in steps 5 and 6.
Recommendation
Add an explicit substitution step (e.g., `repo=$(jq -r .source_repo <<<"$entry")` and use `"repos/$repo/commits"`), or state clearly that `{source_repo}` etc. are placeholders to be substituted by the agent before invocation.