Project Management Guru (ADHD)

The skill describes active integrations (Slack DMs, calendar API, GitHub webhooks, scheduling) and runtime behaviors (monitoring commits/DND, sending reminders). Yet the registry metadata declares no required env vars, no config paths, and no install steps. Realistically those capabilities need API tokens/URLs and webhook setup; the absence of any declared credentials or integration configuration is an incoherence.

SKILL.md and reference files contain explicit instructions to call functions like send_slack_dm, schedule_task, schedule_followup_checkin, prompt_user and to read calendar/events/commit activity. Those are actionable runtime operations that go beyond passive advice — they require network access and credentials. The instructions do not declare how those functions will be provided nor constrain what data may be read or sent.

There is no install spec and no code files executed by the platform; this lowers file-system/write risk. The included reference files contain example code snippets, but nothing in the package automatically downloads or installs external code.

The skill clearly expects access to external services (Slack, calendar, GitHub, optional time-tracking), yet requires.env is empty and no primaryEnv is declared. If the skill were to be granted tokens later, it should request minimal, narrowly-scoped credentials (e.g., a Slack bot token limited to sending DMs). As-is, the spec gives no justification for how credentials would be supplied or limited.

always:false (normal). The skill allows autonomous model invocation (default). Autonomous invocation combined with networked integrations would increase blast radius, but autonomy alone is expected for skills. If you grant service credentials, consider the implications of enabling autonomous runs that can send messages or schedule actions without per-invocation approval.