Thanks Star

Thanks Star

Thank the verified upstream repository only after a download, clone, or install succeeds. Treat a GitHub star as an external account change, not as part of the download permission.

Requirements

• Use Python 3.9 or later.
• Use an authenticated GitHub CLI session (gh auth status).
• Resolve ` to the directory containing this SKILL.md` before running the bundled script.
• Never request, print, or store a GitHub token. Let gh manage authentication.

Workflow

1. Preserve the exact source supplied to the successful download or install command. Prefer an OWNER/REPO value, GitHub URL, installed Skill directory, or local Git checkout.
2. Confirm the acquisition succeeded. Do not star after search, preview, failed download, failed clone, or failed install.
3. Immediately after installing this Skill, or at its first activation when same-turn invocation is unavailable, read the policy:

``text python /scripts/thanks_star.py --json policy show ``

1. If onboarding_required is true, ask exactly one standing-authorization question before any GitHub lookup:

> Thanks Star 默认使用自动模式。是否确认今后在 Agent 成功获取开源项目后，自动为明确识别出的 GitHub 上游仓库点 Star？每次新增点赞都会提示您。

Handle the answer as follows:

• Explicit yes: run policy set auto --authorize-account-changes, then continue with the preserved source.
• Explicit no: run policy set off and stop.
• Explicit request for per-repository confirmation: run policy set ask, then continue in ask mode.
• No answer or ambiguous answer: stop. Do not resolve a repository or change GitHub.

1. If the configured policy is off, stop without resolving or starring anything.
2. Run the operation with the preserved source:

``text python /scripts/thanks_star.py --json thank ``

1. Handle the returned status exactly:

• initial_confirmation_required: follow step 4. This is a defensive result when onboarding was skipped; make no GitHub lookup first.
• confirmation_required: the user selected ask; ask, “已确认上游为 OWNER/REPO。是否给该仓库点 Star？” Run again with --approve only after an explicit yes.
• starred: always tell the user, “您已为 OWNER/REPO 点赞。” Localize when the conversation uses another language.
• already_starred: say it was already starred only when useful; never imply a new change.
• skipped_unverified: do not ask for approval and do not star. Briefly identify the unresolved source when relevant.
• disabled: make no account change and do not nag the user.
• would_star: report that this was a dry run; never imply an account change.

1. In ask mode, after approval for this exact repository, run:

``text python /scripts/thanks_star.py --json thank --approve ``

Do not reuse one-repository approval for another repository. In configured auto mode, do not ask again; notify after every new star.

Policy modes

When no policy exists, default to auto with onboarding_required: true. This pending state is not authorization and performs zero GitHub lookup or mutation until the user confirms once.

• auto: the default after one-time standing authorization; star verified upstream repositories without further questions and notify after every new star.
• ask: require explicit approval for each previously unstarred repository.
• off: perform no lookup and no star action.

Show or change the policy with:

python /scripts/thanks_star.py --json policy show
python /scripts/thanks_star.py --json policy set ask
python /scripts/thanks_star.py --json policy set off

After explicit first-time or later standing authorization, enable auto with:

python /scripts/thanks_star.py --json policy set auto --authorize-account-changes

Never add the authorization flag based only on a download, installation, generic automation request, or silence.

Source rules

• Accept only public repositories on github.com.
• Resolve GitHub-declared forks to the root source repository.
• Resolve a declared mirror only when its upstream is itself an unambiguous GitHub repository; otherwise skip it.
• Use installer-injected metadata.github-repo, metadata.github-ref, and metadata.github-tree-sha together as Skill provenance.
• Prefer a local Git upstream remote. If it exists but is not GitHub, skip instead of falling back to a GitHub mirror in origin.
• Otherwise inspect origin, then verify it through the GitHub API.
• Skip local archives without trusted provenance, non-GitHub sources, private repositories, deleted repositories, and malformed inputs.
• Never star every repository owned by an author or organization.
• Never star the fork or mirror merely because it was downloaded.
• Never guess an upstream from a package name, README text, search result, or repository contents.
• Never unstar a repository.

The GitHub API's fork and mirror metadata cannot identify an undeclared manual copy. If the available evidence cannot establish provenance, skip.

Read-only inspection

Inspect resolution without checking or changing star state:

python /scripts/thanks_star.py --json inspect 

Preview the complete configured policy decision without changing GitHub:

python /scripts/thanks_star.py --json thank  --dry-run

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: 952JO
• Source: 952JO/thanks-star
• License: MIT

Install and usage instructions live in the source repository linked above.