GitCode Issue Reply

Name/description (generate reply drafts for a GitCode issue) match the implementation: scripts fetch issue data, assemble prompts, and can post comments. The single required secret is GITCODE_TOKEN which is necessary and appropriate for calling the GitCode API.

SKILL.md is explicit and scoped: it only runs the included scripts (prepare_issue_reply.py, post_comment.py), requires user confirmation before posting, and instructs where to write temporary files. One noteworthy behavior: if the requests library is present, prepare_issue_reply.py will call the DeepWiki MCP endpoint (mcp.deepwiki.com) with repository and question data to enrich the prompt — this transmits repo/issue content to an external service. The skill otherwise does not read unrelated files or other credentials.

No install spec (instruction-only with bundled scripts). Nothing is downloaded from external URLs or installed automatically; scripts run from the skill directory. This is a low-risk install profile.

The only required environment variable is GITCODE_TOKEN (declared as primary), which is appropriate. get_token also attempts to read Windows user/machine environment variables via a PowerShell call when process env lacks the token — behavior is consistent with trying multiple env scopes. The privacy concern is optional: issue/repo text may be sent to a third-party DeepWiki endpoint when requests is installed.

The skill is not always-enabled and does not request system-wide persistence or modify other skills. It only posts comments when the user explicitly confirms; first-round behavior is read-only.